Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    655s
  • max time network
    659s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 00:42

Errors

Reason
Machine shutdown

General

  • Target

    New Client.exe

  • Size

    167KB

  • MD5

    774fff2810fc115bab05707f73047457

  • SHA1

    6dbf565150aa9a791e0f9f345243984ec6f5fa5a

  • SHA256

    11478265d9ce8d9c390a3c28960972d1c4fa3e1a532183d7ea7e3cdd039f688d

  • SHA512

    dc5a9dd495b912f386b668c95622addce7ebb7fa23a93ffec144c2766695c94a4c00534e567d3a153009987e3fe2683d9715d058a677a20ce498dfcc2276c96a

  • SSDEEP

    3072:pVMADoN36tnQviFCtABnKfWl9zmaF9byYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:pui9z9vM1/JdSI5eb

Malware Config

Signatures

  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Detect Neshta payload 19 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 1 IoCs
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 20 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 8 IoCs
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 56 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Client.exe
    "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Users\Admin\AppData\Roaming\discord.exe
      "C:\Users\Admin\AppData\Roaming\discord.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f im discord.exe
        3⤵
        • Kills process with taskkill
        PID:2972
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4352
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
        3⤵
        • DcRat
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5108
      • C:\Windows\SysWOW64\eventvwr.exe
        "C:\Windows\System32\eventvwr.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\SysWOW64\mmc.exe
          "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4604
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\eventvwr.msc" "C:\Windows\system32\eventvwr.msc"
            5⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3956
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\SysWOW64\choice.exe
        choice /C Y /N /D Y /T 5
        3⤵
          PID:4296
    • C:\Users\Admin\AppData\Roaming\discord.exe
      C:\Users\Admin\AppData\Roaming\discord.exe
      1⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f im discord.exe
        2⤵
        • Kills process with taskkill
        PID:1880
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1164
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
        2⤵
        • DcRat
        • System Location Discovery: System Language Discovery
        PID:3152
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn MicrosoftEdgeUpdateTaskMachine /tr C:\Users\Admin\AppData\Roaming\discord.exe
        2⤵
        • DcRat
        • Scheduled Task/Job: Scheduled Task
        PID:4528
      • C:\Users\Admin\AppData\Local\Temp\390efcf5eb4a44d99da1269e043ebd5d.exe
        "C:\Users\Admin\AppData\Local\Temp\390efcf5eb4a44d99da1269e043ebd5d.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3176
        • C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
          "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:440
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
            4⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:3256
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
              5⤵
                PID:4396
                • C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
                  "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
                  6⤵
                  • DcRat
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:2488
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\foiIXd0asT.bat"
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3048
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      8⤵
                        PID:4760
                      • C:\Recovery\WindowsRE\unsecapp.exe
                        "C:\Recovery\WindowsRE\unsecapp.exe"
                        8⤵
                        • Executes dropped EXE
                        PID:2600
            • C:\Users\Admin\AppData\Local\Temp\Locker.exe
              "C:\Users\Admin\AppData\Local\Temp\Locker.exe"
              3⤵
              • Executes dropped EXE
              • Enumerates connected drives
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              • Modifies Control Panel
              PID:436
          • C:\Users\Admin\AppData\Local\Temp\4f1cf730d4ce4c29b30600eaad3df6e6.exe
            "C:\Users\Admin\AppData\Local\Temp\4f1cf730d4ce4c29b30600eaad3df6e6.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5048
            • C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
              "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4520
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
                4⤵
                • Checks computer location settings
                PID:4804
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
                  5⤵
                    PID:3664
                    • C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
                      "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:3196
              • C:\Users\Admin\AppData\Local\Temp\Unlocker.exe
                "C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"
                3⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Sets desktop wallpaper using registry
                • Modifies Control Panel
                PID:4052
            • C:\Users\Admin\AppData\Local\Temp\7823b8a2bb434f1aacfc9fb759e07707.exe
              "C:\Users\Admin\AppData\Local\Temp\7823b8a2bb434f1aacfc9fb759e07707.exe"
              2⤵
              • UAC bypass
              • Disables RegEdit via registry modification
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Drops file in Windows directory
              • System policy modification
              PID:3268
              • C:\Windows\System32\taskkill.exe
                "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
                3⤵
                • Kills process with taskkill
                PID:2076
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\explorer.exe"
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                PID:396
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  4⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2888
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                PID:3224
                • C:\Windows\SysWOW64\taskkill.exe
                  C:\Windows\System32\taskkill.exe /f /im explorer.exe
                  4⤵
                  • Kills process with taskkill
                  PID:2148
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
                3⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Windows directory
                PID:3540
                • C:\Windows\SysWOW64\taskkill.exe
                  C:\Windows\System32\taskkill.exe /f /im explorer.exe
                  4⤵
                  • Kills process with taskkill
                  PID:4272
            • C:\Users\Admin\AppData\Local\Temp\46fad423a4bc46e4ae4667d7213ed61e.exe
              "C:\Users\Admin\AppData\Local\Temp\46fad423a4bc46e4ae4667d7213ed61e.exe"
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:5084
              • C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
                "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4296
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
                  4⤵
                  • Checks computer location settings
                  PID:4524
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
                    5⤵
                      PID:2136
                      • C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
                        "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
                        6⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:4324
                        • C:\Windows\svchost.com
                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\NVIDIA~1.EXE"
                          7⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          PID:3044
                          • C:\Users\Admin\AppData\Local\Temp\3582-490\NVIDIA~1.EXE
                            C:\Users\Admin\AppData\Local\Temp\3582-490\NVIDIA~1.EXE
                            8⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Drops file in Windows directory
                            • Modifies registry class
                            PID:3792
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xWWlAsg7Jh.bat"
                              9⤵
                                PID:4004
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  10⤵
                                    PID:4864
                                  • C:\Users\Public\discord.exe
                                    "C:\Users\Public\discord.exe"
                                    10⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:516
                                    • C:\Windows\svchost.com
                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\discord.exe"
                                      11⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:116
                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\discord.exe
                                        C:\Users\Admin\AppData\Local\Temp\3582-490\discord.exe
                                        12⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Drops file in Windows directory
                                        PID:1784
                                        • C:\NVIDIA\DisplayDriver\535.21\winlogon.exe
                                          "C:\NVIDIA\DisplayDriver\535.21\winlogon.exe"
                                          13⤵
                                          • Executes dropped EXE
                                          PID:2756
                    • C:\Users\Admin\AppData\Local\Temp\navalny pass - 2000.exe
                      "C:\Users\Admin\AppData\Local\Temp\navalny pass - 2000.exe"
                      3⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies system executable filetype association
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      PID:4176
                      • C:\Users\Admin\AppData\Local\Temp\3582-490\navalny pass - 2000.exe
                        "C:\Users\Admin\AppData\Local\Temp\3582-490\navalny pass - 2000.exe"
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        PID:3044
                        • C:\Windows\svchost.com
                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\WINLOC~1.EXE"
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:1564
                          • C:\Users\Admin\AppData\Local\Temp\WINLOC~1.EXE
                            C:\Users\Admin\AppData\Local\Temp\WINLOC~1.EXE
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of FindShellTrayWindow
                            PID:3232
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c "TASKKILL /F /IM "explorer.exe""
                              7⤵
                                PID:1212
                                • C:\Windows\SysWOW64\taskkill.exe
                                  TASKKILL /F /IM "explorer.exe"
                                  8⤵
                                  • Kills process with taskkill
                                  PID:832
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f im discord.exe
                      2⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      PID:3244
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4944
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                      2⤵
                        PID:1856
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f im discord.exe
                        2⤵
                        • Kills process with taskkill
                        PID:3796
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                        2⤵
                          PID:3744
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                          2⤵
                            PID:1276
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f im discord.exe
                            2⤵
                            • Kills process with taskkill
                            PID:2004
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:2536
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                            2⤵
                            • DcRat
                            PID:1692
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f im discord.exe
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            PID:4496
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                            2⤵
                              PID:2768
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                              2⤵
                                PID:1076
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f im discord.exe
                                2⤵
                                • Kills process with taskkill
                                PID:1824
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:4468
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                2⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:1432
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f im discord.exe
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                PID:5116
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:3804
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                2⤵
                                  PID:4116
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f im discord.exe
                                  2⤵
                                  • Kills process with taskkill
                                  PID:3648
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4384
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1412
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f im discord.exe
                                  2⤵
                                  • Kills process with taskkill
                                  PID:4608
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                  2⤵
                                    PID:116
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                    2⤵
                                      PID:5044
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f im discord.exe
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      • Kills process with taskkill
                                      PID:2780
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                      2⤵
                                        PID:924
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                        2⤵
                                          PID:1220
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f im discord.exe
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          • Kills process with taskkill
                                          PID:4760
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                          2⤵
                                            PID:1020
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1716
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f im discord.exe
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            PID:4908
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                            2⤵
                                              PID:3776
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                              2⤵
                                              • DcRat
                                              PID:3612
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /f im discord.exe
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Kills process with taskkill
                                              PID:3520
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                              2⤵
                                                PID:3088
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                2⤵
                                                  PID:2972
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill /f im discord.exe
                                                  2⤵
                                                  • Kills process with taskkill
                                                  PID:164
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                  2⤵
                                                    PID:4008
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                    2⤵
                                                    • DcRat
                                                    • System Location Discovery: System Language Discovery
                                                    PID:768
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /f im discord.exe
                                                    2⤵
                                                    • Kills process with taskkill
                                                    PID:4260
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                    2⤵
                                                      PID:5008
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                      2⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2380
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /f im discord.exe
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Kills process with taskkill
                                                      PID:3700
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                      2⤵
                                                        PID:3972
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                        2⤵
                                                        • DcRat
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2736
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f im discord.exe
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Kills process with taskkill
                                                        PID:3624
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2996
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                        2⤵
                                                        • DcRat
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1636
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f im discord.exe
                                                        2⤵
                                                        • Kills process with taskkill
                                                        PID:1900
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                        2⤵
                                                          PID:1896
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                          2⤵
                                                          • DcRat
                                                          PID:5024
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /f im discord.exe
                                                          2⤵
                                                          • Kills process with taskkill
                                                          PID:4112
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4324
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                          2⤵
                                                          • DcRat
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4364
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /f im discord.exe
                                                          2⤵
                                                          • Kills process with taskkill
                                                          PID:3376
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                          2⤵
                                                            PID:5012
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                            2⤵
                                                            • DcRat
                                                            PID:4032
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f im discord.exe
                                                            2⤵
                                                            • Kills process with taskkill
                                                            PID:3500
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                            2⤵
                                                              PID:2884
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                              2⤵
                                                                PID:3716
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f im discord.exe
                                                                2⤵
                                                                • Kills process with taskkill
                                                                PID:4848
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2912
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                2⤵
                                                                • DcRat
                                                                PID:4168
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f im discord.exe
                                                                2⤵
                                                                • Kills process with taskkill
                                                                PID:4272
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                2⤵
                                                                  PID:428
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                  2⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:1400
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /f im discord.exe
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Kills process with taskkill
                                                                  PID:4000
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                  2⤵
                                                                    PID:4844
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                    2⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:216
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /f im discord.exe
                                                                    2⤵
                                                                    • Kills process with taskkill
                                                                    PID:4480
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                    2⤵
                                                                      PID:2624
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                      2⤵
                                                                      • DcRat
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:3060
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /f im discord.exe
                                                                      2⤵
                                                                      • Kills process with taskkill
                                                                      PID:836
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4972
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                      2⤵
                                                                      • DcRat
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:3992
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /f im discord.exe
                                                                      2⤵
                                                                      • Kills process with taskkill
                                                                      PID:3960
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2280
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                      2⤵
                                                                      • DcRat
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3224
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /f im discord.exe
                                                                      2⤵
                                                                      • Kills process with taskkill
                                                                      PID:2420
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2108
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                      2⤵
                                                                      • DcRat
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:4180
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /f im discord.exe
                                                                      2⤵
                                                                      • Kills process with taskkill
                                                                      PID:4084
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4912
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                      2⤵
                                                                        PID:4088
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        taskkill /f im discord.exe
                                                                        2⤵
                                                                        • Kills process with taskkill
                                                                        PID:2792
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3424
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                        2⤵
                                                                        • DcRat
                                                                        PID:4228
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        taskkill /f im discord.exe
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Kills process with taskkill
                                                                        PID:4936
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                        2⤵
                                                                          PID:1892
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                          2⤵
                                                                          • DcRat
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4052
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          taskkill /f im discord.exe
                                                                          2⤵
                                                                          • Kills process with taskkill
                                                                          PID:760
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                          2⤵
                                                                            PID:3608
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4820
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f im discord.exe
                                                                            2⤵
                                                                            • Kills process with taskkill
                                                                            PID:5080
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                            2⤵
                                                                              PID:5096
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1228
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /f im discord.exe
                                                                              2⤵
                                                                              • Kills process with taskkill
                                                                              PID:2356
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                              2⤵
                                                                                PID:4040
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                2⤵
                                                                                  PID:3872
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /f im discord.exe
                                                                                  2⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:3656
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                  2⤵
                                                                                    PID:5084
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                    2⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:3488
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /f im discord.exe
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Kills process with taskkill
                                                                                    PID:3456
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                    2⤵
                                                                                      PID:3560
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                      2⤵
                                                                                      • DcRat
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4276
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /f im discord.exe
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Kills process with taskkill
                                                                                      PID:1984
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                      2⤵
                                                                                        PID:4916
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                        2⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:3048
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /f im discord.exe
                                                                                        2⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Kills process with taskkill
                                                                                        PID:1116
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                        2⤵
                                                                                          PID:1108
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                          2⤵
                                                                                            PID:3892
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            taskkill /f im discord.exe
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Kills process with taskkill
                                                                                            PID:4652
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                            2⤵
                                                                                              PID:3380
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                              2⤵
                                                                                              • DcRat
                                                                                              PID:3636
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /f im discord.exe
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Kills process with taskkill
                                                                                              PID:2604
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                              2⤵
                                                                                                PID:2640
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                2⤵
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:1728
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f im discord.exe
                                                                                                2⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:3564
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                2⤵
                                                                                                  PID:2532
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                  2⤵
                                                                                                  • DcRat
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3464
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  taskkill /f im discord.exe
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Kills process with taskkill
                                                                                                  PID:4440
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                  2⤵
                                                                                                    PID:2500
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                    2⤵
                                                                                                      PID:716
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      taskkill /f im discord.exe
                                                                                                      2⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:1268
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                      2⤵
                                                                                                        PID:2344
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                        2⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:3540
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        taskkill /f im discord.exe
                                                                                                        2⤵
                                                                                                        • Kills process with taskkill
                                                                                                        PID:4056
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                        2⤵
                                                                                                          PID:3936
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                          2⤵
                                                                                                            PID:2872
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            taskkill /f im discord.exe
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Kills process with taskkill
                                                                                                            PID:744
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3312
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                            2⤵
                                                                                                              PID:1528
                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                              taskkill /f im discord.exe
                                                                                                              2⤵
                                                                                                              • Kills process with taskkill
                                                                                                              PID:4160
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                              2⤵
                                                                                                                PID:2160
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                2⤵
                                                                                                                • DcRat
                                                                                                                PID:2584
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /f im discord.exe
                                                                                                                2⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:4920
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                                2⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:516
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                2⤵
                                                                                                                  PID:5016
                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                  taskkill /f im discord.exe
                                                                                                                  2⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  PID:1156
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1632
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                  2⤵
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:4444
                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                  taskkill /f im discord.exe
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Kills process with taskkill
                                                                                                                  PID:3736
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                                  2⤵
                                                                                                                    PID:3812
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                    2⤵
                                                                                                                      PID:920
                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                      taskkill /f im discord.exe
                                                                                                                      2⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      PID:2196
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                                      2⤵
                                                                                                                        PID:1792
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                        2⤵
                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                        PID:2880
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill /f im discord.exe
                                                                                                                        2⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:2292
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
                                                                                                                        2⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4380
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                        2⤵
                                                                                                                        • DcRat
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2804
                                                                                                                    • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3652
                                                                                                                    • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3968
                                                                                                                    • C:\Windows\system32\OpenWith.exe
                                                                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:4304
                                                                                                                    • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3952
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:4540
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:232
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:2536
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\services.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:1196
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\services.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:1532
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\services.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:3672
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:4944
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:3308
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:1664
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:2768
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:4496
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:2632
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:1020
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:4008
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:3792
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:2068
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:4356
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:2872
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\dwm.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:2076
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\dwm.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:3196
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\dwm.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:4720
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "LockerL" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\Locker.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • DcRat
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:1480
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "Locker" /sc ONLOGON /tr "'C:\Windows\ShellComponents\Locker.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:3416
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "LockerL" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\Locker.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:1632
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:1700
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:1192
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:4900
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Registry.exe'" /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:4808
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:2356
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:2464
                                                                                                                    • C:\Windows\system32\mspaint.exe
                                                                                                                      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Fixed.TestEnable.jpg" /ForceBootstrapPaint3D
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:3928
                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
                                                                                                                      1⤵
                                                                                                                        PID:4396
                                                                                                                      • C:\Windows\system32\OpenWith.exe
                                                                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:3232
                                                                                                                      • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1380
                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x4b0 0x48c
                                                                                                                        1⤵
                                                                                                                          PID:1804
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:4664
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:1852
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "NVIDIA~1N" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:4948
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "NVIDIA~1" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:4164
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "NVIDIA~1N" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3768
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\SppExtComObj.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:4608
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\SppExtComObj.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3684
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\SppExtComObj.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3916
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Registry.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3988
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Registry.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:2756
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Registry.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:3788
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:1952
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3652
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:832
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:1908
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:2148
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3572
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "7823b8a2bb434f1aacfc9fb759e077077" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\7823b8a2bb434f1aacfc9fb759e07707.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:1532
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "7823b8a2bb434f1aacfc9fb759e07707" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\7823b8a2bb434f1aacfc9fb759e07707.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:4908
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "7823b8a2bb434f1aacfc9fb759e077077" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\7823b8a2bb434f1aacfc9fb759e07707.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3724
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\InputMethod\CHS\RuntimeBroker.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:2824
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:452
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\InputMethod\CHS\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3064
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\NVIDIA\DisplayDriver\backgroundTaskHost.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:4284
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\backgroundTaskHost.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:2952
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\NVIDIA\DisplayDriver\backgroundTaskHost.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:4740
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:2880
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:2384
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:3116
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "discordd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\discord.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:4056
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "discord" /sc ONLOGON /tr "'C:\Users\Public\discord.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:3396
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "discordd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\discord.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:5108
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:2360
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:2188
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:1288
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Java\audiodg.exe'" /f
                                                                                                                          1⤵
                                                                                                                          • DcRat
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:3648
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\audiodg.exe'" /rl HIGHEST /f
                                                                                                                          1⤵
                                                                                                                            PID:4196
                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Java\audiodg.exe'" /rl HIGHEST /f
                                                                                                                            1⤵
                                                                                                                            • DcRat
                                                                                                                            PID:3008
                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\images\winlogon.exe'" /f
                                                                                                                            1⤵
                                                                                                                              PID:1608
                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\winlogon.exe'" /rl HIGHEST /f
                                                                                                                              1⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:5044
                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\images\winlogon.exe'" /rl HIGHEST /f
                                                                                                                              1⤵
                                                                                                                              • DcRat
                                                                                                                              PID:2632
                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /f
                                                                                                                              1⤵
                                                                                                                              • DcRat
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:3376
                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                              schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /rl HIGHEST /f
                                                                                                                              1⤵
                                                                                                                              • DcRat
                                                                                                                              PID:952
                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /rl HIGHEST /f
                                                                                                                              1⤵
                                                                                                                              • DcRat
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:4368
                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Videos\RuntimeBroker.exe'" /f
                                                                                                                              1⤵
                                                                                                                                PID:1488
                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                1⤵
                                                                                                                                  PID:956
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\My Videos\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:1736
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                    PID:4332
                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
                                                                                                                                    1⤵
                                                                                                                                      PID:1520
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
                                                                                                                                      1⤵
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:5116
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\NVIDIA\DisplayDriver\535.21\WmiPrvSE.exe'" /f
                                                                                                                                      1⤵
                                                                                                                                      • DcRat
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:832
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                      1⤵
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:1884
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\NVIDIA\DisplayDriver\535.21\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                      1⤵
                                                                                                                                      • DcRat
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:3288
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /f
                                                                                                                                      1⤵
                                                                                                                                      • DcRat
                                                                                                                                      PID:2768
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /rl HIGHEST /f
                                                                                                                                      1⤵
                                                                                                                                      • DcRat
                                                                                                                                      PID:4908
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /rl HIGHEST /f
                                                                                                                                      1⤵
                                                                                                                                        PID:4972
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "discordd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\discord.exe'" /f
                                                                                                                                        1⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:5072
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "discord" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\discord.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                          PID:4284
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks.exe /create /tn "discordd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\discord.exe'" /rl HIGHEST /f
                                                                                                                                          1⤵
                                                                                                                                          • DcRat
                                                                                                                                          PID:2952
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\dllhost.exe'" /f
                                                                                                                                          1⤵
                                                                                                                                          • DcRat
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:4840
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                          1⤵
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:5076
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                          1⤵
                                                                                                                                            PID:4144
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /f
                                                                                                                                            1⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:1492
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:1288
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:3648
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\dllhost.exe'" /f
                                                                                                                                            1⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:3008
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                              PID:1608
                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                              1⤵
                                                                                                                                              • DcRat
                                                                                                                                              PID:1664
                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                              schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
                                                                                                                                              1⤵
                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                              PID:2656
                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                              schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                                                                              1⤵
                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                              PID:1268
                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                              schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                                                                              1⤵
                                                                                                                                                PID:1412
                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /f
                                                                                                                                                1⤵
                                                                                                                                                • DcRat
                                                                                                                                                PID:3824
                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /rl HIGHEST /f
                                                                                                                                                1⤵
                                                                                                                                                • DcRat
                                                                                                                                                PID:2416
                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /rl HIGHEST /f
                                                                                                                                                1⤵
                                                                                                                                                  PID:4032
                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /f
                                                                                                                                                  1⤵
                                                                                                                                                    PID:752
                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                    schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /rl HIGHEST /f
                                                                                                                                                    1⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:3368
                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                    schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /rl HIGHEST /f
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1932
                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /f
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2460
                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                                        1⤵
                                                                                                                                                        • DcRat
                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                        PID:2464
                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                                        1⤵
                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                        PID:3488
                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\dllhost.exe'" /f
                                                                                                                                                        1⤵
                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                        PID:4256
                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\uk-UA\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                        1⤵
                                                                                                                                                        • DcRat
                                                                                                                                                        PID:3308
                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                        1⤵
                                                                                                                                                        • DcRat
                                                                                                                                                        PID:4864
                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                        schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Recent\audiodg.exe'" /f
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4004
                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Admin\Recent\audiodg.exe'" /rl HIGHEST /f
                                                                                                                                                          1⤵
                                                                                                                                                          • DcRat
                                                                                                                                                          PID:4468
                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Recent\audiodg.exe'" /rl HIGHEST /f
                                                                                                                                                          1⤵
                                                                                                                                                            PID:864
                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4192
                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                                              1⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:700
                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                                              1⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:3672
                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3920
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
                                                                                                                                                                1⤵
                                                                                                                                                                • DcRat
                                                                                                                                                                PID:3324
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
                                                                                                                                                                1⤵
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:4880
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jdk-1.8\bin\sihost.exe'" /f
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4168
                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                  schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\bin\sihost.exe'" /rl HIGHEST /f
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                  PID:2672
                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                  schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk-1.8\bin\sihost.exe'" /rl HIGHEST /f
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2640
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "discordd" /sc MINUTE /mo 8 /tr "'C:\Windows\apppatch\discord.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                    PID:1488
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "discord" /sc ONLOGON /tr "'C:\Windows\apppatch\discord.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:956
                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                      schtasks.exe /create /tn "discordd" /sc MINUTE /mo 5 /tr "'C:\Windows\apppatch\discord.exe'" /rl HIGHEST /f
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1888
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3764
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4132
                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4352
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3392
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:920
                                                                                                                                                                        • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe
                                                                                                                                                                          "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2944
                                                                                                                                                                        • C:\Windows\apppatch\discord.exe
                                                                                                                                                                          C:\Windows\apppatch\discord.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3064
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\discord.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4152
                                                                                                                                                                        • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe
                                                                                                                                                                          "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3176

                                                                                                                                                                        Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        • C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.4MB

                                                                                                                                                                          MD5

                                                                                                                                                                          4a591f46c87b49a7de93f5ac771cd4ab

                                                                                                                                                                          SHA1

                                                                                                                                                                          e0992350818e5c56d3f2e3a6db340d1f5b8f3314

                                                                                                                                                                          SHA256

                                                                                                                                                                          b495e22042b08f27b690da18986ec74d5054a65d05d5cf41fdecd5751482ccbd

                                                                                                                                                                          SHA512

                                                                                                                                                                          b498445d1e427853690250aebff35cbd7e28e85a89ad868e3483930b16ec13198357cfcd5feb45567b1bc8f3d9f97c5ecf2d242c8a5e9d758a536d0498ba7955

                                                                                                                                                                        • C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe

                                                                                                                                                                          Filesize

                                                                                                                                                                          225B

                                                                                                                                                                          MD5

                                                                                                                                                                          d7df2670ad0c6c7b9cc48122f20f086c

                                                                                                                                                                          SHA1

                                                                                                                                                                          e69bf8c214d8c4b768125ca03e402e1c871cc233

                                                                                                                                                                          SHA256

                                                                                                                                                                          d3bf5c54de984dd2d1d779494deb8a995cc062eb5f25c465d0de78d99b8cc52b

                                                                                                                                                                          SHA512

                                                                                                                                                                          05ed88410790bf74dc7ab880f893e555c4859c133e79a89f28b5e1a68c36f4a4f28d3b7b6532953c04b6d23a21faf53e60107efde9e6acb492a9235d48943f03

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\discord.exe.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          859B

                                                                                                                                                                          MD5

                                                                                                                                                                          462d5af26752129045a92b98c8943aaf

                                                                                                                                                                          SHA1

                                                                                                                                                                          cf3b840d8e2ff5ad11ceb70cd425a44209830ef1

                                                                                                                                                                          SHA256

                                                                                                                                                                          90b4268f4208387999c7ecf4ff8822daf2ffadb2db4121936a56b563286cf003

                                                                                                                                                                          SHA512

                                                                                                                                                                          75dc848c29f36d8cf14e7fff804b0b0c5beb8a0f202f235875847992ef1703e7cf5cf4b50aef859b4c38139836f249cf4f7657812341dd258771544c057eb09b

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                                                                                          Filesize

                                                                                                                                                                          36KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                                                          SHA1

                                                                                                                                                                          92495421ad887f27f53784c470884802797025ad

                                                                                                                                                                          SHA256

                                                                                                                                                                          0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                                                          SHA512

                                                                                                                                                                          61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                                                                                                          Filesize

                                                                                                                                                                          36KB

                                                                                                                                                                          MD5

                                                                                                                                                                          ab0262f72142aab53d5402e6d0cb5d24

                                                                                                                                                                          SHA1

                                                                                                                                                                          eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                                                                                          SHA256

                                                                                                                                                                          20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                                                                                          SHA512

                                                                                                                                                                          bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\navalny pass - 2000.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.1MB

                                                                                                                                                                          MD5

                                                                                                                                                                          86a1cbee2b7dc5d64051c83c82c8d02b

                                                                                                                                                                          SHA1

                                                                                                                                                                          55d82d17f7f10d088909d0cb7116969d12308974

                                                                                                                                                                          SHA256

                                                                                                                                                                          d3f47cd85c525a0c3ed855949bf27023c27b24c51d388166d72d4fa8cae4c2f5

                                                                                                                                                                          SHA512

                                                                                                                                                                          6720ecb2799185bf2a03259766e3dd38aeaec674a3a28e657bd55131b1e9fb18fab118afc3aa7881de56d7af36d60bf8b29449065ba32c5cf0dea38fb892ecbb

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\390efcf5eb4a44d99da1269e043ebd5d.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.6MB

                                                                                                                                                                          MD5

                                                                                                                                                                          1849f89a807de47190139035f6148366

                                                                                                                                                                          SHA1

                                                                                                                                                                          0e23f3cfc246483f5dd17815fea3d5011f6611c7

                                                                                                                                                                          SHA256

                                                                                                                                                                          131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac

                                                                                                                                                                          SHA512

                                                                                                                                                                          49398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\46fad423a4bc46e4ae4667d7213ed61e.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.1MB

                                                                                                                                                                          MD5

                                                                                                                                                                          558ff65486960f523a1eb17ed0f87bf8

                                                                                                                                                                          SHA1

                                                                                                                                                                          bc6acc37eb0472a0bb23967f62cc4469ca1deb13

                                                                                                                                                                          SHA256

                                                                                                                                                                          b08298bb968f9ef0bb09aa6cee9b608b9a4882b72301de0aa82fc45dd8d6a10c

                                                                                                                                                                          SHA512

                                                                                                                                                                          19f066bd6adf650d7dbfb6412f7506139520eaeb8989852dd9f074622f13fc2c50a826eb35df38197ebd5cfaf34c1a1087e7cd9d8b60f50b10191c631f3121fc

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4f1cf730d4ce4c29b30600eaad3df6e6.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.5MB

                                                                                                                                                                          MD5

                                                                                                                                                                          515a119cd9c0701313070074760d673d

                                                                                                                                                                          SHA1

                                                                                                                                                                          69858f0d27e2f5c78ce17c01e7155a799356b14f

                                                                                                                                                                          SHA256

                                                                                                                                                                          4e542b6eaf04bff7e61da39772c0dd6bb3090d8a8b2d791dd96fc604326a05cd

                                                                                                                                                                          SHA512

                                                                                                                                                                          7b91f85d71f68c585a0c5714eee3822abf6861575862dee5afb75af9fa4b2265bade80f737107a14eecf4e0f00a13ef88f77b30fad47941d0c17c16f1e25f1ec

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7823b8a2bb434f1aacfc9fb759e07707.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          19.7MB

                                                                                                                                                                          MD5

                                                                                                                                                                          80c506da3df5e4580c06c48162bccbea

                                                                                                                                                                          SHA1

                                                                                                                                                                          43fbccf50f91cd8e1190869b0edc96d920519c14

                                                                                                                                                                          SHA256

                                                                                                                                                                          5699b2e12f78b7eeca0633c6a5a93effe7187565eccd7668acccf93c61ab7acb

                                                                                                                                                                          SHA512

                                                                                                                                                                          f4a424bf758bb48da944701397ac1e82bb72a15ea4e8818535f2e52199d37e9caf4361303fee4bd9d6db528e1c0171d1612aebc5f636ca9c4ee4fd795432b8c5

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Locker.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          793KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a83185ef7c03bfe0e0fbe10098876a34

                                                                                                                                                                          SHA1

                                                                                                                                                                          b166fed95e9bcc9f8b0ac4deafa9c45c21e91d0d

                                                                                                                                                                          SHA256

                                                                                                                                                                          7a923db27ae488a02e77242b1bbceb9a64898b9c2d085372a5ef5fca06b2a4be

                                                                                                                                                                          SHA512

                                                                                                                                                                          283e698b326d044480c49351531249ab9ed3a851c1d2c4a36c87fc5ecbaf2771af58f39cc0fc1551d08a4674ad766a3d4b96b6ee6ca1e6e967727f320f599f4c

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.8MB

                                                                                                                                                                          MD5

                                                                                                                                                                          531bf67134a7c1fb4096113ca58cc648

                                                                                                                                                                          SHA1

                                                                                                                                                                          99e0fc1fb7a07c0685e426b327921d3e6c34498c

                                                                                                                                                                          SHA256

                                                                                                                                                                          67942630366d114efa35f3f4a79741a4a4eb2c3b0c8ffaac07af527f84d4489a

                                                                                                                                                                          SHA512

                                                                                                                                                                          8facae8335a4f33f54e48c64814946eb8b480800b4453612fffcef64117946a35d493f433d4e27186ee864603da756319f816e70c3bfc08b8bb1861fc7030ff4

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unlocker.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          653KB

                                                                                                                                                                          MD5

                                                                                                                                                                          c29e84272de123ac2cae92bf8210d95b

                                                                                                                                                                          SHA1

                                                                                                                                                                          1b60b8f5430707ca08d806e5739553cd6cfccf89

                                                                                                                                                                          SHA256

                                                                                                                                                                          42c145d05f5a3d20a4df748d488e32f986ef0bbd370dd086b6f431e00a5efb14

                                                                                                                                                                          SHA512

                                                                                                                                                                          055aebf709f23647783f034913fd61721649ceddcc1357b4bd34ecd446b059f27c57a16392943000d7f2152cdec51043d11910fae1dd002f043f300d9724ee6e

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aut9EFC.tmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          138KB

                                                                                                                                                                          MD5

                                                                                                                                                                          7c30424c525cb64760083e066ca1f77d

                                                                                                                                                                          SHA1

                                                                                                                                                                          69c369028e3db4fe5c2fbc69cbd837d66496c480

                                                                                                                                                                          SHA256

                                                                                                                                                                          b75685e5fe51601632066ae2cb162738b340c9873f3b30cd4eb0b6f80cc27643

                                                                                                                                                                          SHA512

                                                                                                                                                                          59d726222ffc846ada2e7c6d040e0f0114e2cb92e72f81f23489aa6681b07a1c8cfceb7e81f9b7d7678d33b313302d9cf39c345d862e43f2768e145df14ef8df

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\foiIXd0asT.bat

                                                                                                                                                                          Filesize

                                                                                                                                                                          199B

                                                                                                                                                                          MD5

                                                                                                                                                                          54d898632f1bc3922a1e0392ddd1aecc

                                                                                                                                                                          SHA1

                                                                                                                                                                          979eea29862e91aaa385f1b8160095a6b6068857

                                                                                                                                                                          SHA256

                                                                                                                                                                          8d115dac563ed393d6978f7be75edd51f41d9254a7f943a09f0f3f7a37fb7e5e

                                                                                                                                                                          SHA512

                                                                                                                                                                          c9a96b1bb1e6c29d0b1aaeebffcabcc6638214d28fa880485b4d22379c72d6fabf8c1d71d25ee8d94a49695faf43d5ea7150d78bf2b5907c803932d0d5c99650

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\navalny pass - 2000.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.2MB

                                                                                                                                                                          MD5

                                                                                                                                                                          d5f38176aa233dc3a85f2c3e7c6cf1f7

                                                                                                                                                                          SHA1

                                                                                                                                                                          022ea6d320067d2429b26cc424145610fa0ad28e

                                                                                                                                                                          SHA256

                                                                                                                                                                          db307d31bbb3d282685bf28e0abf464a931fa749633d784e39adbe7d8d8ead31

                                                                                                                                                                          SHA512

                                                                                                                                                                          f58f855e3a102b6ccb4197b38323149342c23c2182b6309074d5720c2b2f20d764c33b10013834e85f73e22c0b7ab95ec4171ff251523b598821ad632af5a893

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\sjzsdatloq.gif

                                                                                                                                                                          Filesize

                                                                                                                                                                          422KB

                                                                                                                                                                          MD5

                                                                                                                                                                          705a10144ffd51597b863af7b6dc6761

                                                                                                                                                                          SHA1

                                                                                                                                                                          68e3ff4a0c5c498e958431cc4379f33042900194

                                                                                                                                                                          SHA256

                                                                                                                                                                          cbc8a31345ac302681cac85e5347de1ffcbaa12bdc50c679ecf99cda7fc5157e

                                                                                                                                                                          SHA512

                                                                                                                                                                          00685116a9471c2f95534932eedf29e70c0486cdb16235770ff3ab8655396ead19378c29f57f298ac2d17e202ed8e75b4ecab282a1be4cb40dd27774568107a3

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\winlocker.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          3.1MB

                                                                                                                                                                          MD5

                                                                                                                                                                          9f93492e155d1bf27b8077e991e6a5a0

                                                                                                                                                                          SHA1

                                                                                                                                                                          159d72ad8074b56562b1014393be24b402c3af39

                                                                                                                                                                          SHA256

                                                                                                                                                                          43eef3b68ebaab3efbe15eb3046281e380aa78003a0eda8757a9e44f6a59ec7f

                                                                                                                                                                          SHA512

                                                                                                                                                                          270bc608ac79ca92c8db6a1455a26f24d80844badc514d5db29acade5748513d8378e3d6d803e9cfb7bdab6482a992b7c6a60845b255f3be5cbf92a0a69db918

                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.url

                                                                                                                                                                          Filesize

                                                                                                                                                                          178B

                                                                                                                                                                          MD5

                                                                                                                                                                          3b35148d7661e41a89ded2a167b81bd2

                                                                                                                                                                          SHA1

                                                                                                                                                                          3341e6e2522b5f2c39aefe0f752550acbd143ad7

                                                                                                                                                                          SHA256

                                                                                                                                                                          8375823df91f6dc9d9fc09a83303bdea778eef761f577bbedeccf00eeda7129c

                                                                                                                                                                          SHA512

                                                                                                                                                                          8cc6e258f8c531230bc6ef4ac778c8f10cf971ba992f63b2847bd3c93c76c884428cee8d337274ef58a782c89a82817cd288e897bed2557da330397b00be8683

                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\discord.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          167KB

                                                                                                                                                                          MD5

                                                                                                                                                                          774fff2810fc115bab05707f73047457

                                                                                                                                                                          SHA1

                                                                                                                                                                          6dbf565150aa9a791e0f9f345243984ec6f5fa5a

                                                                                                                                                                          SHA256

                                                                                                                                                                          11478265d9ce8d9c390a3c28960972d1c4fa3e1a532183d7ea7e3cdd039f688d

                                                                                                                                                                          SHA512

                                                                                                                                                                          dc5a9dd495b912f386b668c95622addce7ebb7fa23a93ffec144c2766695c94a4c00534e567d3a153009987e3fe2683d9715d058a677a20ce498dfcc2276c96a

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.AddSwitch.cfg

                                                                                                                                                                          Filesize

                                                                                                                                                                          490KB

                                                                                                                                                                          MD5

                                                                                                                                                                          eb820859528f342fb44535b580de6fc4

                                                                                                                                                                          SHA1

                                                                                                                                                                          2b7c432bf92b4f250c06089d37e672d6cb4d704c

                                                                                                                                                                          SHA256

                                                                                                                                                                          3d35d99ceb5e515ead5cfc0916d8f3ad3ad4110b221681637adb8a22fb7a2e8d

                                                                                                                                                                          SHA512

                                                                                                                                                                          2e3404b4c4e5c2befc303e6b96346f2fd3927c525134edada81d8a67b0a0128c9e0c3715f0f9ea5e1af3c4cce9bff6789e306f94d920cc4fe36f029b3263982c

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.BlockConvertTo.crw

                                                                                                                                                                          Filesize

                                                                                                                                                                          236KB

                                                                                                                                                                          MD5

                                                                                                                                                                          e24abffe68c617d871c31ead151042cc

                                                                                                                                                                          SHA1

                                                                                                                                                                          94cd0bb85e074ffd69ffdf53921adeff0323ac7e

                                                                                                                                                                          SHA256

                                                                                                                                                                          30ee9d45a914d5c09f3c0484aef9e0f4c2397a52599a89774b824f4c09492495

                                                                                                                                                                          SHA512

                                                                                                                                                                          d6952f1bac4ea07518238ac3d6880837b69454b086d9d63c74271b69f91b7cea17961b9a6cc4ac3f18f1ac1a35b83b254cd4ce71632151fc7c68b6f723b8ea91

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.CompressRemove.pcx

                                                                                                                                                                          Filesize

                                                                                                                                                                          290KB

                                                                                                                                                                          MD5

                                                                                                                                                                          84358cfc4a757d8a0d3a0b6138864b05

                                                                                                                                                                          SHA1

                                                                                                                                                                          4bd6b7202dd3a32642364b42661084e8f7f7233a

                                                                                                                                                                          SHA256

                                                                                                                                                                          73fe763ae5a7fd3f244eb691a464ad9c130b1fceb5d950a77375a893d42f97ff

                                                                                                                                                                          SHA512

                                                                                                                                                                          6ef697747a058fdd489ef427aa17abe4860be89fd373dd1ecdd1e7b91da1c40d1ab120bf7c77881d113cebc0ce3e01d74ec53b545e818e34cd75540a64d29d1f

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.ConfirmAssert.asx

                                                                                                                                                                          Filesize

                                                                                                                                                                          527KB

                                                                                                                                                                          MD5

                                                                                                                                                                          96556ffaf8197b8e1df219a9857132d9

                                                                                                                                                                          SHA1

                                                                                                                                                                          800dc8467057d38e5612624b6077894147efe6e0

                                                                                                                                                                          SHA256

                                                                                                                                                                          eb6cadd6b41ea2e38a9382e6015b8b84117b401e23eaca31627830bd0a688679

                                                                                                                                                                          SHA512

                                                                                                                                                                          622da73bcd9bf8dd6918791c77cb73fd0769424d421bb75696fb28126780d74d6614488804f6a551ad46d5ce01ef545d18b29cb073f776584a1a83a1325229c0

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.ConvertFromDismount.jpeg

                                                                                                                                                                          Filesize

                                                                                                                                                                          309KB

                                                                                                                                                                          MD5

                                                                                                                                                                          93e3783001f4b2919389388b15e9d31a

                                                                                                                                                                          SHA1

                                                                                                                                                                          b5d07c155d107b3001d7340e44e865a4c915cf61

                                                                                                                                                                          SHA256

                                                                                                                                                                          a5aa84a14d06c8eec843a6f2dcbd23d82affc88252f8963fc16c4900d90255af

                                                                                                                                                                          SHA512

                                                                                                                                                                          ddd326eadcb120650c602f9b7fc3b058c8b96ddd643406bcd09c3dad9d544ea366773d8b34a0bfb5097bcc0c8124765f3edb89d01e005f0fe55d3a4c6e253cd2

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.DenyRename.easmx

                                                                                                                                                                          Filesize

                                                                                                                                                                          563KB

                                                                                                                                                                          MD5

                                                                                                                                                                          bfea8c2dba7507ce048f47dee7d33258

                                                                                                                                                                          SHA1

                                                                                                                                                                          3866ccd6e7f9a9cadd6eea5ee535b12c5b3fe9f2

                                                                                                                                                                          SHA256

                                                                                                                                                                          6dd78f0fe4310b3092418b82ec480bcffd34dd02034050981829e856d2d090cf

                                                                                                                                                                          SHA512

                                                                                                                                                                          1311c2e5566e071e4f3527728e4014c41d5abe4849f91256a3cb84553804cc363ee89997cc923aa3c46d268773aa3872ddd8c2f97aca404c941bc502544984db

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.GroupLimit.ADTS

                                                                                                                                                                          Filesize

                                                                                                                                                                          545KB

                                                                                                                                                                          MD5

                                                                                                                                                                          642244b215ced9f20f9109d8cec32335

                                                                                                                                                                          SHA1

                                                                                                                                                                          e02e50ad91a82d7c0ccb1c92e76a670f87e936d8

                                                                                                                                                                          SHA256

                                                                                                                                                                          213b9a7b2299a09681cac1052d825ee7d018c63b5b5204912af128f3ec1f2c4c

                                                                                                                                                                          SHA512

                                                                                                                                                                          507b4ae885b670ac4f8ca0f5efdbbbf068cadb24512adb99e769e8256d466df3241938f00a2bb1644a04c204eb3368b4fe5d537d1155de4255ef42d8a812ea64

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.JoinMove.docx

                                                                                                                                                                          Filesize

                                                                                                                                                                          672KB

                                                                                                                                                                          MD5

                                                                                                                                                                          5177a9c18e8b4bf897764f30dfe59f63

                                                                                                                                                                          SHA1

                                                                                                                                                                          bd85d0965e13af87aac9b1d840424fb1a94f5f80

                                                                                                                                                                          SHA256

                                                                                                                                                                          8753de899760e74b8c8701040cfc66b5790e2cc884c6c256ccb7c6f1be804ff7

                                                                                                                                                                          SHA512

                                                                                                                                                                          e41dc549192940447c8bd16e913d4d0fc7147e07ebb299177fad79e6b3f798bc258ae5324d9da61ea11b5ebb6658f4644b238102c6e6b48aac92079e0d2284b4

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.MeasureResolve.xlsm

                                                                                                                                                                          Filesize

                                                                                                                                                                          399KB

                                                                                                                                                                          MD5

                                                                                                                                                                          821d4db9753953e2254653dcc29cad2d

                                                                                                                                                                          SHA1

                                                                                                                                                                          95023558e13347c308dafe49bed5c5881bfb017d

                                                                                                                                                                          SHA256

                                                                                                                                                                          ae928f0d2489addf7ef6b9b69b0b11a3349a5a2fea5bffb63c57b8251b6e8ba0

                                                                                                                                                                          SHA512

                                                                                                                                                                          e7d8bbf6a1d440d42beb1bd4db6927eeb5f1dee79d106f8b971c3f5bf9f77a95192ab7f7eea11a7c820d65cc5fbbc4ff1b7b71a963b236bd3f81a90ad20b3231

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.Microsoft Edge.lnk

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          b2fa2fa8f8159d1985b032d3722f83a4

                                                                                                                                                                          SHA1

                                                                                                                                                                          867efc83cc36b48e82e40fa05058b3269a959bd5

                                                                                                                                                                          SHA256

                                                                                                                                                                          565ad902d14a0d17f1bceed29bd31f313f808e4130a8539cd7906f5f495d5099

                                                                                                                                                                          SHA512

                                                                                                                                                                          c702798ef3dda113f58d0600642305d19fdf0defda7db292839d6dc02035ea4000041464dc120fe2d7d767e528c59253f6901e75fd722f957eacfad94c252d52

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.OutResize.vstx

                                                                                                                                                                          Filesize

                                                                                                                                                                          345KB

                                                                                                                                                                          MD5

                                                                                                                                                                          b1adebef02c72f8ee210f547a2c3a679

                                                                                                                                                                          SHA1

                                                                                                                                                                          de6437ddae8aaa378a2df41370b7aed2c1470e5b

                                                                                                                                                                          SHA256

                                                                                                                                                                          43689a0d7457e4a079914e0efd1ed975ea16d41bb31e0f4df9f37cf4bff3e1a0

                                                                                                                                                                          SHA512

                                                                                                                                                                          0c20d8acace165d76501e6e661d8a5c78246ad7e3bf8eeec2491da413bad78097f3371d0d0573dd7cfd4bf74baa301186d2c9c6dd6b74968cb762816858b6728

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.ProtectOpen.wvx

                                                                                                                                                                          Filesize

                                                                                                                                                                          363KB

                                                                                                                                                                          MD5

                                                                                                                                                                          ca1ab5295e245741cb1e0d0943d5e689

                                                                                                                                                                          SHA1

                                                                                                                                                                          e52cf66a9f5563f38aee77216ca2f7878a1c33b6

                                                                                                                                                                          SHA256

                                                                                                                                                                          9ec753be8e35b0d267e7485de5df04a0d07152aa28c6ead3b4e535946f58a3c5

                                                                                                                                                                          SHA512

                                                                                                                                                                          521bb5c29b2e193138074e2aa9fe5abeee0f098b55290b9458cc504e9e86703d0ede2ca2b99eda82e9d72dd94e75ccc1d01c4ed4930a4932e8c47ff6d0ac3a20

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.RegisterRepair.wmv

                                                                                                                                                                          Filesize

                                                                                                                                                                          381KB

                                                                                                                                                                          MD5

                                                                                                                                                                          013ef9458fcb66d73a3b90a0c0a63959

                                                                                                                                                                          SHA1

                                                                                                                                                                          666fd31486a92eb04fef1e52f954a02e00f49039

                                                                                                                                                                          SHA256

                                                                                                                                                                          8e4c379f647a072ff59509c80428132e5afeaeee75e0bfb8b7cc9e5b04b86d95

                                                                                                                                                                          SHA512

                                                                                                                                                                          39163cc8f7daa5965ab339a15e3f827b1b22151f9d728f6453166381d15fa03b44527799edbb86f8720df13dac224f3bb3d82bd3a3c176a674bb01520f694a1c

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.ResumeTest.vst

                                                                                                                                                                          Filesize

                                                                                                                                                                          581KB

                                                                                                                                                                          MD5

                                                                                                                                                                          8abc7426b798b8d7a973d9e2282e2954

                                                                                                                                                                          SHA1

                                                                                                                                                                          504ed68af33036d3add35c3dbceb0064ddd409f6

                                                                                                                                                                          SHA256

                                                                                                                                                                          27a27a23125ce909d5b824b2e4f407288c96b57c54e3a7495d07cc1c382b41ef

                                                                                                                                                                          SHA512

                                                                                                                                                                          e0fe5955c6bd3d2291e83f14d44b267943056cc1648accec54219065317de83f14212b69a1383ed49d6b1bd54be34399931063a60defee1813ae778c9981b7a4

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.ResumeUndo.pptx

                                                                                                                                                                          Filesize

                                                                                                                                                                          327KB

                                                                                                                                                                          MD5

                                                                                                                                                                          29eeed166e76cf846b3e5fb690b39edc

                                                                                                                                                                          SHA1

                                                                                                                                                                          0265dbe64561943f2da1a19c48cef54a75020c6e

                                                                                                                                                                          SHA256

                                                                                                                                                                          fba0b0097271ebe8f909307e34fdf84ead988e5c49cfb214e3838166f069b528

                                                                                                                                                                          SHA512

                                                                                                                                                                          a0a766fa34d38fcc7a14ed381ee0cfe44ddb1b8618ddd041eef75fad4088861af074bbeed0d9b6c78cf10ac209f3fcb0dfe63df80c127b29eeea8d21b3ceed83

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.SaveUninstall.cab

                                                                                                                                                                          Filesize

                                                                                                                                                                          618KB

                                                                                                                                                                          MD5

                                                                                                                                                                          8dd29aee29501684633123b6eafec637

                                                                                                                                                                          SHA1

                                                                                                                                                                          49e8243e7ba4ea43f7ee6bcd98174db4d873add4

                                                                                                                                                                          SHA256

                                                                                                                                                                          396a208198aff93c4e3230c8e4db43b9d157e6419785348924d1d4a1beedcc70

                                                                                                                                                                          SHA512

                                                                                                                                                                          115da0e7aa617c1da94c415de99e47ab84f194bbc7d7def6668e4b41ffe6589187a0e88ba487c03d9fd7ed38364c931f1e64383a7db59f11cb5ffef730abcbb2

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.SearchDeny.midi

                                                                                                                                                                          Filesize

                                                                                                                                                                          926KB

                                                                                                                                                                          MD5

                                                                                                                                                                          44eba426ad10b0c64a2db6c6bfe56ec4

                                                                                                                                                                          SHA1

                                                                                                                                                                          fcd716ccfc4f3d9e8b21d95b62c3e355a3684e17

                                                                                                                                                                          SHA256

                                                                                                                                                                          523b736e2d80b6ffb632ebc13ec65dcdfbe05422fbb4861de1b3513e4020310c

                                                                                                                                                                          SHA512

                                                                                                                                                                          269d3dd73dccc7d4bf51e7fca0e38bca362ce5c7eec548fb5be51ab949ff3696beb64cc23b15c40144068b36b94a74d16948f003480a47f2622f516fbd149d41

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.SetPop.3gpp

                                                                                                                                                                          Filesize

                                                                                                                                                                          599KB

                                                                                                                                                                          MD5

                                                                                                                                                                          5cd6afe1ba0cedb4c6494fa5cb1c68e7

                                                                                                                                                                          SHA1

                                                                                                                                                                          3881c88a3fbc57101803728e8cc649ffdac85baa

                                                                                                                                                                          SHA256

                                                                                                                                                                          a04c68095c33c9ca42ba9f070739700a7edb6d1e3c77393e74a086144b118a54

                                                                                                                                                                          SHA512

                                                                                                                                                                          acd0c4787638b73b0c427700bd67f6615d635f2096dd80e25dc6217d4a681cc425c1eb47aaf83dd4202aa4544b65a5a710df162788f84b0a2413453101be399b

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.StepRead.xltm

                                                                                                                                                                          Filesize

                                                                                                                                                                          454KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fec1a77f76b7b90c698d94d16673cede

                                                                                                                                                                          SHA1

                                                                                                                                                                          9cbfa2b5c6a1d78886ddc53ff93439fdf79d65bc

                                                                                                                                                                          SHA256

                                                                                                                                                                          4073e3ab4154831822913d4ec6be28106332074a4103885c67c9b5adf3d1028e

                                                                                                                                                                          SHA512

                                                                                                                                                                          4298fa87a46d72a36af5e460b5b92e1baa177e34ba2fb0c4951f7290aa917937fd129f423b50b44d9ae05ff13ec0c87869f20785a1e399c693f305904cea00c2

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.TestEnable.jpg

                                                                                                                                                                          Filesize

                                                                                                                                                                          254KB

                                                                                                                                                                          MD5

                                                                                                                                                                          4cfb73ff2bcd694b2dde13da5f08ae69

                                                                                                                                                                          SHA1

                                                                                                                                                                          27cfba64d048ede84709aefb1b3d92a46e164fe6

                                                                                                                                                                          SHA256

                                                                                                                                                                          8cb00caa772dbb1621b8cf397b4d68c8a76ba79bef01bfdbc26afcd85fffc910

                                                                                                                                                                          SHA512

                                                                                                                                                                          b81d36b5785696f15f5148c4a7733d8ae5c708d4703f4c60d9afca1f1403bdf0cbcb673c96f0434da9269ac657c3b129d1e00f410462d59bb1fcea73c2083f1f

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.TestUndo.asf

                                                                                                                                                                          Filesize

                                                                                                                                                                          636KB

                                                                                                                                                                          MD5

                                                                                                                                                                          34322572f372b9c49f9ec06b479118d5

                                                                                                                                                                          SHA1

                                                                                                                                                                          35e846584ffc1cb407cf00de2681c99e13bd447d

                                                                                                                                                                          SHA256

                                                                                                                                                                          5a74fe605481a33ac6aa316cfae48cb95cf8f27295d891347d0323fec141e144

                                                                                                                                                                          SHA512

                                                                                                                                                                          5eb4b7609619bc19bfd3a6b1b6b4c6ba1f932b1e4b613bcdf474ead0aa88e5296bee32b62934e79abfbb8f42953ba15630efd10fd8ac664ac3506e361b863a8b

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.TraceResize.wps

                                                                                                                                                                          Filesize

                                                                                                                                                                          472KB

                                                                                                                                                                          MD5

                                                                                                                                                                          31034c18c23b3d4d37c72b8c5acd98eb

                                                                                                                                                                          SHA1

                                                                                                                                                                          f59f9b330de75b30f9a039bb6ff8b6b00917d90a

                                                                                                                                                                          SHA256

                                                                                                                                                                          c8bb1cb3f82570188275b4edd1f602cd871fbdf2d89d75bcc0de5f38bb56ce9c

                                                                                                                                                                          SHA512

                                                                                                                                                                          7de8c2b8ea88ac8a7b17ee60d708df7e8c7d3892f257d3f6170edba65cc82ab3160ee32a36b1ff04d6f8080059af29b944494fcffb96935eac53a502eae97457

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.UndoStep.wmv

                                                                                                                                                                          Filesize

                                                                                                                                                                          654KB

                                                                                                                                                                          MD5

                                                                                                                                                                          52f85132f520239ee3f7b86bec905818

                                                                                                                                                                          SHA1

                                                                                                                                                                          2d87c2ad9c8243d4baeef34f56e9a2fc0c55ecb6

                                                                                                                                                                          SHA256

                                                                                                                                                                          acdb8151e85b089d7ac787619d62f82d11009db549f56202678d06116ec62980

                                                                                                                                                                          SHA512

                                                                                                                                                                          9350164001b2937504936c5fd3ed50fcac90f85146c0ca8cdc849d73ce2c36b3b33cd442bb5eb98b5597cb10ab18d6ff5b9cfad5e235d01c7ad45a4e01d8c28f

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.UnprotectInitialize.ogg

                                                                                                                                                                          Filesize

                                                                                                                                                                          418KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a25db8b3a91fee57557ae4af701e8713

                                                                                                                                                                          SHA1

                                                                                                                                                                          3ab99f7db3d2cb8a18d107f4c07d0425215d17af

                                                                                                                                                                          SHA256

                                                                                                                                                                          d75f1c3a99015edc9311a8e883db186faf95fdd7d66bfdf0a10d38dbc0192b18

                                                                                                                                                                          SHA512

                                                                                                                                                                          dc011575ae2741ec50cbfc2944bad3a65572f52e24d415e92c2e985dfd90fc2b07ba389adbb7e1003a01f0447387a51fe326285831e0dc61ab799c78dda2cd36

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.UseConfirm.avi

                                                                                                                                                                          Filesize

                                                                                                                                                                          508KB

                                                                                                                                                                          MD5

                                                                                                                                                                          daa2aefe10eb852b3f113dc04b1d5fde

                                                                                                                                                                          SHA1

                                                                                                                                                                          691124f477a246c05e24471cd0bf6437d3989e57

                                                                                                                                                                          SHA256

                                                                                                                                                                          4fb32fcf24989d0522f9f816a374acdce9c0723ee05b57ef334afff9ae2bd762

                                                                                                                                                                          SHA512

                                                                                                                                                                          ed12b2c4c035a2713a8fb39645cebec08fa4d86c4fa87153510986969bf374915ab4735b77ed48995d54ec4b86ca29d4c0a68922d7b4cb831425f6c917e85262

                                                                                                                                                                        • C:\Users\Admin\Desktop\Lock.desktop.ini

                                                                                                                                                                          Filesize

                                                                                                                                                                          288B

                                                                                                                                                                          MD5

                                                                                                                                                                          ba41cfaa9aff58c3b40c7ac73b4d1cd4

                                                                                                                                                                          SHA1

                                                                                                                                                                          691f19d9330522a47b16c832c6d6b51a3a2efc72

                                                                                                                                                                          SHA256

                                                                                                                                                                          30fb6cb48d4689a02731dedf82483a58738ba4131e4be90b2a44bd1ab9fd6a0a

                                                                                                                                                                          SHA512

                                                                                                                                                                          708ebe3314fd85d51ab0e73d83a7e61cb00d6c0ce5e78530f7ed6c9e6bcd827ca5b3ca4cd34842bc2d7337fdd73c4c1f39407f5e8c94ba6a5fa8e9130533350e

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.AddRegister.rmi

                                                                                                                                                                          Filesize

                                                                                                                                                                          258KB

                                                                                                                                                                          MD5

                                                                                                                                                                          6142ce02177b2944dcc7508597f4d096

                                                                                                                                                                          SHA1

                                                                                                                                                                          807e2dfcd98bc38766efd6d0190b6dc774fd02e0

                                                                                                                                                                          SHA256

                                                                                                                                                                          ed8fdef115f9af87ea59834e3613d68212946ea599c847b88c947c8f457bf1ee

                                                                                                                                                                          SHA512

                                                                                                                                                                          43f45f6a9cd103a70fa2e4cd0984cfb8abac88b38184ab97a648ebd3c5295e014acf5b9d5e22c833bce7dcadcee4bc109f3b22a3c08436c99529168a10e3973e

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.ApproveTest.pub

                                                                                                                                                                          Filesize

                                                                                                                                                                          384KB

                                                                                                                                                                          MD5

                                                                                                                                                                          8b64d0861192074855a0b59f84563e93

                                                                                                                                                                          SHA1

                                                                                                                                                                          a003e5c05ae1f851df7c760ccce5e8bb1ee20c1f

                                                                                                                                                                          SHA256

                                                                                                                                                                          0401aac1651fa5dc83c1ac1d728ea50eebb8c2dba63a23856de046e1c78b7d96

                                                                                                                                                                          SHA512

                                                                                                                                                                          1f3bafc219ebbf2f327d063cfe0eb85109ce365373db146838c6f5d5e2c4b6ff773742e7fd7e34e826a03096a7ea416999e51eabe591b96c743f144109533fdb

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.BackupRequest.cfg

                                                                                                                                                                          Filesize

                                                                                                                                                                          143KB

                                                                                                                                                                          MD5

                                                                                                                                                                          7397686ad5d8e2360e2bb87f9cffda9d

                                                                                                                                                                          SHA1

                                                                                                                                                                          dba311c4c4302d31e44801a7e9b35696dbda2d9e

                                                                                                                                                                          SHA256

                                                                                                                                                                          ef78f171d5ff7d0abc0d07c9fa6571fe6dbaf4a5090306f974541ea06680ac81

                                                                                                                                                                          SHA512

                                                                                                                                                                          e4e10ad6143f975cd444c1611c00e11cabee4dc1859b3810ef7d2c56097ed633d4f1b92fd54c1f8ee3a459e6abd0654e215fdae492541bf51b1f32a8810dedcf

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.ClearSync.ps1xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          235KB

                                                                                                                                                                          MD5

                                                                                                                                                                          5ed7a4da514171c7fc0186154a2c7997

                                                                                                                                                                          SHA1

                                                                                                                                                                          e8e4e85e7e34110b6503b30767839a644164b992

                                                                                                                                                                          SHA256

                                                                                                                                                                          99f0a7142a551f4ed6a135463b67d923c5e685fc4b0ead5d6f6c8c1003f1882e

                                                                                                                                                                          SHA512

                                                                                                                                                                          060ecc7a976c6e08cc786b6e273f41a6b73c90c773f0ec187494cfa4548f8cbc900340dafc499a102a5724285cb805387fc2837be676f2204f1251d0f7efff89

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.CompressClose.odp

                                                                                                                                                                          Filesize

                                                                                                                                                                          292KB

                                                                                                                                                                          MD5

                                                                                                                                                                          e0b3fd3f6dbe28b09cfe2ddb549dd5b7

                                                                                                                                                                          SHA1

                                                                                                                                                                          1bafdc4337fa538aaba3c1588fe3c67dfb3df50d

                                                                                                                                                                          SHA256

                                                                                                                                                                          68eac1560b732a354740e70adcc4db8d77d7ecfa8163b812c9b3facb1d8bd988

                                                                                                                                                                          SHA512

                                                                                                                                                                          eddeea9e4128d517f89568aece3ee57f47f216318070f1c9d57f4c91819dc9409da5416895a78a20b38ca211100f11e7c3cd8294876b0791d873038b92a2b08d

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.CompressGet.AAC

                                                                                                                                                                          Filesize

                                                                                                                                                                          200KB

                                                                                                                                                                          MD5

                                                                                                                                                                          753583e2ae32e4587362b2a148221a4d

                                                                                                                                                                          SHA1

                                                                                                                                                                          52f56e64f870eab0a1964d67d56a3abaf82f9f3b

                                                                                                                                                                          SHA256

                                                                                                                                                                          157324f1027cdb564ffbf4d7c9add2502916c66e42c404b9dc30db53d48845d1

                                                                                                                                                                          SHA512

                                                                                                                                                                          0d8eded0e98c5f1d03d846ba544819dad657eb65b1ae25adaa540ce3d1eec54ab275e6c459365991d6f10ec766728036878d9b02ac6d8c3bb8ea335e5d2b4b38

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.CompressRead.gif

                                                                                                                                                                          Filesize

                                                                                                                                                                          166KB

                                                                                                                                                                          MD5

                                                                                                                                                                          2e691274750373bdd3b9b013edcf9962

                                                                                                                                                                          SHA1

                                                                                                                                                                          99c13f6167804c1cdc4b0c7ce86a8dca982fb588

                                                                                                                                                                          SHA256

                                                                                                                                                                          3e48bb43859dc851e10818742d3a2b2ef8c8ef64bd514825f6097c4e6d2ae1e7

                                                                                                                                                                          SHA512

                                                                                                                                                                          511d0a61cbd1c5e957e34e1a375db9db15c11bcd94408b1686b23b8fa072681781e946d28720f9a891b6fa356020e20e373cccff496d871c13b91c93d4b3fdb8

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.ConvertFromSync.wm

                                                                                                                                                                          Filesize

                                                                                                                                                                          246KB

                                                                                                                                                                          MD5

                                                                                                                                                                          e0390a36602bc45f27e35a86744e54ef

                                                                                                                                                                          SHA1

                                                                                                                                                                          f88c8bfefecaadc6c14cf6b8381ac4bf73ec483d

                                                                                                                                                                          SHA256

                                                                                                                                                                          bcbd91892261217180ab345eb6d29b875c53eabcbc44aa1e931e6b9752a70c93

                                                                                                                                                                          SHA512

                                                                                                                                                                          4a5d2e44bd93d859561775a57dc5e7566337382b180be1e52bdea292b2331dd3eb1a64e5f8960e269a429f56c7788d8f814749affb5a613b2960c9feb711ef56

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.HideFind.tiff

                                                                                                                                                                          Filesize

                                                                                                                                                                          315KB

                                                                                                                                                                          MD5

                                                                                                                                                                          3452d35cb6bb158261b4864885bd49a2

                                                                                                                                                                          SHA1

                                                                                                                                                                          c69d6afbc58661fd949f666060848d692e13ea87

                                                                                                                                                                          SHA256

                                                                                                                                                                          53e2c5d107f791de66acca97e70cb1b843c3b6d79143b3a8dc7574b4bf78633e

                                                                                                                                                                          SHA512

                                                                                                                                                                          a2943b2deb7c618f287396e62b37b8442c79052092e9283e16dba3dbe60c09add1a8246ea7cb4760853ce716dc2116fb6a194812be5963753545c896aa0d9896

                                                                                                                                                                        • C:\Users\Admin\Music\Lock.desktop.ini

                                                                                                                                                                          Filesize

                                                                                                                                                                          512B

                                                                                                                                                                          MD5

                                                                                                                                                                          3e5d2582a5d0c915afef6c8cafa343d1

                                                                                                                                                                          SHA1

                                                                                                                                                                          7062928a2ec000838f78dce8c48693a1859471e1

                                                                                                                                                                          SHA256

                                                                                                                                                                          34ae08d15c34e017facda7c39f7b5f9e8cc891b160072b908969a1a2523772aa

                                                                                                                                                                          SHA512

                                                                                                                                                                          2cb2f561be74448d361099883ea4fdb9a1ea17a82970459fff7e35802617726561b52955b147d5fb23d3a3bb3d88539af645886c2d0e46716fba5c641a2b90b7

                                                                                                                                                                        • C:\Windows\directx.sys

                                                                                                                                                                          Filesize

                                                                                                                                                                          48B

                                                                                                                                                                          MD5

                                                                                                                                                                          9768a0013346f1e95b3bb7a843498ba2

                                                                                                                                                                          SHA1

                                                                                                                                                                          920868c2f9455cb4dbfd229da81868734017cf60

                                                                                                                                                                          SHA256

                                                                                                                                                                          469d6d9507c277089454df59c1c686a8fc511a9f17b4b9c6f9ca9c5070c2d1dd

                                                                                                                                                                          SHA512

                                                                                                                                                                          41a9f3f6f63ebb32256e59d8562fb21e80dc1e53b5c988ed0dcef66dbf556f799559085b7f54426b0a29209ac1cc5e2dcabc2754d89d1b7c4e32257b8a5ae825

                                                                                                                                                                        • C:\alarm.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          60KB

                                                                                                                                                                          MD5

                                                                                                                                                                          84b81f71beda7afeded4085a84808465

                                                                                                                                                                          SHA1

                                                                                                                                                                          7199bd12cc0ef1f77fcaaba8b3ea5645ab388dce

                                                                                                                                                                          SHA256

                                                                                                                                                                          0884ecdc6f9a9ce52f67f6fdeaf02d579b2d7a1c7cf14d20d77c2906e41196a9

                                                                                                                                                                          SHA512

                                                                                                                                                                          698bdbc47b061ad37982195a16930caeaccda52f95f9c0d4ed33653590023eda6a2c3f110ea2112aaa67c99ed588d9117797aedd9298b36b37e78dcc5c74a5ae

                                                                                                                                                                        • C:\amogas.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          27KB

                                                                                                                                                                          MD5

                                                                                                                                                                          7c96d6b14ab956a856d47e87c4be4553

                                                                                                                                                                          SHA1

                                                                                                                                                                          a4626ab555204ae9221547b539fe9fe8b21cf500

                                                                                                                                                                          SHA256

                                                                                                                                                                          3e6482553b51c3bf6d419f8333647f59762240861c79f166d1995fc59eb189b4

                                                                                                                                                                          SHA512

                                                                                                                                                                          aef86dfb77cce4064a634f3b1accdebb3c066e6d9fc966538df80b2c0d948a017b1af1bd34d93d525f907bb983504544d541ae1a1f074caabaea55d71b4f3f3c

                                                                                                                                                                        • C:\amogus.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          32KB

                                                                                                                                                                          MD5

                                                                                                                                                                          c30df0f1ba8d92eccb020946a107c7fe

                                                                                                                                                                          SHA1

                                                                                                                                                                          fe95d0b0246a4ecc25fc89ee7102647e12c1dcb5

                                                                                                                                                                          SHA256

                                                                                                                                                                          3d6d12cadb2ef6fe5b2a03d15964512bc32895e338c2da25ae2cb07bcb31deae

                                                                                                                                                                          SHA512

                                                                                                                                                                          624aebee4d918c8eed1716d17829a36104eb5aeb2d23be021e61f9d8e59a6aeb7215c14365ac081fa2f820e561aa108be25640d1634983dff7ca8ebd4dbd6a45

                                                                                                                                                                        • C:\amogus_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          42KB

                                                                                                                                                                          MD5

                                                                                                                                                                          43042269818924374a29891d79cb676b

                                                                                                                                                                          SHA1

                                                                                                                                                                          f34ef8a688e15efa9c0117816a617892a2730bb8

                                                                                                                                                                          SHA256

                                                                                                                                                                          77aa5f8536b9c30133f8083712b2d5434123d31a6ed41f0680fce52e06144187

                                                                                                                                                                          SHA512

                                                                                                                                                                          09cefcf48c1ebd4d5593d6d4f6973ff39330d23cf606da54bf79eeecd355842c675bd530b4e43d19b3dcc3fa6f4539d5d161ca423347197d6b319c17abab0e31

                                                                                                                                                                        • C:\avocado_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          80KB

                                                                                                                                                                          MD5

                                                                                                                                                                          6d362a3e515cc18d537f74fca1f75293

                                                                                                                                                                          SHA1

                                                                                                                                                                          99a5b363ac274e027530fa7a532a007b0e6c56f3

                                                                                                                                                                          SHA256

                                                                                                                                                                          c87dc1a91720070afe96d3be716d6203540da4d08e9d2339967a8a2a6a521d42

                                                                                                                                                                          SHA512

                                                                                                                                                                          896ac439ff7ff58b33413fd978bee25afffd9f4b2a8183ad63db861b92c7118bad0b845ccd85390c8b8a76ba57f6a6fb7d0ad3970bdb0a28fb9f2ed718979821

                                                                                                                                                                        • C:\bass_imposta_sound.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          149KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f6d67bd69fe398b2c5238fa4c9d6455a

                                                                                                                                                                          SHA1

                                                                                                                                                                          a8c7dfb2cd54dd46f2eb1e2fe6a19bdf40c47e44

                                                                                                                                                                          SHA256

                                                                                                                                                                          3ad823c535650fcba2de953fb2ce6fc46afeb04e529494e6b60b788cb28ddc32

                                                                                                                                                                          SHA512

                                                                                                                                                                          63e0e262338850ffe35929af320d17eb850efa046f860ca4fdb93518dbeeb2fe9ab3d4d13305c6d1f5c9fe78b42615ac0794d160b66fad5e3a30309dfed117e8

                                                                                                                                                                        • C:\ben_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          109KB

                                                                                                                                                                          MD5

                                                                                                                                                                          35ed09899d21d2f9806e5c4eb1411324

                                                                                                                                                                          SHA1

                                                                                                                                                                          5afa7972868a84f4e49d65f149aa09dda07870d2

                                                                                                                                                                          SHA256

                                                                                                                                                                          66775b29fdbd36e7ea15b038224a12271fe84b0e1129b11dec008af1dec986b3

                                                                                                                                                                          SHA512

                                                                                                                                                                          625d060ab49f371a9416315f85f6c01874cc19bfd5a4fb9b0a84287f1af0411695623e4176e62afa6623b16339b4c603f6a2179fe00ef505fdcd97e2b36cf820

                                                                                                                                                                        • C:\bom.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          37KB

                                                                                                                                                                          MD5

                                                                                                                                                                          1c782f17124b6eea9619acc46fc165a4

                                                                                                                                                                          SHA1

                                                                                                                                                                          aa22fe4a52723cf2ec83af3b478531c83ac1c589

                                                                                                                                                                          SHA256

                                                                                                                                                                          9f1c04f4d37d995f9f6cdb7751be399468c275f91c35f30bdb45ff9ff31190eb

                                                                                                                                                                          SHA512

                                                                                                                                                                          2b63129054cffd9037963f9e42c46c489e697f81109f8465c9cf3915894f143ffa444e9fb1bef195111ea915f36b51f08246b5ddc7ae5763d056bd0c8b0a7921

                                                                                                                                                                        • C:\dad_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          91KB

                                                                                                                                                                          MD5

                                                                                                                                                                          8883262af502c220932bbc50979391ca

                                                                                                                                                                          SHA1

                                                                                                                                                                          0be9ff95e86e798493f5f067a6dd3ddec9ed6832

                                                                                                                                                                          SHA256

                                                                                                                                                                          f500586d27d938ebfc965c59cdc42e361b78bc41246d52a075bc278271c96fc6

                                                                                                                                                                          SHA512

                                                                                                                                                                          ca78bd4cbf199ac1ec91058e48f357b3dae908a5bc06eba132ad9e143d5791d11e04462a96bf836999dd412ff0d9f37d06243c8b944f84ec354a3fb223b1d076

                                                                                                                                                                        • C:\fart.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          38KB

                                                                                                                                                                          MD5

                                                                                                                                                                          e87a6a5fe2591cb8c7a88c0bd4cc8d3c

                                                                                                                                                                          SHA1

                                                                                                                                                                          75c4ca221b2f4782709f16230059bf8413de13b9

                                                                                                                                                                          SHA256

                                                                                                                                                                          840bbecc0e95ca503740df9ac0ac944303c4a4c5f163a3eb4d4aea329629371c

                                                                                                                                                                          SHA512

                                                                                                                                                                          2fce9c3827b0d16828175f8ac86029f615614ad0f147c95842113824d8177e2919cd0e09d67b9723396d259dea99e3b465b7a83972a8f1d344925cd8c14f0605

                                                                                                                                                                        • C:\guy_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          81KB

                                                                                                                                                                          MD5

                                                                                                                                                                          caf2b6d49aae9303b222fdd06b91f10a

                                                                                                                                                                          SHA1

                                                                                                                                                                          12b967bd3aafa465c228551a7cb2d70f8b9f972e

                                                                                                                                                                          SHA256

                                                                                                                                                                          2b670bfb2029e8f023f13180780c648f606bb91fd5854e45e08c27bad2f4e1b8

                                                                                                                                                                          SHA512

                                                                                                                                                                          0eb51b3e222c4843fb3d79bddfd04faf41135845f1d20a320be84f076289be9890624cb34b73bf4093b2ddbb8d48ff409deeec5aaf3b10216204a24da4c2f92d

                                                                                                                                                                        • C:\hell_no.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          77KB

                                                                                                                                                                          MD5

                                                                                                                                                                          22aa4efefa11404c5656516f4f257a59

                                                                                                                                                                          SHA1

                                                                                                                                                                          2b7476f4fc38d51303dc78dcdef4577ea59efa09

                                                                                                                                                                          SHA256

                                                                                                                                                                          88f4e80980753871fe322f8dda83e72900cca29961efdf25bd119b259a57d05e

                                                                                                                                                                          SHA512

                                                                                                                                                                          167d77f6f5aeb19fc98b6dc969f8ea91906aa23f5771b3f764884a685acbea5fa545486e72daf79decfa86265e6718a0d5e95c6f9c01bbc14a5c6b7c0ad2380f

                                                                                                                                                                        • C:\obama_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          91KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f89f675153effeea979e32716d1dcac8

                                                                                                                                                                          SHA1

                                                                                                                                                                          84780277f79505ccf920d13391726741e127a79d

                                                                                                                                                                          SHA256

                                                                                                                                                                          99232a1b8d11825ccdc89ad8a9e095c6a1c36731836c17207ec5f45cfc0270f7

                                                                                                                                                                          SHA512

                                                                                                                                                                          8c447c5a226a127cb671eac033bc7db370a5dd47aeed7e46fcbd112684bcbff300827292c8bd87aee6f21bff887c4c04b7620b3bc22a3b6bd3b6843678083fff

                                                                                                                                                                        • C:\omg.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          51KB

                                                                                                                                                                          MD5

                                                                                                                                                                          4f0ad7516cd72bc8e78452edbfb7675b

                                                                                                                                                                          SHA1

                                                                                                                                                                          fdaf974becd0d3d66eb580df0e4beaf048ef22b4

                                                                                                                                                                          SHA256

                                                                                                                                                                          654700adddf4f3b7f18f08d3d7ba2df035a026fd38b86f700b950d4ce4cc0cfe

                                                                                                                                                                          SHA512

                                                                                                                                                                          d973a212cb46199bfbb938edd724e187f52d273eb92f0f32390f6b8c269886d55a2009545a3b46d456eb8a42f1c76e4956bfde803898d053e2164aa58a92f584

                                                                                                                                                                        • C:\rock.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          35KB

                                                                                                                                                                          MD5

                                                                                                                                                                          2483ba5ed0b989e311c585760c624055

                                                                                                                                                                          SHA1

                                                                                                                                                                          e4a793b783beb97a94d04c2e2795f02aced64d14

                                                                                                                                                                          SHA256

                                                                                                                                                                          651ab26c519b7a0ac97e0adc3c452efbc9233f695f5ae0bb70d42d5b3e37cac5

                                                                                                                                                                          SHA512

                                                                                                                                                                          a37554d540383958614fbd898dd7435476480b4c7aa83b9191f626567c1835f338ec35c4799fa544d9cc0bc2aa7b2139ec929f26bffb4fc0424c10c09b8a72b1

                                                                                                                                                                        • C:\rock_eyebrow_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          56KB

                                                                                                                                                                          MD5

                                                                                                                                                                          56afb11ebd7367af4c03b065ef3580f3

                                                                                                                                                                          SHA1

                                                                                                                                                                          4f30fbf3d5c0469533c1b33b98aa612e6704c14b

                                                                                                                                                                          SHA256

                                                                                                                                                                          da6e60fa7d074a5b8a90e3ebe53ed1c01661423ec0ec1ff154857bcef14ecff7

                                                                                                                                                                          SHA512

                                                                                                                                                                          eef0e1be7dfde83f546d36f41a6339ce17d5c7153da3f3d003838c333884458697b2d156abf9c119f4786d4d53f08563b79d17c0c3e316dabfa519db145e32c4

                                                                                                                                                                        • C:\scream.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          53KB

                                                                                                                                                                          MD5

                                                                                                                                                                          2d714bed0f2a11e2daba10305c667e93

                                                                                                                                                                          SHA1

                                                                                                                                                                          20af1afd4f3283cd142904a285b6471b119f8079

                                                                                                                                                                          SHA256

                                                                                                                                                                          a65f7847e0c4ec164b204cb5abb90a4b58cacc4c957f0749b52c7130094b860d

                                                                                                                                                                          SHA512

                                                                                                                                                                          da26fb5aba9377c746993daf6ffbe3df60db4ce0992058b7d70a1a26398f9014a7c111775e1acfe26526500a90daaacf805dda3b8a7cce87c36b60f641fd0119

                                                                                                                                                                        • C:\skream_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          52KB

                                                                                                                                                                          MD5

                                                                                                                                                                          21a8888b16b257c094fd38d09612fc48

                                                                                                                                                                          SHA1

                                                                                                                                                                          9ce7e89da63c663987c9624a845144a4fecc3e72

                                                                                                                                                                          SHA256

                                                                                                                                                                          e1e71925f5169df514d0c196f41fe91ae1419426ed28422aea78ab85b4dafbc4

                                                                                                                                                                          SHA512

                                                                                                                                                                          cc554f7180b8f79de7ee6278b19fe8a4331ab9caa5cd980caf66eeed973a3577b56dfb57e4c0797d7987ce55ff8ab305a9a51b27568ae0fb9414498d3c494af2

                                                                                                                                                                        • C:\speedrunner_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          66KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a0bd05bdf6641d55fff217fc45b6e7a4

                                                                                                                                                                          SHA1

                                                                                                                                                                          9c4f824bda8ec17d0c23fbe50cd8f6c55d5784e3

                                                                                                                                                                          SHA256

                                                                                                                                                                          c34b87c2f0454d80f7b1989e80eb5b6ca04052c16f94ce294f15a0053cc76ce2

                                                                                                                                                                          SHA512

                                                                                                                                                                          bdecd28c096925852936f0aa96a406596a3d60bbff51ac1e12d9241f4c7552630bf12aeb73cfed8cf8afc916cad90d4e6d23e5eafea6e14f73b73ced4992bad3

                                                                                                                                                                        • C:\startup.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          16KB

                                                                                                                                                                          MD5

                                                                                                                                                                          12b162b0c010fcc23fa43b03cbb76509

                                                                                                                                                                          SHA1

                                                                                                                                                                          a696c6b6d5c0216b3eddf8dd4eb2a269abe19d00

                                                                                                                                                                          SHA256

                                                                                                                                                                          6be68911f16ec9283da61ce222d946c9e8e5ea39d71ad9d23216b4961947d180

                                                                                                                                                                          SHA512

                                                                                                                                                                          f983d2a19c18574cd09c1be30f44a6c8b586bfc74341367f6dfab26a6c7440f73e7ba252e66d1ed5fa6af5a78dd3f69de3909a369fe08ad78ca1e539eaa036c4

                                                                                                                                                                        • C:\sussybaka.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          38KB

                                                                                                                                                                          MD5

                                                                                                                                                                          8853da13437c21bd8c8b131dacd73d4f

                                                                                                                                                                          SHA1

                                                                                                                                                                          844f143af3aab36ce1cee355eb7e7c5a4ba67f4a

                                                                                                                                                                          SHA256

                                                                                                                                                                          7616c3dc3ef9a7a6d08a54a5e955b33f001647f0821c29b92b022c044226e480

                                                                                                                                                                          SHA512

                                                                                                                                                                          31a3989fddbffbb8e6979bf3e855eb13ba97146cc1cee4ab6f939cf002e0a2e698a12383f0f2a8d3d6aab437da9bac7e641189565a7ced1d2c5ae1a8f149cf30

                                                                                                                                                                        • C:\the_wok_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          68KB

                                                                                                                                                                          MD5

                                                                                                                                                                          8e1462f2d993e1bd6fd00268623abece

                                                                                                                                                                          SHA1

                                                                                                                                                                          67367e20f64d32ab8d1840dedd91d686ac989952

                                                                                                                                                                          SHA256

                                                                                                                                                                          ac084f24272a89b616e21add98739a7c4dc55830e6c7ac8fff74a9d495eef4c5

                                                                                                                                                                          SHA512

                                                                                                                                                                          9184a8a87c2b5ec222df4d51a940977b2ec784c634ca66e5d11a46d35ef1a38162b6e1090e1df364eaef3fc1313a39a989a803c2ace603e90fb4473ec9105ace

                                                                                                                                                                        • C:\ustupid.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          20KB

                                                                                                                                                                          MD5

                                                                                                                                                                          afc635b14cc1d36ce347aa3ad423bcde

                                                                                                                                                                          SHA1

                                                                                                                                                                          306b78de47455914a0550229035516b951e638c5

                                                                                                                                                                          SHA256

                                                                                                                                                                          80d9439a20f9f0b09bfb6b7b71a84bd9875c2363141b323522ab0473df90c0b5

                                                                                                                                                                          SHA512

                                                                                                                                                                          ce4b43b1b876b741d312a045fede59c4b1287f084a4fd0a1929aa8e6da3820450f25ae9436d48885e30908201e6a82cd3ad7e8e9d92b16aa68aa1e0b37366d40

                                                                                                                                                                        • C:\ustupid_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          59KB

                                                                                                                                                                          MD5

                                                                                                                                                                          6e3e6e1a0f01c0168c7b1fcb4e63a89d

                                                                                                                                                                          SHA1

                                                                                                                                                                          785688b7caa8f28583e417a651517b721405d835

                                                                                                                                                                          SHA256

                                                                                                                                                                          b856abc28d3d026fbe327376bbd72f7a169012bc987d59dc9fe600e9714ff634

                                                                                                                                                                          SHA512

                                                                                                                                                                          d2038420bb997ff0d97561ff8b167822de36fa1f924962abed0f29b3c8b2ef7bf9a9f52311738d498b894cfd7d488ee0a1741150e45782e555028483bb1ecc99

                                                                                                                                                                        • C:\walt_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          113KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fa516d1d0fce7db4dfa81e73cf74e917

                                                                                                                                                                          SHA1

                                                                                                                                                                          ecbb4b0ab88b6c7574279693bda9a7cfd0a2d9c0

                                                                                                                                                                          SHA256

                                                                                                                                                                          335b92e10ea035e1061ab8d44d02472d2db80a838eae63900b9d02ab9483c4af

                                                                                                                                                                          SHA512

                                                                                                                                                                          f9adda2c53121fbe6a0c42582f2af6d19dc8225f9422a2163210153bd5bc458cd4fadb1d97085fadc658b45557ddc3650ca96d68764241a153c70b68569dec8f

                                                                                                                                                                        • C:\whatdadogdoing.wav

                                                                                                                                                                          Filesize

                                                                                                                                                                          34KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a55dee0b6901e6cc5dee3ee6db227b41

                                                                                                                                                                          SHA1

                                                                                                                                                                          914b3ff1faa2a3009b13044ba08f08a71f2f3f20

                                                                                                                                                                          SHA256

                                                                                                                                                                          6fd47a0e90adba6e9560ba5fbbc162b346b528aba268300f560d5a144924bd9f

                                                                                                                                                                          SHA512

                                                                                                                                                                          ecbd6e493df019e3045a420e0aa6235fdee1d1e97e455370e29ee7563e7c25f9d75afa9b7c1c9d8e2693e90e1271811dbe88072ba8ec4e93cf23d08cdba0f4b5

                                                                                                                                                                        • C:\whenimpostaissus_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          89KB

                                                                                                                                                                          MD5

                                                                                                                                                                          57a21de76111fd67dd32bbf5b8cbbe8f

                                                                                                                                                                          SHA1

                                                                                                                                                                          127d6c20da0234ac8bc9dd65391fcfd695185274

                                                                                                                                                                          SHA256

                                                                                                                                                                          8a5f22591d81c5ce727cab12fa380c3331fd9a3118a69667bd21b8ed9d6bb96f

                                                                                                                                                                          SHA512

                                                                                                                                                                          4177b17475c7dff84fa577077d844e27af7d8dafba7f6beacc1b45174d4df2ae88f242529dfbd5f6e5b80bbc5ceb949ba0fcd2c3c7065dcf32226b0e9da85629

                                                                                                                                                                        • C:\xina10_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          34KB

                                                                                                                                                                          MD5

                                                                                                                                                                          312462041a762b3ca42e106dd23c77ef

                                                                                                                                                                          SHA1

                                                                                                                                                                          199e0d9650f70bc9d4aceb95da7d7200668dddde

                                                                                                                                                                          SHA256

                                                                                                                                                                          df0e53d5be9ecf641313960c107ab41bce93c8cf4849d006077e33a424cb15c5

                                                                                                                                                                          SHA512

                                                                                                                                                                          4d57c6b4659ededbecb127a9676f6cc64644cc270e33ceabe469e84c2a1b38981134aafb8f1d1e53cd0d6cc1f22f08fa3bd7e8568e8f1d907efd4bd07b51f790

                                                                                                                                                                        • C:\xina11_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          34KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a6a4e4e3398f437cd4d431d85e9d54a8

                                                                                                                                                                          SHA1

                                                                                                                                                                          4afca6d917412205203b9498fd1fde26a926b7af

                                                                                                                                                                          SHA256

                                                                                                                                                                          03f9584495fef61a2f54a0f0cc469f26f25f35394be48b5d954d449ca37bc784

                                                                                                                                                                          SHA512

                                                                                                                                                                          2ef129c544c12373b8eb06160450ec4c925d2b3075d1f7925859c4a0f184911dda59b6687944b7fc086276b3966e1111535e4e859b3f3715078e1e68dfe6ac2b

                                                                                                                                                                        • C:\xina12_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          813e47eaed5990689d0d53815c68d29f

                                                                                                                                                                          SHA1

                                                                                                                                                                          a20cf1de1b653e7267c5dd134db2207fb1150e3d

                                                                                                                                                                          SHA256

                                                                                                                                                                          710b492db43e192fdf281d9d5ae58a06500b506694ce4685c64d413188c4b245

                                                                                                                                                                          SHA512

                                                                                                                                                                          9aa5898a1e6942e41d7cf2ccb9dfb96a0b12c4d148d24a9ec8b9f5bf608bdc0312fdfd97c779a73ea81dcb9ce7df06941efd2a0841b2afc6b439528ec0f84fa5

                                                                                                                                                                        • C:\xina13_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fafd6d2d4a64f53220994bd4bbb9de94

                                                                                                                                                                          SHA1

                                                                                                                                                                          05d90ef5327c3ec114d0a36cb29927ca4796e5b7

                                                                                                                                                                          SHA256

                                                                                                                                                                          a8cac8b5521a9ff85faa0999ed21af3669c57a9cf51eb14760c001305c44c195

                                                                                                                                                                          SHA512

                                                                                                                                                                          64cc77861e5a3679cf2f323ecd673805aa6df266e720d4e889ca283017201d25f194767b7c36aaeeb4a4eebe062d2597fc3e13f1b7e6054b4707ee74178df232

                                                                                                                                                                        • C:\xina14_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          398df692cd2ec1bb7920ea5449d965a1

                                                                                                                                                                          SHA1

                                                                                                                                                                          d4fb9dc4e31cb5ec3ca4e2dd2223a0d4bc4256ec

                                                                                                                                                                          SHA256

                                                                                                                                                                          76fe950ef1408b93f1a13a7197cd3221d8eb6f6660ccf9aaec3bf94f8b9ef703

                                                                                                                                                                          SHA512

                                                                                                                                                                          2156c194183d961a06daeca442fe8da4808f2065e8936f4fee10f487784721c0976a69e39a466f1bc1a0c31e082025774a391bbad2138cab638bce4153ca7201

                                                                                                                                                                        • C:\xina15_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          b28cdde3e6551f820fbf4d1ae4da6677

                                                                                                                                                                          SHA1

                                                                                                                                                                          8e1fbc56e308b24dca374eb5debc9e9bdd5f6135

                                                                                                                                                                          SHA256

                                                                                                                                                                          dc1a15e29698e60ac326185e619eb875e869ea3d01746ac0701d11a2716f6b85

                                                                                                                                                                          SHA512

                                                                                                                                                                          21bab2e588190151a380d0663f0d8f307c95805af7197bb2adf6019bf28eb3cf57d9e7f621395a7f23ca847811e5a9fd316bc45fa3208c71832966c4127b8cc6

                                                                                                                                                                        • C:\xina16_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          66bd198bf0cfca918c45067bdbc354ea

                                                                                                                                                                          SHA1

                                                                                                                                                                          04d7bda4cd83a7d1e950a8da7f409eea72033578

                                                                                                                                                                          SHA256

                                                                                                                                                                          06f24e06f12ce66cb87a29d7eac67befb737ee1400f11071d4ca83ecb5c78dfc

                                                                                                                                                                          SHA512

                                                                                                                                                                          d2d775f19e5cd72671c739d03b6bed554dcc517f93bb83cba7bbe54fc3408cb8d177bb237620894f0cb45117bd902b6e39a7ce3f630f21c8c45b08d2280306c7

                                                                                                                                                                        • C:\xina17_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9225599ab65c613124185b2529989cd5

                                                                                                                                                                          SHA1

                                                                                                                                                                          94cf9fdd8808ddc34d8c552a5fd52dd3bd6b4043

                                                                                                                                                                          SHA256

                                                                                                                                                                          e64658b6ee5ee61b29cbf79812b1f6cc45367eeb2cbe9da9fa5f1e63979644e8

                                                                                                                                                                          SHA512

                                                                                                                                                                          b535e4bf42d1bfe8d0280a694e8663fdfda224b030a80f0ccf0568009e1476cc062c3e88f9e3a3c31b62e5156504570fc17f1466acc234e83cf1f3628ac999b1

                                                                                                                                                                        • C:\xina18_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          3807d3a5a2f9fb626c97e048e3b64b1e

                                                                                                                                                                          SHA1

                                                                                                                                                                          1b14e6ef507551e72370b03a876e9534b0da3883

                                                                                                                                                                          SHA256

                                                                                                                                                                          5d99c8bc9f302d87e86addeebe013c34ca4305f3c9752fd92e979ac6d97aca34

                                                                                                                                                                          SHA512

                                                                                                                                                                          fd5ee94044f25dd20495dc3bae17ba89257211be6ca36df224813d7a71afe8270df7e8a74d11655dc6ab1397b5ceab3e56bfeac149a09d3015f10d4b50755164

                                                                                                                                                                        • C:\xina19_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f6ecf41acb43f283021fa952e762b9e4

                                                                                                                                                                          SHA1

                                                                                                                                                                          cdd89bee571630d93ceb186ec5dbef3fc28d0019

                                                                                                                                                                          SHA256

                                                                                                                                                                          9962141bc3e2a1936bffa25de1e8ad85aa630d4a9770f90e9900534784683be2

                                                                                                                                                                          SHA512

                                                                                                                                                                          af637de1c505023a03e2fce65847fbb596a3c7dc6789f636dfc78b185b583e801274fc00f63c12e531a6eefb505a0c2bb29222a133a4f0d08a1eafa3be17acde

                                                                                                                                                                        • C:\xina1_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          ea930fd90cdcf6d31a2ec4c1559b41f9

                                                                                                                                                                          SHA1

                                                                                                                                                                          498db95c46ed784d6c6b83b6ad30184ceb7f80f0

                                                                                                                                                                          SHA256

                                                                                                                                                                          aba2367393eab39caa359b90c62ac0231e7af228070c50496a984be89bba4f3e

                                                                                                                                                                          SHA512

                                                                                                                                                                          726bf8c578a9019ac025c2fc021cdf7c111597d182720d62c48be9ea4fb3c8f4da777ff2305695a27d0db61c3af9da48e99ada694eab71df9fec459c50a00656

                                                                                                                                                                        • C:\xina20_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0e027d0c11f6adfa7aaf640ef5cbb83c

                                                                                                                                                                          SHA1

                                                                                                                                                                          b9d69ff6f1ea832de0c713fd2011a1d588cc1d6f

                                                                                                                                                                          SHA256

                                                                                                                                                                          93bd144b21f021708564d17a127b241b6236ec7922cc772a78bbdfa9b0fd8ee4

                                                                                                                                                                          SHA512

                                                                                                                                                                          77c242c76e6f3aaea9df664ccfa280af6c4931adad908a069073d35cbbf521f5650a0135239f6f831049a5d13ebab595169f27eb9f847a952f8a47a18e092d7c

                                                                                                                                                                        • C:\xina21_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0c12f084e52be0801c90d48ebaaa9c4b

                                                                                                                                                                          SHA1

                                                                                                                                                                          8954a0a34e1344e0ef0a8920c9935dedd1eb4dec

                                                                                                                                                                          SHA256

                                                                                                                                                                          b1b86e511ff375352a46b9b6fc8f3a7a20c55b7516dd1dd9d5af38adb7f527e9

                                                                                                                                                                          SHA512

                                                                                                                                                                          01b8f27eb18a77a7be9a1b910b93c16afcfda1e0c371463619dc6562bfc469af34d152282bde6fd4c14fc191c6b7cf1877d8607e257489498ba1c96f68c52e2c

                                                                                                                                                                        • C:\xina22_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          adb1b10c27228fd7a59a50a5839ee6bb

                                                                                                                                                                          SHA1

                                                                                                                                                                          579e67dca36773986fcebdd955f86cb6d47a7164

                                                                                                                                                                          SHA256

                                                                                                                                                                          4e876b157be27295d52d754db4367a05e2bd10550006355fef27542de0603c1d

                                                                                                                                                                          SHA512

                                                                                                                                                                          a2efeda33021d205b11cfce73b9897e82571f42596438020786dc58abcb0e42287ac3730f5f57fe92249f5b8fc8cf74f391fab5ba25004ee84b3741be4849499

                                                                                                                                                                        • C:\xina23_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          32KB

                                                                                                                                                                          MD5

                                                                                                                                                                          cf293a4f73d67d90b43d6fe2fc707e0d

                                                                                                                                                                          SHA1

                                                                                                                                                                          c779c8794392ac1d907170999a15d8a7440e85c0

                                                                                                                                                                          SHA256

                                                                                                                                                                          d2767668d76008045bb9ac633f6ae30daba499cdd4c803030b3f4119169220f6

                                                                                                                                                                          SHA512

                                                                                                                                                                          cd2dbe59f40101d36bcf9b2da70ed8f03e66e5c57386be68bc929e1fd05ef2b806afae135ec703e960bc159400cb402d409e7745f7b348ff47fb24861267dea2

                                                                                                                                                                        • C:\xina2_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          32KB

                                                                                                                                                                          MD5

                                                                                                                                                                          d129b378192f4f70d831fb7034d7992f

                                                                                                                                                                          SHA1

                                                                                                                                                                          c782ed401d9a33644568dd3d4c78b49ec3d9a4a0

                                                                                                                                                                          SHA256

                                                                                                                                                                          3d41e7d8040bc0c91f371f88dbbd7eee29e7c8408d2de331636096f81cc57b4d

                                                                                                                                                                          SHA512

                                                                                                                                                                          b31d3191ad62011d53f77e789333f3669b515172aa30f914ca116af0b8b6949a031b002aa391637fdd7ab9a63a5b0dd5ce37dd691766f3d896ff570dcf23b2a7

                                                                                                                                                                        • C:\xina3_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          32KB

                                                                                                                                                                          MD5

                                                                                                                                                                          37cf805ea6e33432e8bcd4e028938faf

                                                                                                                                                                          SHA1

                                                                                                                                                                          c0ea05823441d9115a2f079346efff5ad2967930

                                                                                                                                                                          SHA256

                                                                                                                                                                          c638d0fedabee0972e593ef24aacb2bc86ddcb6a3357d0ddc2228e76d73051bf

                                                                                                                                                                          SHA512

                                                                                                                                                                          091bd6d4e0f5707df74a461657b513cf7c61b94e780b80f8f93fb000b0e29b7f59c08a35964d4dbee005e7bd9d3c9be5a69a2486996e3a9f09a3d3784d424a4f

                                                                                                                                                                        • C:\xina4_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          32KB

                                                                                                                                                                          MD5

                                                                                                                                                                          5e3393e772f5aad126c10b86b8b59c62

                                                                                                                                                                          SHA1

                                                                                                                                                                          ac70b3a5ce29c2d432263a11a4f157fa53222c23

                                                                                                                                                                          SHA256

                                                                                                                                                                          049e8a377ff04c64b0e804d14a96f1469bfdf60c6b38d807d8b1af5b293221ef

                                                                                                                                                                          SHA512

                                                                                                                                                                          3903acb567fdfd0abff26dcbd4c7c9ebfe569569b1af78283beedd7c2343baa3e3fe19a2e851e43b7313017624435ce814dc839f79c67d3c7ee528b3c71666a7

                                                                                                                                                                        • C:\xina5_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          32KB

                                                                                                                                                                          MD5

                                                                                                                                                                          ef185b61dfa8298a39bd12bc5b5ad56e

                                                                                                                                                                          SHA1

                                                                                                                                                                          3401678e4ebf8a78c664994e864a18cde058c20f

                                                                                                                                                                          SHA256

                                                                                                                                                                          ff3838388c2ed572a4d2ce6b8b6d77490bc56bab33ccf8c586bac27d2df83b68

                                                                                                                                                                          SHA512

                                                                                                                                                                          e7fa3e4f302801e617442764a28b7f7a24a394319903a411f40d6da31d03b7530a8160193010ef868c90f9259d44085d113b73fc09a0e72c5a1f9f990d87e7bf

                                                                                                                                                                        • C:\xina6_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fc5f065a5e8ede646d1595c50f9253f8

                                                                                                                                                                          SHA1

                                                                                                                                                                          5c9a10baa223eca0ca3005b760b21f9dfe656e94

                                                                                                                                                                          SHA256

                                                                                                                                                                          90a1510f938da7440b9b0d2f82428885684761898d4f76575b1c2fbdfc245d92

                                                                                                                                                                          SHA512

                                                                                                                                                                          49a96c244bacdf8b5dde05f3b57c18d2f83a53f3f82bf32f6c8026d890e047f6b11d0d7d9357e8d6f509acbaa5fa37d5aab72c26e58f46c99885f272a747f544

                                                                                                                                                                        • C:\xina7_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          cb099d15874bc078218294749eb7b6bd

                                                                                                                                                                          SHA1

                                                                                                                                                                          27647365028ef3fe8df37d9341595501c5748b9b

                                                                                                                                                                          SHA256

                                                                                                                                                                          2efb6ed0f26f8a561014536a1eb846cd4467d830998f6bf2c89f5dbd4a87f1f3

                                                                                                                                                                          SHA512

                                                                                                                                                                          c350bd8959004da8cf76a4d79a25629c4e38ad57e22230a29c339685c076cfc0044cc241dc206016183549ac66da685a3d673938f0af6c69f40c0bb6ee5fbc2e

                                                                                                                                                                        • C:\xina8_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          33KB

                                                                                                                                                                          MD5

                                                                                                                                                                          337dc66064bf405d08a2c9c2f8b80ee1

                                                                                                                                                                          SHA1

                                                                                                                                                                          34e79eaf97bc9274222df62331ed464b06c26deb

                                                                                                                                                                          SHA256

                                                                                                                                                                          0bcb24229a3ca5ab524b3241e79d71d0b190994b77d4c420985e8f89b9557774

                                                                                                                                                                          SHA512

                                                                                                                                                                          61616a7d4e29c9a47b8f0f6c3a21e68b51ee2a185a2e0e6d3f7933a932305a246091c9ae757aa4d49601f2631e3cb5c62618a1e2a2932b957b9b279d019db337

                                                                                                                                                                        • C:\xina9_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          34KB

                                                                                                                                                                          MD5

                                                                                                                                                                          c7e83c267bc0e3238163b11a968d59d0

                                                                                                                                                                          SHA1

                                                                                                                                                                          180d269f95d88ab98c4abfaf5024119ab22f5424

                                                                                                                                                                          SHA256

                                                                                                                                                                          939f8ad378a8372438fdea72adb3f56cf4ecf3ab3d517efdbf5588c3a34be3dd

                                                                                                                                                                          SHA512

                                                                                                                                                                          054593312a083ae7f86b6aaa18ec206193b08368a8166f09815056ed339d1370ed0f03500fd39ad45bcba7a4a450b819415e695ff0a8cbca6db2a5999f9bb741

                                                                                                                                                                        • C:\xina_icon.ico

                                                                                                                                                                          Filesize

                                                                                                                                                                          75KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0f111a8457f17592240624b2e80a6c61

                                                                                                                                                                          SHA1

                                                                                                                                                                          23b009e988c3a95d9e8ac97e9baf2979dda3211d

                                                                                                                                                                          SHA256

                                                                                                                                                                          8d49d92735d094885cbb57a63988e6205b5a477f2a571aff2f1e8d295f3d8e2f

                                                                                                                                                                          SHA512

                                                                                                                                                                          4e14e5e9c834723a23d3982fa2c5223eb0ac09403bc5cde638733c2a96dc28f820f76b6614e444b5a2aef3fb9f53c6e8f1fffd265ae7bb0af0c372aa7f548bfe

                                                                                                                                                                        • memory/116-996-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/396-1484-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/396-1104-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/396-1132-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/396-1327-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/396-978-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/516-990-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/1564-850-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/1852-677-0x0000023394820000-0x0000023394840000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          128KB

                                                                                                                                                                        • memory/1852-708-0x0000023394BF0000-0x0000023394C10000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          128KB

                                                                                                                                                                        • memory/1852-673-0x0000023393800000-0x0000023393900000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1024KB

                                                                                                                                                                        • memory/1852-672-0x0000023393800000-0x0000023393900000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1024KB

                                                                                                                                                                        • memory/1852-691-0x00000233945E0000-0x0000023394600000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          128KB

                                                                                                                                                                        • memory/2488-182-0x0000000001040000-0x0000000001056000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          88KB

                                                                                                                                                                        • memory/2488-181-0x000000001B8B0000-0x000000001B900000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          320KB

                                                                                                                                                                        • memory/2488-179-0x0000000000F00000-0x0000000000F1C000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          112KB

                                                                                                                                                                        • memory/2488-167-0x0000000000580000-0x00000000006EA000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.4MB

                                                                                                                                                                        • memory/2488-183-0x0000000001060000-0x0000000001070000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/2488-184-0x000000001B860000-0x000000001B86E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          56KB

                                                                                                                                                                        • memory/2488-188-0x000000001B880000-0x000000001B88C000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          48KB

                                                                                                                                                                        • memory/2488-185-0x000000001B870000-0x000000001B87E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          56KB

                                                                                                                                                                        • memory/2704-0-0x00007FFA56790000-0x00007FFA56985000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                        • memory/2704-12-0x00007FFA56790000-0x00007FFA56985000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                        • memory/2704-10-0x00007FFA56790000-0x00007FFA56985000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                        • memory/2888-671-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/2932-9-0x00007FFA56790000-0x00007FFA56985000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                        • memory/2932-16-0x00007FFA56790000-0x00007FFA56985000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                        • memory/2932-20-0x00007FFA56790000-0x00007FFA56985000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                        • memory/3044-869-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/3176-54-0x0000000000360000-0x000000000050C000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.7MB

                                                                                                                                                                        • memory/3224-1041-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/3232-981-0x0000000002F50000-0x0000000002FD2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          520KB

                                                                                                                                                                        • memory/3232-976-0x0000000000400000-0x0000000000AAB000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.7MB

                                                                                                                                                                        • memory/3232-980-0x0000000002E00000-0x0000000002E2A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          168KB

                                                                                                                                                                        • memory/3232-979-0x0000000000400000-0x0000000000AAB000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.7MB

                                                                                                                                                                        • memory/3232-654-0x0000000000400000-0x0000000000AAB000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.7MB

                                                                                                                                                                        • memory/3232-1105-0x0000000000400000-0x0000000000AAB000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.7MB

                                                                                                                                                                        • memory/3232-792-0x0000000002E00000-0x0000000002E2A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          168KB

                                                                                                                                                                        • memory/3232-793-0x0000000002F50000-0x0000000002FD2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          520KB

                                                                                                                                                                        • memory/3232-1133-0x0000000000400000-0x0000000000AAB000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.7MB

                                                                                                                                                                        • memory/3268-460-0x0000000000590000-0x0000000001954000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          19.8MB

                                                                                                                                                                        • memory/3540-1061-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/4176-1120-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/4176-1475-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/4176-977-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/4176-1102-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/4176-1307-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/4176-1485-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/4324-858-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/5048-278-0x0000000000400000-0x000000000058A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.5MB

                                                                                                                                                                        • memory/5084-608-0x0000000000920000-0x0000000000F46000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.1MB