Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
655s -
max time network
659s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 00:42
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win10v2004-20241007-en
Errors
General
-
Target
New Client.exe
-
Size
167KB
-
MD5
774fff2810fc115bab05707f73047457
-
SHA1
6dbf565150aa9a791e0f9f345243984ec6f5fa5a
-
SHA256
11478265d9ce8d9c390a3c28960972d1c4fa3e1a532183d7ea7e3cdd039f688d
-
SHA512
dc5a9dd495b912f386b668c95622addce7ebb7fa23a93ffec144c2766695c94a4c00534e567d3a153009987e3fe2683d9715d058a677a20ce498dfcc2276c96a
-
SSDEEP
3072:pVMADoN36tnQviFCtABnKfWl9zmaF9byYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:pui9z9vM1/JdSI5eb
Malware Config
Signatures
-
DcRat 64 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 4364 schtasks.exe 768 schtasks.exe 2736 schtasks.exe 1532 schtasks.exe 3308 schtasks.exe 1692 schtasks.exe 4052 schtasks.exe 5108 schtasks.exe File created C:\Windows\TAPI\9e8d7a4ca61bd9 NVIDIA Container.exe 2768 schtasks.exe 2952 schtasks.exe 3916 schtasks.exe 2872 schtasks.exe File created C:\Program Files (x86)\Windows NT\56085415360792 NVIDIA Container.exe 3648 schtasks.exe 1664 schtasks.exe 3824 schtasks.exe 5024 schtasks.exe 3060 schtasks.exe 4228 schtasks.exe 4720 schtasks.exe 2880 schtasks.exe 3636 schtasks.exe 3152 schtasks.exe 4948 schtasks.exe 832 schtasks.exe 4168 schtasks.exe 2076 schtasks.exe 4528 schtasks.exe 2416 schtasks.exe 4032 schtasks.exe 4276 schtasks.exe 2584 schtasks.exe 3064 schtasks.exe 1288 schtasks.exe 3992 schtasks.exe 2756 schtasks.exe 2952 schtasks.exe 1480 schtasks.exe 4496 schtasks.exe 4540 schtasks.exe 3396 schtasks.exe 2632 schtasks.exe 3464 schtasks.exe 3792 schtasks.exe 2536 schtasks.exe 2804 schtasks.exe 4864 schtasks.exe 3324 schtasks.exe 1636 schtasks.exe 4180 schtasks.exe 4008 schtasks.exe 3288 schtasks.exe 4368 schtasks.exe 4908 schtasks.exe 3008 schtasks.exe 3376 schtasks.exe 4468 schtasks.exe 3724 schtasks.exe 952 schtasks.exe 4840 schtasks.exe 2464 schtasks.exe 3612 schtasks.exe 3224 schtasks.exe -
Dcrat family
-
Detect Neshta payload 19 IoCs
resource yara_rule behavioral1/files/0x0008000000023d78-619.dat family_neshta behavioral1/memory/1564-850-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4324-858-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3044-869-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4176-977-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/396-978-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/516-990-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/116-996-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3224-1041-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3540-1061-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4176-1102-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/396-1104-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4176-1120-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/396-1132-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4176-1307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/396-1327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4176-1475-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/396-1484-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4176-1485-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Process spawned unexpected child process 64 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4540 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 232 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3672 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4944 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3308 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2768 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4496 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2632 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1020 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4008 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3792 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2068 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4356 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2872 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3196 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4720 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3416 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1632 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1700 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1192 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4900 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4808 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2464 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4948 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4164 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3768 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4608 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3684 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3916 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3988 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2756 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3788 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1952 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3652 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 832 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1908 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2148 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3572 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4908 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3724 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2824 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 452 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4284 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2952 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4740 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2880 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2384 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3116 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4056 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3396 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5108 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2360 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 3312 schtasks.exe 147 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3648 3312 schtasks.exe 147 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7823b8a2bb434f1aacfc9fb759e07707.exe -
resource yara_rule behavioral1/files/0x000300000000072f-62.dat dcrat behavioral1/files/0x0003000000000741-155.dat dcrat behavioral1/memory/2488-167-0x0000000000580000-0x00000000006EA000-memory.dmp dcrat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7823b8a2bb434f1aacfc9fb759e07707.exe -
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 20 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 4f1cf730d4ce4c29b30600eaad3df6e6.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation navalny pass - 2000.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation discord.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation New Client.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation NVIDIA Container.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation discord.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation NVIDIA Container.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 7823b8a2bb434f1aacfc9fb759e07707.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation NVIDIA Container.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation NVIDIA~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation discord.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 390efcf5eb4a44d99da1269e043ebd5d.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation NVIDIA Container.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation NVIDIA Container.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 46fad423a4bc46e4ae4667d7213ed61e.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation navalny pass - 2000.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation discord.exe -
Drops startup file 8 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.exe 7823b8a2bb434f1aacfc9fb759e07707.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.exe 7823b8a2bb434f1aacfc9fb759e07707.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe discord.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe discord.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.url discord.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe discord.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe discord.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.url discord.exe -
Executes dropped EXE 40 IoCs
pid Process 2932 discord.exe 2984 discord.exe 3652 discord.exe 3968 discord.exe 3952 discord.exe 3176 390efcf5eb4a44d99da1269e043ebd5d.exe 440 NVIDIA Container.exe 436 Locker.exe 2488 NVIDIA Container.exe 2600 unsecapp.exe 5048 4f1cf730d4ce4c29b30600eaad3df6e6.exe 4520 NVIDIA Container.exe 4052 Unlocker.exe 3196 NVIDIA Container.exe 1380 discord.exe 3268 7823b8a2bb434f1aacfc9fb759e07707.exe 5084 46fad423a4bc46e4ae4667d7213ed61e.exe 4296 NVIDIA Container.exe 4176 navalny pass - 2000.exe 3044 navalny pass - 2000.exe 1564 svchost.com 396 svchost.com 3232 WINLOC~1.EXE 4324 NVIDIA Container.exe 3044 svchost.com 3792 NVIDIA~1.EXE 516 discord.exe 116 svchost.com 1784 discord.exe 3224 svchost.com 3540 svchost.com 2756 winlogon.exe 3764 discord.exe 4132 discord.exe 3392 discord.exe 920 discord.exe 2944 NVIDIA~1.exe 3064 discord.exe 4152 discord.exe 3176 dwm.exe -
Loads dropped DLL 5 IoCs
pid Process 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" navalny pass - 2000.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .." discord.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .." discord.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .." discord.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .." discord.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7823b8a2bb434f1aacfc9fb759e07707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7823b8a2bb434f1aacfc9fb759e07707.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini discord.exe File opened for modification C:\Windows\assembly\Desktop.ini discord.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: Locker.exe File opened (read-only) \??\g: Locker.exe File opened (read-only) \??\k: Locker.exe File opened (read-only) \??\v: Unlocker.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\n: Locker.exe File opened (read-only) \??\u: Locker.exe File opened (read-only) \??\h: Unlocker.exe File opened (read-only) \??\a: Locker.exe File opened (read-only) \??\h: Locker.exe File opened (read-only) \??\j: Locker.exe File opened (read-only) \??\o: Locker.exe File opened (read-only) \??\t: Locker.exe File opened (read-only) \??\v: Locker.exe File opened (read-only) \??\e: Unlocker.exe File opened (read-only) \??\k: Unlocker.exe File opened (read-only) \??\m: Unlocker.exe File opened (read-only) \??\r: Unlocker.exe File opened (read-only) \??\u: Unlocker.exe File opened (read-only) \??\s: Locker.exe File opened (read-only) \??\x: Locker.exe File opened (read-only) \??\y: Unlocker.exe File opened (read-only) \??\e: Locker.exe File opened (read-only) \??\i: Locker.exe File opened (read-only) \??\l: Locker.exe File opened (read-only) \??\z: Locker.exe File opened (read-only) \??\g: Unlocker.exe File opened (read-only) \??\o: Unlocker.exe File opened (read-only) \??\p: Unlocker.exe File opened (read-only) \??\p: Locker.exe File opened (read-only) \??\r: Locker.exe File opened (read-only) \??\i: Unlocker.exe File opened (read-only) \??\q: Unlocker.exe File opened (read-only) \??\t: Unlocker.exe File opened (read-only) \??\q: Locker.exe File opened (read-only) \??\w: Locker.exe File opened (read-only) \??\b: Unlocker.exe File opened (read-only) \??\n: Unlocker.exe File opened (read-only) \??\w: Unlocker.exe File opened (read-only) \??\x: Unlocker.exe File opened (read-only) \??\m: Locker.exe File opened (read-only) \??\y: Locker.exe File opened (read-only) \??\a: Unlocker.exe File opened (read-only) \??\j: Unlocker.exe File opened (read-only) \??\l: Unlocker.exe File opened (read-only) \??\s: Unlocker.exe File opened (read-only) \??\z: Unlocker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
flow ioc 96 5.tcp.eu.ngrok.io 130 5.tcp.eu.ngrok.io 46 5.tcp.eu.ngrok.io 70 5.tcp.eu.ngrok.io 73 5.tcp.eu.ngrok.io 88 5.tcp.eu.ngrok.io 110 5.tcp.eu.ngrok.io 116 5.tcp.eu.ngrok.io 16 5.tcp.eu.ngrok.io 56 5.tcp.eu.ngrok.io -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 7823b8a2bb434f1aacfc9fb759e07707.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0003000000000731-79.dat autoit_exe behavioral1/files/0x000800000001dacc-291.dat autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\eventvwr.msc mmc.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.com -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Web\\Wallpaper\\Windows\\img0.jpg" Unlocker.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wl.jpg" Locker.exe -
resource yara_rule behavioral1/files/0x0008000000023d7d-641.dat upx behavioral1/memory/3232-654-0x0000000000400000-0x0000000000AAB000-memory.dmp upx behavioral1/memory/3232-793-0x0000000002F50000-0x0000000002FD2000-memory.dmp upx behavioral1/memory/3232-976-0x0000000000400000-0x0000000000AAB000-memory.dmp upx behavioral1/memory/3232-981-0x0000000002F50000-0x0000000002FD2000-memory.dmp upx behavioral1/memory/3232-979-0x0000000000400000-0x0000000000AAB000-memory.dmp upx behavioral1/memory/3232-1105-0x0000000000400000-0x0000000000AAB000-memory.dmp upx behavioral1/memory/3232-1133-0x0000000000400000-0x0000000000AAB000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe navalny pass - 2000.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ee2ad38f3d4382 NVIDIA~1.EXE File created C:\Program Files\WindowsPowerShell\c5b4cb5e9653cc NVIDIA Container.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE svchost.com File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe navalny pass - 2000.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\08223891fa9a09 NVIDIA~1.EXE File created C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe discord.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE svchost.com File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE navalny pass - 2000.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\7823b8a2bb434f1aacfc9fb759e07707.exe NVIDIA~1.EXE File created C:\Program Files (x86)\Windows Media Player\it-IT\dllhost.exe discord.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE svchost.com File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe svchost.com File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e discord.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\5940a34987c991 discord.exe File created C:\Program Files (x86)\Windows NT\wininit.exe NVIDIA Container.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE svchost.com File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE svchost.com File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Registry.exe NVIDIA~1.EXE File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe navalny pass - 2000.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe NVIDIA~1.EXE File created C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9 discord.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE svchost.com File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe NVIDIA~1.EXE File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE svchost.com File created C:\Program Files (x86)\Internet Explorer\images\cc11b995f2a76d NVIDIA~1.EXE File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe navalny pass - 2000.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe svchost.com File created C:\Program Files (x86)\Windows Mail\winlogon.exe discord.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE navalny pass - 2000.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe navalny pass - 2000.exe -
Drops file in Windows directory 34 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini discord.exe File created C:\Windows\TAPI\RuntimeBroker.exe NVIDIA Container.exe File created C:\Windows\ShellComponents\Locker.exe NVIDIA Container.exe File opened for modification C:\Windows\svchost.com navalny pass - 2000.exe File opened for modification C:\Windows\svchost.com svchost.com File created C:\Windows\uk-UA\dllhost.exe discord.exe File created C:\Windows\TAPI\9e8d7a4ca61bd9 NVIDIA Container.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File created C:\Windows\ShellComponents\c5a040b446f600 NVIDIA Container.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\xina.exe 7823b8a2bb434f1aacfc9fb759e07707.exe File opened for modification C:\Windows\svchost.com NVIDIA Container.exe File opened for modification C:\Windows\directx.sys svchost.com File created C:\Windows\Speech_OneCore\Engines\SR\en-US-N\e1ef82546f0b02 NVIDIA~1.EXE File created C:\Windows\InputMethod\CHS\RuntimeBroker.exe NVIDIA~1.EXE File created C:\Windows\InputMethod\CHS\9e8d7a4ca61bd9 NVIDIA~1.EXE File opened for modification C:\Windows\directx.sys discord.exe File created C:\Windows\apppatch\discord.exe discord.exe File opened for modification C:\Windows\assembly discord.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File created C:\Windows\uk-UA\5940a34987c991 discord.exe File created C:\Windows\apppatch\90bab6f920d2f0 discord.exe File opened for modification C:\Windows\svchost.com discord.exe File created C:\Windows\assembly\Desktop.ini discord.exe File created C:\Windows\xina.exe 7823b8a2bb434f1aacfc9fb759e07707.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys NVIDIA Container.exe File created C:\Windows\Speech_OneCore\Engines\SR\en-US-N\SppExtComObj.exe NVIDIA~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVIDIA Container.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVIDIA Container.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language discord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language discord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Locker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVIDIA Container.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVIDIA Container.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language discord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe -
Kills process with taskkill 56 IoCs
pid Process 3564 taskkill.exe 744 taskkill.exe 3244 taskkill.exe 4760 taskkill.exe 3376 taskkill.exe 2148 taskkill.exe 3796 taskkill.exe 3960 taskkill.exe 832 taskkill.exe 2004 taskkill.exe 3624 taskkill.exe 4272 taskkill.exe 1156 taskkill.exe 164 taskkill.exe 4260 taskkill.exe 5080 taskkill.exe 2356 taskkill.exe 4652 taskkill.exe 836 taskkill.exe 2604 taskkill.exe 3736 taskkill.exe 2972 taskkill.exe 3656 taskkill.exe 4160 taskkill.exe 2292 taskkill.exe 4272 taskkill.exe 4608 taskkill.exe 3456 taskkill.exe 1984 taskkill.exe 1824 taskkill.exe 4908 taskkill.exe 4848 taskkill.exe 4000 taskkill.exe 760 taskkill.exe 2196 taskkill.exe 4496 taskkill.exe 2792 taskkill.exe 4920 taskkill.exe 5116 taskkill.exe 4936 taskkill.exe 1116 taskkill.exe 1880 taskkill.exe 2076 taskkill.exe 4084 taskkill.exe 2420 taskkill.exe 4440 taskkill.exe 4056 taskkill.exe 3648 taskkill.exe 2780 taskkill.exe 3520 taskkill.exe 3700 taskkill.exe 4480 taskkill.exe 4112 taskkill.exe 1900 taskkill.exe 3500 taskkill.exe 1268 taskkill.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop Locker.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop Unlocker.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{6BFCACDC-A6A6-4343-9CF6-83A83727367B}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1041-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40C" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Katja" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Pablo" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\AI041040" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\AI041036" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Japanese (Japan)" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Discrete;Continuous" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "411" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1031-110-WINMO-DNN" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = 49553b76dbc112bcd96e2ce32f82aa3750d88abb05779f5fac65e84c5363077e SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings NVIDIA~1.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{C6FABB24-E332-46FB-BC91-FF331B2D51F0}" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "You have selected %1 as the default voice." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Julie - French (France)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "I 0069 Y 0079 IX 0268 YX 0289 UU 026F U 0075 IH 026A YH 028F UH 028A E 0065 EU 00F8 EX 0258 OX 0275 OU 0264 O 006F AX 0259 EH 025B OE 0153 ER 025C UR 025E AH 028C AO 0254 AE 00E6 AEX 0250 A 0061 AOE 0276 AA 0251 Q 0252 EI 006503610069 AU 00610361028A OI 025403610069 AI 006103610069 IYX 006903610259 UYX 007903610259 EHX 025B03610259 UWX 007503610259 OWX 006F03610259 AOX 025403610259 EN 00650303 AN 00610303 ON 006F0303 OEN 01530303 P 0070 B 0062 M 006D BB 0299 PH 0278 BH 03B2 MF 0271 F 0066 V 0076 VA 028B TH 03B8 DH 00F0 T 0074 D 0064 N 006E RR 0072 DX 027E S 0073 Z 007A LSH 026C LH 026E RA 0279 L 006C SH 0283 ZH 0292 TR 0288 DR 0256 NR 0273 DXR 027D SR 0282 ZR 0290 R 027B LR 026D CT 0063 JD 025F NJ 0272 C 00E7 CJ 029D J 006A LJ 028E W 0077 K 006B G 0067 NG 014B X 0078 GH 0263 GA 0270 GL 029F QT 0071 QD 0262 QN 0274 QQ 0280 QH 03C7 RH 0281 HH 0127 HG 0295 GT 0294 H 0068 WJ 0265 PF 007003610066 TS 007403610073 CH 007403610283 JH 006403610292 JJ 006A0361006A DZ 00640361007A CC 007403610255 JC 006403610291 TSR 007403610282 WH 028D ESH 029C EZH 02A2 ET 02A1 SC 0255 ZC 0291 LT 027A SHX 0267 HZ 0266 PCK 0298 TCK 01C0 NCK 0021 CCK 01C2 LCK 01C1 BIM 0253 DIM 0257 QIM 029B GIM 0260 JIM 0284 S1 02C8 S2 02CC . 002E _| 007C _|| 2016 lng 02D0 hlg 02D1 xsh 02D8 _^ 203F _! 0001 _& 0002 _, 0003 _s 0004 _. 2198 _? 2197 T5 030B T4 0301 T3 0304 T2 0300 T1 030F T- 2193 T+ 2191 vls 030A vcd 032C bvd 0324 cvd 0330 asp 02B0 mrd 0339 lrd 031C adv 031F ret 0331 cen 0308 mcn 033D syl 0329 nsy 032F rho 02DE lla 033C lab 02B7 pal 02B2 vel 02E0 phr 02E4 vph 0334 rai 031D low 031E atr 0318 rtr 0319 den 032A api 033A lam 033B nas 0303 nsr 207F lar 02E1 nar 031A ejc 02BC + 0361 bva 02B1 G2 0261 rte 0320 vsl 0325 NCK3 0297 NCK2 01C3 LCK2 0296 TCK2 0287 JC2 02A5 CC2 02A8 LG 026B DZ2 02A3 TS2 02A6 JH2 02A4 CH2 02A7 SHC 0286 rhz 02B4 QOM 02A0 xst 0306 T= 2192 ERR 025D AXR 025A ZHJ 0293" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\r1040sr.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lts Lexicon" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\mscfile\shell\open discord.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - German (Germany)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{E164F996-FF93-4675-BDD8-6C47AB0B86B1}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Mark" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - German (Germany)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Sie haben %1 als Standardstimme ausgewählt." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{31350404-77AC-4471-B33A-9020A2EDA1D1}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Spanish (Spain)" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\c1033.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5233694" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE/SOFTWARE\\Microsoft\\Speech_OneCore\\AudioOutput\\TokenEnums\\MMAudioOut\\" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "en-US" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\sidubm.table" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Elsa - Italian (Italy)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Locale Handler" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "French Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\r1031sr.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; message=NativeSupported; address=NativeSupported; media=NativeSupported; telephone=NativeSupported; currency=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\L1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\L1041" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HW" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\sidubm.table" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5248260" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Cosimo - Italian (Italy)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "DebugPlugin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{81218F10-A8AA-44C4-9436-33A42C3852E9}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1031" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hedda" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "409" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{2984A9DB-5689-43AD-877D-14999A15DD46}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\VoiceActivation_es-ES.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\MSTTSLocjaJP.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings NVIDIA Container.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2148 schtasks.exe 2188 schtasks.exe 5044 schtasks.exe 1884 schtasks.exe 4256 schtasks.exe 216 schtasks.exe 3648 schtasks.exe 3060 schtasks.exe 1728 schtasks.exe 2872 schtasks.exe 832 schtasks.exe 5076 schtasks.exe 1268 schtasks.exe 3368 schtasks.exe 3672 schtasks.exe 1488 schtasks.exe 3992 schtasks.exe 4180 schtasks.exe 4056 schtasks.exe 5072 schtasks.exe 1288 schtasks.exe 3540 schtasks.exe 3308 schtasks.exe 3792 schtasks.exe 4368 schtasks.exe 3488 schtasks.exe 3788 schtasks.exe 2360 schtasks.exe 700 schtasks.exe 3648 schtasks.exe 1736 schtasks.exe 2464 schtasks.exe 2672 schtasks.exe 2880 schtasks.exe 4528 schtasks.exe 2068 schtasks.exe 3116 schtasks.exe 3288 schtasks.exe 1492 schtasks.exe 2656 schtasks.exe 2380 schtasks.exe 1400 schtasks.exe 3048 schtasks.exe 5108 schtasks.exe 1664 schtasks.exe 4720 schtasks.exe 4948 schtasks.exe 5116 schtasks.exe 4944 schtasks.exe 2632 schtasks.exe 1192 schtasks.exe 3008 schtasks.exe 4880 schtasks.exe 4444 schtasks.exe 1020 schtasks.exe 3376 schtasks.exe 4840 schtasks.exe 3416 schtasks.exe 4808 schtasks.exe 4740 schtasks.exe 2384 schtasks.exe 3488 schtasks.exe 1432 schtasks.exe 2076 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe 2932 discord.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2984 discord.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2932 discord.exe Token: 33 2932 discord.exe Token: SeIncBasePriorityPrivilege 2932 discord.exe Token: 33 2932 discord.exe Token: SeIncBasePriorityPrivilege 2932 discord.exe Token: 33 2932 discord.exe Token: SeIncBasePriorityPrivilege 2932 discord.exe Token: 33 2932 discord.exe Token: SeIncBasePriorityPrivilege 2932 discord.exe Token: 33 2932 discord.exe Token: SeIncBasePriorityPrivilege 2932 discord.exe Token: 33 2932 discord.exe Token: SeIncBasePriorityPrivilege 2932 discord.exe Token: SeSecurityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: SeSecurityPrivilege 3956 mmc.exe Token: 33 3956 mmc.exe Token: SeIncBasePriorityPrivilege 3956 mmc.exe Token: SeDebugPrivilege 2984 discord.exe Token: 33 2984 discord.exe Token: SeIncBasePriorityPrivilege 2984 discord.exe Token: 33 2984 discord.exe Token: SeIncBasePriorityPrivilege 2984 discord.exe Token: 33 2984 discord.exe Token: SeIncBasePriorityPrivilege 2984 discord.exe Token: 33 2984 discord.exe Token: SeIncBasePriorityPrivilege 2984 discord.exe Token: 33 2984 discord.exe Token: SeIncBasePriorityPrivilege 2984 discord.exe Token: 33 2984 discord.exe Token: SeIncBasePriorityPrivilege 2984 discord.exe Token: 33 2984 discord.exe Token: SeIncBasePriorityPrivilege 2984 discord.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE 3232 WINLOC~1.EXE -
Suspicious use of SendNotifyMessage 23 IoCs
pid Process 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe 2888 explorer.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2932 discord.exe 4604 mmc.exe 3956 mmc.exe 3956 mmc.exe 4304 OpenWith.exe 4304 OpenWith.exe 4304 OpenWith.exe 4304 OpenWith.exe 4304 OpenWith.exe 3928 mspaint.exe 3232 OpenWith.exe 4664 StartMenuExperienceHost.exe 1852 SearchApp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2932 2704 New Client.exe 83 PID 2704 wrote to memory of 2932 2704 New Client.exe 83 PID 2704 wrote to memory of 2932 2704 New Client.exe 83 PID 2704 wrote to memory of 2640 2704 New Client.exe 84 PID 2704 wrote to memory of 2640 2704 New Client.exe 84 PID 2704 wrote to memory of 2640 2704 New Client.exe 84 PID 2640 wrote to memory of 4296 2640 cmd.exe 86 PID 2640 wrote to memory of 4296 2640 cmd.exe 86 PID 2640 wrote to memory of 4296 2640 cmd.exe 86 PID 2932 wrote to memory of 2972 2932 discord.exe 94 PID 2932 wrote to memory of 2972 2932 discord.exe 94 PID 2932 wrote to memory of 2972 2932 discord.exe 94 PID 2932 wrote to memory of 4352 2932 discord.exe 96 PID 2932 wrote to memory of 4352 2932 discord.exe 96 PID 2932 wrote to memory of 4352 2932 discord.exe 96 PID 2932 wrote to memory of 5108 2932 discord.exe 98 PID 2932 wrote to memory of 5108 2932 discord.exe 98 PID 2932 wrote to memory of 5108 2932 discord.exe 98 PID 2932 wrote to memory of 2740 2932 discord.exe 116 PID 2932 wrote to memory of 2740 2932 discord.exe 116 PID 2932 wrote to memory of 2740 2932 discord.exe 116 PID 2740 wrote to memory of 4604 2740 eventvwr.exe 117 PID 2740 wrote to memory of 4604 2740 eventvwr.exe 117 PID 2740 wrote to memory of 4604 2740 eventvwr.exe 117 PID 4604 wrote to memory of 3956 4604 mmc.exe 118 PID 4604 wrote to memory of 3956 4604 mmc.exe 118 PID 2984 wrote to memory of 1880 2984 discord.exe 121 PID 2984 wrote to memory of 1880 2984 discord.exe 121 PID 2984 wrote to memory of 1880 2984 discord.exe 121 PID 2984 wrote to memory of 1164 2984 discord.exe 123 PID 2984 wrote to memory of 1164 2984 discord.exe 123 PID 2984 wrote to memory of 1164 2984 discord.exe 123 PID 2984 wrote to memory of 3152 2984 discord.exe 125 PID 2984 wrote to memory of 3152 2984 discord.exe 125 PID 2984 wrote to memory of 3152 2984 discord.exe 125 PID 2984 wrote to memory of 4528 2984 discord.exe 135 PID 2984 wrote to memory of 4528 2984 discord.exe 135 PID 2984 wrote to memory of 4528 2984 discord.exe 135 PID 2984 wrote to memory of 3176 2984 discord.exe 139 PID 2984 wrote to memory of 3176 2984 discord.exe 139 PID 3176 wrote to memory of 440 3176 390efcf5eb4a44d99da1269e043ebd5d.exe 140 PID 3176 wrote to memory of 440 3176 390efcf5eb4a44d99da1269e043ebd5d.exe 140 PID 3176 wrote to memory of 440 3176 390efcf5eb4a44d99da1269e043ebd5d.exe 140 PID 3176 wrote to memory of 436 3176 390efcf5eb4a44d99da1269e043ebd5d.exe 141 PID 3176 wrote to memory of 436 3176 390efcf5eb4a44d99da1269e043ebd5d.exe 141 PID 3176 wrote to memory of 436 3176 390efcf5eb4a44d99da1269e043ebd5d.exe 141 PID 440 wrote to memory of 3256 440 NVIDIA Container.exe 142 PID 440 wrote to memory of 3256 440 NVIDIA Container.exe 142 PID 440 wrote to memory of 3256 440 NVIDIA Container.exe 142 PID 3256 wrote to memory of 4396 3256 WScript.exe 143 PID 3256 wrote to memory of 4396 3256 WScript.exe 143 PID 3256 wrote to memory of 4396 3256 WScript.exe 143 PID 2488 wrote to memory of 3048 2488 NVIDIA Container.exe 179 PID 2488 wrote to memory of 3048 2488 NVIDIA Container.exe 179 PID 3048 wrote to memory of 4760 3048 cmd.exe 181 PID 3048 wrote to memory of 4760 3048 cmd.exe 181 PID 3048 wrote to memory of 2600 3048 cmd.exe 182 PID 3048 wrote to memory of 2600 3048 cmd.exe 182 PID 2984 wrote to memory of 5048 2984 discord.exe 184 PID 2984 wrote to memory of 5048 2984 discord.exe 184 PID 5048 wrote to memory of 4520 5048 4f1cf730d4ce4c29b30600eaad3df6e6.exe 185 PID 5048 wrote to memory of 4520 5048 4f1cf730d4ce4c29b30600eaad3df6e6.exe 185 PID 5048 wrote to memory of 4520 5048 4f1cf730d4ce4c29b30600eaad3df6e6.exe 185 PID 5048 wrote to memory of 4052 5048 4f1cf730d4ce4c29b30600eaad3df6e6.exe 186 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "1" 7823b8a2bb434f1aacfc9fb759e07707.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7823b8a2bb434f1aacfc9fb759e07707.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Roaming\discord.exe"C:\Users\Admin\AppData\Roaming\discord.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- Kills process with taskkill
PID:2972
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f3⤵
- System Location Discovery: System Language Discovery
PID:4352
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe3⤵
- DcRat
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5108
-
-
C:\Windows\SysWOW64\eventvwr.exe"C:\Windows\System32\eventvwr.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\eventvwr.msc" "C:\Windows\system32\eventvwr.msc"5⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3956
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵PID:4296
-
-
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:1880
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:1164
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:3152
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn MicrosoftEdgeUpdateTaskMachine /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4528
-
-
C:\Users\Admin\AppData\Local\Temp\390efcf5eb4a44d99da1269e043ebd5d.exe"C:\Users\Admin\AppData\Local\Temp\390efcf5eb4a44d99da1269e043ebd5d.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "5⤵PID:4396
-
C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"6⤵
- DcRat
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\foiIXd0asT.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:4760
-
-
C:\Recovery\WindowsRE\unsecapp.exe"C:\Recovery\WindowsRE\unsecapp.exe"8⤵
- Executes dropped EXE
PID:2600
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Locker.exe"C:\Users\Admin\AppData\Local\Temp\Locker.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:436
-
-
-
C:\Users\Admin\AppData\Local\Temp\4f1cf730d4ce4c29b30600eaad3df6e6.exe"C:\Users\Admin\AppData\Local\Temp\4f1cf730d4ce4c29b30600eaad3df6e6.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4520 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"4⤵
- Checks computer location settings
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "5⤵PID:3664
-
C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"6⤵
- Executes dropped EXE
PID:3196
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\Unlocker.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:4052
-
-
-
C:\Users\Admin\AppData\Local\Temp\7823b8a2bb434f1aacfc9fb759e07707.exe"C:\Users\Admin\AppData\Local\Temp\7823b8a2bb434f1aacfc9fb759e07707.exe"2⤵
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System policy modification
PID:3268 -
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im explorer.exe3⤵
- Kills process with taskkill
PID:2076
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\explorer.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:396 -
C:\Windows\explorer.exeC:\Windows\explorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2888
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\taskkill.exe" /f /im explorer.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3224 -
C:\Windows\SysWOW64\taskkill.exeC:\Windows\System32\taskkill.exe /f /im explorer.exe4⤵
- Kills process with taskkill
PID:2148
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\taskkill.exe" /f /im explorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3540 -
C:\Windows\SysWOW64\taskkill.exeC:\Windows\System32\taskkill.exe /f /im explorer.exe4⤵
- Kills process with taskkill
PID:4272
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\46fad423a4bc46e4ae4667d7213ed61e.exe"C:\Users\Admin\AppData\Local\Temp\46fad423a4bc46e4ae4667d7213ed61e.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"4⤵
- Checks computer location settings
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "5⤵PID:2136
-
C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\NVIDIA~1.EXE"7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\NVIDIA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\NVIDIA~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:3792 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xWWlAsg7Jh.bat"9⤵PID:4004
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:4864
-
-
C:\Users\Public\discord.exe"C:\Users\Public\discord.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\discord.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\discord.exeC:\Users\Admin\AppData\Local\Temp\3582-490\discord.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1784 -
C:\NVIDIA\DisplayDriver\535.21\winlogon.exe"C:\NVIDIA\DisplayDriver\535.21\winlogon.exe"13⤵
- Executes dropped EXE
PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\navalny pass - 2000.exe"C:\Users\Admin\AppData\Local\Temp\navalny pass - 2000.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\navalny pass - 2000.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\navalny pass - 2000.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\WINLOC~1.EXE"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\WINLOC~1.EXEC:\Users\Admin\AppData\Local\Temp\WINLOC~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3232 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "TASKKILL /F /IM "explorer.exe""7⤵PID:1212
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM "explorer.exe"8⤵
- Kills process with taskkill
PID:832
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3244
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:4944
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:1856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:3796
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3744
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:1276
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:2004
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:2536
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
PID:1692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4496
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:2768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:1076
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:1824
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:4468
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:1432
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:3804
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:4116
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:3648
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:4384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- System Location Discovery: System Language Discovery
PID:1412
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4608
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:5044
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2780
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:924
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:1220
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4760
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:1020
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- System Location Discovery: System Language Discovery
PID:1716
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4908
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3776
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
PID:3612
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3520
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3088
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:2972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:164
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:4008
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4260
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:5008
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:2380
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3700
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3972
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:2996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:1636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:1900
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:1896
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
PID:5024
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4112
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:4324
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:4364
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:3376
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:5012
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
PID:4032
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:3500
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:2884
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:3716
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4848
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:2912
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
PID:4168
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4272
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:428
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:1400
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4000
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:4844
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:216
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4480
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:2624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:836
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:4972
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:3960
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:2280
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:3224
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:2420
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:2108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4180
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4084
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:4912
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:4088
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:2792
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:3424
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
PID:4228
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4936
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:1892
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:4052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:760
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3608
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- System Location Discovery: System Language Discovery
PID:4820
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:5080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:5096
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- System Location Discovery: System Language Discovery
PID:1228
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:2356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:4040
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:3872
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:3656
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:5084
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:3488
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3456
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3560
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:4276
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1984
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:4916
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:3048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:1108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:3892
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4652
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3380
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
PID:3636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2604
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:2640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:1728
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:3564
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:2532
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:3464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4440
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:2500
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:716
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:1268
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:2344
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:3540
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4056
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3936
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:2872
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:744
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:3312
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:1528
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4160
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:2160
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
PID:2584
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:4920
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:5016
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:1156
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:1632
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:4444
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3736
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:3812
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵PID:920
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:2196
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:1792
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:2880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe2⤵
- Kills process with taskkill
PID:2292
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵
- System Location Discovery: System Language Discovery
PID:4380
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe2⤵
- DcRat
- System Location Discovery: System Language Discovery
PID:2804
-
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
PID:3652
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
PID:3968
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4304
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
PID:3952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
PID:4540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:2536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\services.exe'" /f1⤵
- Process spawned unexpected child process
PID:1196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /f1⤵
- Process spawned unexpected child process
PID:2768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:4496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:4008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "LockerL" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\Locker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Locker" /sc ONLOGON /tr "'C:\Windows\ShellComponents\Locker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "LockerL" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\Locker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
PID:1700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2464
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Fixed.TestEnable.jpg" /ForceBootstrapPaint3D1⤵
- Suspicious use of SetWindowsHookEx
PID:3928
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵PID:4396
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3232
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
PID:1380
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b0 0x48c1⤵PID:1804
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4664
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "NVIDIA~1N" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "NVIDIA~1" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "NVIDIA~1N" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
PID:4608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:3916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Registry.exe'" /f1⤵
- Process spawned unexpected child process
PID:3988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:2756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f1⤵
- Process spawned unexpected child process
PID:1952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe'" /f1⤵
- Process spawned unexpected child process
PID:1908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "7823b8a2bb434f1aacfc9fb759e077077" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\7823b8a2bb434f1aacfc9fb759e07707.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "7823b8a2bb434f1aacfc9fb759e07707" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\7823b8a2bb434f1aacfc9fb759e07707.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "7823b8a2bb434f1aacfc9fb759e077077" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\7823b8a2bb434f1aacfc9fb759e07707.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:3724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\InputMethod\CHS\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
PID:2824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\InputMethod\CHS\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:3064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\NVIDIA\DisplayDriver\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
PID:4284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:2952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\NVIDIA\DisplayDriver\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
PID:2880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discordd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\discord.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discord" /sc ONLOGON /tr "'C:\Users\Public\discord.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:3396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discordd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\discord.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:5108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
PID:1288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Java\audiodg.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\audiodg.exe'" /rl HIGHEST /f1⤵PID:4196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Java\audiodg.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:3008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\images\winlogon.exe'" /f1⤵PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\winlogon.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:5044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\images\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:2632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /f1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Videos\RuntimeBroker.exe'" /f1⤵PID:1488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\RuntimeBroker.exe'" /rl HIGHEST /f1⤵PID:956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\My Videos\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f1⤵PID:4332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f1⤵PID:1520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:5116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\NVIDIA\DisplayDriver\535.21\WmiPrvSE.exe'" /f1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\NVIDIA\DisplayDriver\535.21\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /f1⤵
- DcRat
PID:2768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:4908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /rl HIGHEST /f1⤵PID:4972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discordd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\discord.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:5072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discord" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\discord.exe'" /rl HIGHEST /f1⤵PID:4284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discordd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\discord.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:2952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\dllhost.exe'" /f1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:5076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\dllhost.exe'" /rl HIGHEST /f1⤵PID:4144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\dllhost.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\dllhost.exe'" /rl HIGHEST /f1⤵PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:1664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵PID:1412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /f1⤵
- DcRat
PID:3824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:2416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /rl HIGHEST /f1⤵PID:4032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /f1⤵PID:752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /rl HIGHEST /f1⤵PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /f1⤵PID:2460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\dllhost.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\uk-UA\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:3308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:4864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Recent\audiodg.exe'" /f1⤵PID:4004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Admin\Recent\audiodg.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:4468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Recent\audiodg.exe'" /rl HIGHEST /f1⤵PID:864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f1⤵PID:4192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f1⤵PID:3920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
PID:3324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jdk-1.8\bin\sihost.exe'" /f1⤵PID:4168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\bin\sihost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk-1.8\bin\sihost.exe'" /rl HIGHEST /f1⤵PID:2640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discordd" /sc MINUTE /mo 8 /tr "'C:\Windows\apppatch\discord.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discord" /sc ONLOGON /tr "'C:\Windows\apppatch\discord.exe'" /rl HIGHEST /f1⤵PID:956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "discordd" /sc MINUTE /mo 5 /tr "'C:\Windows\apppatch\discord.exe'" /rl HIGHEST /f1⤵PID:1888
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
PID:3764
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4132
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4352
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
PID:3392
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
PID:920
-
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe"C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\NVIDIA~1.exe"1⤵
- Executes dropped EXE
PID:2944
-
C:\Windows\apppatch\discord.exeC:\Windows\apppatch\discord.exe1⤵
- Executes dropped EXE
PID:3064
-
C:\Users\Admin\AppData\Roaming\discord.exeC:\Users\Admin\AppData\Roaming\discord.exe1⤵
- Executes dropped EXE
PID:4152
-
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe"C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dwm.exe"1⤵
- Executes dropped EXE
PID:3176
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
7Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD54a591f46c87b49a7de93f5ac771cd4ab
SHA1e0992350818e5c56d3f2e3a6db340d1f5b8f3314
SHA256b495e22042b08f27b690da18986ec74d5054a65d05d5cf41fdecd5751482ccbd
SHA512b498445d1e427853690250aebff35cbd7e28e85a89ad868e3483930b16ec13198357cfcd5feb45567b1bc8f3d9f97c5ecf2d242c8a5e9d758a536d0498ba7955
-
Filesize
225B
MD5d7df2670ad0c6c7b9cc48122f20f086c
SHA1e69bf8c214d8c4b768125ca03e402e1c871cc233
SHA256d3bf5c54de984dd2d1d779494deb8a995cc062eb5f25c465d0de78d99b8cc52b
SHA51205ed88410790bf74dc7ab880f893e555c4859c133e79a89f28b5e1a68c36f4a4f28d3b7b6532953c04b6d23a21faf53e60107efde9e6acb492a9235d48943f03
-
Filesize
859B
MD5462d5af26752129045a92b98c8943aaf
SHA1cf3b840d8e2ff5ad11ceb70cd425a44209830ef1
SHA25690b4268f4208387999c7ecf4ff8822daf2ffadb2db4121936a56b563286cf003
SHA51275dc848c29f36d8cf14e7fff804b0b0c5beb8a0f202f235875847992ef1703e7cf5cf4b50aef859b4c38139836f249cf4f7657812341dd258771544c057eb09b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
Filesize36KB
MD50e2a09c8b94747fa78ec836b5711c0c0
SHA192495421ad887f27f53784c470884802797025ad
SHA2560c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36
SHA51261530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
Filesize36KB
MD5ab0262f72142aab53d5402e6d0cb5d24
SHA1eaf95bb31ae1d4c0010f50e789bdc8b8e3116116
SHA25620a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb
SHA512bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1
-
Filesize
5.1MB
MD586a1cbee2b7dc5d64051c83c82c8d02b
SHA155d82d17f7f10d088909d0cb7116969d12308974
SHA256d3f47cd85c525a0c3ed855949bf27023c27b24c51d388166d72d4fa8cae4c2f5
SHA5126720ecb2799185bf2a03259766e3dd38aeaec674a3a28e657bd55131b1e9fb18fab118afc3aa7881de56d7af36d60bf8b29449065ba32c5cf0dea38fb892ecbb
-
Filesize
1.6MB
MD51849f89a807de47190139035f6148366
SHA10e23f3cfc246483f5dd17815fea3d5011f6611c7
SHA256131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac
SHA51249398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154
-
Filesize
6.1MB
MD5558ff65486960f523a1eb17ed0f87bf8
SHA1bc6acc37eb0472a0bb23967f62cc4469ca1deb13
SHA256b08298bb968f9ef0bb09aa6cee9b608b9a4882b72301de0aa82fc45dd8d6a10c
SHA51219f066bd6adf650d7dbfb6412f7506139520eaeb8989852dd9f074622f13fc2c50a826eb35df38197ebd5cfaf34c1a1087e7cd9d8b60f50b10191c631f3121fc
-
Filesize
1.5MB
MD5515a119cd9c0701313070074760d673d
SHA169858f0d27e2f5c78ce17c01e7155a799356b14f
SHA2564e542b6eaf04bff7e61da39772c0dd6bb3090d8a8b2d791dd96fc604326a05cd
SHA5127b91f85d71f68c585a0c5714eee3822abf6861575862dee5afb75af9fa4b2265bade80f737107a14eecf4e0f00a13ef88f77b30fad47941d0c17c16f1e25f1ec
-
Filesize
19.7MB
MD580c506da3df5e4580c06c48162bccbea
SHA143fbccf50f91cd8e1190869b0edc96d920519c14
SHA2565699b2e12f78b7eeca0633c6a5a93effe7187565eccd7668acccf93c61ab7acb
SHA512f4a424bf758bb48da944701397ac1e82bb72a15ea4e8818535f2e52199d37e9caf4361303fee4bd9d6db528e1c0171d1612aebc5f636ca9c4ee4fd795432b8c5
-
Filesize
793KB
MD5a83185ef7c03bfe0e0fbe10098876a34
SHA1b166fed95e9bcc9f8b0ac4deafa9c45c21e91d0d
SHA2567a923db27ae488a02e77242b1bbceb9a64898b9c2d085372a5ef5fca06b2a4be
SHA512283e698b326d044480c49351531249ab9ed3a851c1d2c4a36c87fc5ecbaf2771af58f39cc0fc1551d08a4674ad766a3d4b96b6ee6ca1e6e967727f320f599f4c
-
Filesize
1.8MB
MD5531bf67134a7c1fb4096113ca58cc648
SHA199e0fc1fb7a07c0685e426b327921d3e6c34498c
SHA25667942630366d114efa35f3f4a79741a4a4eb2c3b0c8ffaac07af527f84d4489a
SHA5128facae8335a4f33f54e48c64814946eb8b480800b4453612fffcef64117946a35d493f433d4e27186ee864603da756319f816e70c3bfc08b8bb1861fc7030ff4
-
Filesize
653KB
MD5c29e84272de123ac2cae92bf8210d95b
SHA11b60b8f5430707ca08d806e5739553cd6cfccf89
SHA25642c145d05f5a3d20a4df748d488e32f986ef0bbd370dd086b6f431e00a5efb14
SHA512055aebf709f23647783f034913fd61721649ceddcc1357b4bd34ecd446b059f27c57a16392943000d7f2152cdec51043d11910fae1dd002f043f300d9724ee6e
-
Filesize
138KB
MD57c30424c525cb64760083e066ca1f77d
SHA169c369028e3db4fe5c2fbc69cbd837d66496c480
SHA256b75685e5fe51601632066ae2cb162738b340c9873f3b30cd4eb0b6f80cc27643
SHA51259d726222ffc846ada2e7c6d040e0f0114e2cb92e72f81f23489aa6681b07a1c8cfceb7e81f9b7d7678d33b313302d9cf39c345d862e43f2768e145df14ef8df
-
Filesize
199B
MD554d898632f1bc3922a1e0392ddd1aecc
SHA1979eea29862e91aaa385f1b8160095a6b6068857
SHA2568d115dac563ed393d6978f7be75edd51f41d9254a7f943a09f0f3f7a37fb7e5e
SHA512c9a96b1bb1e6c29d0b1aaeebffcabcc6638214d28fa880485b4d22379c72d6fabf8c1d71d25ee8d94a49695faf43d5ea7150d78bf2b5907c803932d0d5c99650
-
Filesize
5.2MB
MD5d5f38176aa233dc3a85f2c3e7c6cf1f7
SHA1022ea6d320067d2429b26cc424145610fa0ad28e
SHA256db307d31bbb3d282685bf28e0abf464a931fa749633d784e39adbe7d8d8ead31
SHA512f58f855e3a102b6ccb4197b38323149342c23c2182b6309074d5720c2b2f20d764c33b10013834e85f73e22c0b7ab95ec4171ff251523b598821ad632af5a893
-
Filesize
422KB
MD5705a10144ffd51597b863af7b6dc6761
SHA168e3ff4a0c5c498e958431cc4379f33042900194
SHA256cbc8a31345ac302681cac85e5347de1ffcbaa12bdc50c679ecf99cda7fc5157e
SHA51200685116a9471c2f95534932eedf29e70c0486cdb16235770ff3ab8655396ead19378c29f57f298ac2d17e202ed8e75b4ecab282a1be4cb40dd27774568107a3
-
Filesize
3.1MB
MD59f93492e155d1bf27b8077e991e6a5a0
SHA1159d72ad8074b56562b1014393be24b402c3af39
SHA25643eef3b68ebaab3efbe15eb3046281e380aa78003a0eda8757a9e44f6a59ec7f
SHA512270bc608ac79ca92c8db6a1455a26f24d80844badc514d5db29acade5748513d8378e3d6d803e9cfb7bdab6482a992b7c6a60845b255f3be5cbf92a0a69db918
-
Filesize
178B
MD53b35148d7661e41a89ded2a167b81bd2
SHA13341e6e2522b5f2c39aefe0f752550acbd143ad7
SHA2568375823df91f6dc9d9fc09a83303bdea778eef761f577bbedeccf00eeda7129c
SHA5128cc6e258f8c531230bc6ef4ac778c8f10cf971ba992f63b2847bd3c93c76c884428cee8d337274ef58a782c89a82817cd288e897bed2557da330397b00be8683
-
Filesize
167KB
MD5774fff2810fc115bab05707f73047457
SHA16dbf565150aa9a791e0f9f345243984ec6f5fa5a
SHA25611478265d9ce8d9c390a3c28960972d1c4fa3e1a532183d7ea7e3cdd039f688d
SHA512dc5a9dd495b912f386b668c95622addce7ebb7fa23a93ffec144c2766695c94a4c00534e567d3a153009987e3fe2683d9715d058a677a20ce498dfcc2276c96a
-
Filesize
490KB
MD5eb820859528f342fb44535b580de6fc4
SHA12b7c432bf92b4f250c06089d37e672d6cb4d704c
SHA2563d35d99ceb5e515ead5cfc0916d8f3ad3ad4110b221681637adb8a22fb7a2e8d
SHA5122e3404b4c4e5c2befc303e6b96346f2fd3927c525134edada81d8a67b0a0128c9e0c3715f0f9ea5e1af3c4cce9bff6789e306f94d920cc4fe36f029b3263982c
-
Filesize
236KB
MD5e24abffe68c617d871c31ead151042cc
SHA194cd0bb85e074ffd69ffdf53921adeff0323ac7e
SHA25630ee9d45a914d5c09f3c0484aef9e0f4c2397a52599a89774b824f4c09492495
SHA512d6952f1bac4ea07518238ac3d6880837b69454b086d9d63c74271b69f91b7cea17961b9a6cc4ac3f18f1ac1a35b83b254cd4ce71632151fc7c68b6f723b8ea91
-
Filesize
290KB
MD584358cfc4a757d8a0d3a0b6138864b05
SHA14bd6b7202dd3a32642364b42661084e8f7f7233a
SHA25673fe763ae5a7fd3f244eb691a464ad9c130b1fceb5d950a77375a893d42f97ff
SHA5126ef697747a058fdd489ef427aa17abe4860be89fd373dd1ecdd1e7b91da1c40d1ab120bf7c77881d113cebc0ce3e01d74ec53b545e818e34cd75540a64d29d1f
-
Filesize
527KB
MD596556ffaf8197b8e1df219a9857132d9
SHA1800dc8467057d38e5612624b6077894147efe6e0
SHA256eb6cadd6b41ea2e38a9382e6015b8b84117b401e23eaca31627830bd0a688679
SHA512622da73bcd9bf8dd6918791c77cb73fd0769424d421bb75696fb28126780d74d6614488804f6a551ad46d5ce01ef545d18b29cb073f776584a1a83a1325229c0
-
Filesize
309KB
MD593e3783001f4b2919389388b15e9d31a
SHA1b5d07c155d107b3001d7340e44e865a4c915cf61
SHA256a5aa84a14d06c8eec843a6f2dcbd23d82affc88252f8963fc16c4900d90255af
SHA512ddd326eadcb120650c602f9b7fc3b058c8b96ddd643406bcd09c3dad9d544ea366773d8b34a0bfb5097bcc0c8124765f3edb89d01e005f0fe55d3a4c6e253cd2
-
Filesize
563KB
MD5bfea8c2dba7507ce048f47dee7d33258
SHA13866ccd6e7f9a9cadd6eea5ee535b12c5b3fe9f2
SHA2566dd78f0fe4310b3092418b82ec480bcffd34dd02034050981829e856d2d090cf
SHA5121311c2e5566e071e4f3527728e4014c41d5abe4849f91256a3cb84553804cc363ee89997cc923aa3c46d268773aa3872ddd8c2f97aca404c941bc502544984db
-
Filesize
545KB
MD5642244b215ced9f20f9109d8cec32335
SHA1e02e50ad91a82d7c0ccb1c92e76a670f87e936d8
SHA256213b9a7b2299a09681cac1052d825ee7d018c63b5b5204912af128f3ec1f2c4c
SHA512507b4ae885b670ac4f8ca0f5efdbbbf068cadb24512adb99e769e8256d466df3241938f00a2bb1644a04c204eb3368b4fe5d537d1155de4255ef42d8a812ea64
-
Filesize
672KB
MD55177a9c18e8b4bf897764f30dfe59f63
SHA1bd85d0965e13af87aac9b1d840424fb1a94f5f80
SHA2568753de899760e74b8c8701040cfc66b5790e2cc884c6c256ccb7c6f1be804ff7
SHA512e41dc549192940447c8bd16e913d4d0fc7147e07ebb299177fad79e6b3f798bc258ae5324d9da61ea11b5ebb6658f4644b238102c6e6b48aac92079e0d2284b4
-
Filesize
399KB
MD5821d4db9753953e2254653dcc29cad2d
SHA195023558e13347c308dafe49bed5c5881bfb017d
SHA256ae928f0d2489addf7ef6b9b69b0b11a3349a5a2fea5bffb63c57b8251b6e8ba0
SHA512e7d8bbf6a1d440d42beb1bd4db6927eeb5f1dee79d106f8b971c3f5bf9f77a95192ab7f7eea11a7c820d65cc5fbbc4ff1b7b71a963b236bd3f81a90ad20b3231
-
Filesize
2KB
MD5b2fa2fa8f8159d1985b032d3722f83a4
SHA1867efc83cc36b48e82e40fa05058b3269a959bd5
SHA256565ad902d14a0d17f1bceed29bd31f313f808e4130a8539cd7906f5f495d5099
SHA512c702798ef3dda113f58d0600642305d19fdf0defda7db292839d6dc02035ea4000041464dc120fe2d7d767e528c59253f6901e75fd722f957eacfad94c252d52
-
Filesize
345KB
MD5b1adebef02c72f8ee210f547a2c3a679
SHA1de6437ddae8aaa378a2df41370b7aed2c1470e5b
SHA25643689a0d7457e4a079914e0efd1ed975ea16d41bb31e0f4df9f37cf4bff3e1a0
SHA5120c20d8acace165d76501e6e661d8a5c78246ad7e3bf8eeec2491da413bad78097f3371d0d0573dd7cfd4bf74baa301186d2c9c6dd6b74968cb762816858b6728
-
Filesize
363KB
MD5ca1ab5295e245741cb1e0d0943d5e689
SHA1e52cf66a9f5563f38aee77216ca2f7878a1c33b6
SHA2569ec753be8e35b0d267e7485de5df04a0d07152aa28c6ead3b4e535946f58a3c5
SHA512521bb5c29b2e193138074e2aa9fe5abeee0f098b55290b9458cc504e9e86703d0ede2ca2b99eda82e9d72dd94e75ccc1d01c4ed4930a4932e8c47ff6d0ac3a20
-
Filesize
381KB
MD5013ef9458fcb66d73a3b90a0c0a63959
SHA1666fd31486a92eb04fef1e52f954a02e00f49039
SHA2568e4c379f647a072ff59509c80428132e5afeaeee75e0bfb8b7cc9e5b04b86d95
SHA51239163cc8f7daa5965ab339a15e3f827b1b22151f9d728f6453166381d15fa03b44527799edbb86f8720df13dac224f3bb3d82bd3a3c176a674bb01520f694a1c
-
Filesize
581KB
MD58abc7426b798b8d7a973d9e2282e2954
SHA1504ed68af33036d3add35c3dbceb0064ddd409f6
SHA25627a27a23125ce909d5b824b2e4f407288c96b57c54e3a7495d07cc1c382b41ef
SHA512e0fe5955c6bd3d2291e83f14d44b267943056cc1648accec54219065317de83f14212b69a1383ed49d6b1bd54be34399931063a60defee1813ae778c9981b7a4
-
Filesize
327KB
MD529eeed166e76cf846b3e5fb690b39edc
SHA10265dbe64561943f2da1a19c48cef54a75020c6e
SHA256fba0b0097271ebe8f909307e34fdf84ead988e5c49cfb214e3838166f069b528
SHA512a0a766fa34d38fcc7a14ed381ee0cfe44ddb1b8618ddd041eef75fad4088861af074bbeed0d9b6c78cf10ac209f3fcb0dfe63df80c127b29eeea8d21b3ceed83
-
Filesize
618KB
MD58dd29aee29501684633123b6eafec637
SHA149e8243e7ba4ea43f7ee6bcd98174db4d873add4
SHA256396a208198aff93c4e3230c8e4db43b9d157e6419785348924d1d4a1beedcc70
SHA512115da0e7aa617c1da94c415de99e47ab84f194bbc7d7def6668e4b41ffe6589187a0e88ba487c03d9fd7ed38364c931f1e64383a7db59f11cb5ffef730abcbb2
-
Filesize
926KB
MD544eba426ad10b0c64a2db6c6bfe56ec4
SHA1fcd716ccfc4f3d9e8b21d95b62c3e355a3684e17
SHA256523b736e2d80b6ffb632ebc13ec65dcdfbe05422fbb4861de1b3513e4020310c
SHA512269d3dd73dccc7d4bf51e7fca0e38bca362ce5c7eec548fb5be51ab949ff3696beb64cc23b15c40144068b36b94a74d16948f003480a47f2622f516fbd149d41
-
Filesize
599KB
MD55cd6afe1ba0cedb4c6494fa5cb1c68e7
SHA13881c88a3fbc57101803728e8cc649ffdac85baa
SHA256a04c68095c33c9ca42ba9f070739700a7edb6d1e3c77393e74a086144b118a54
SHA512acd0c4787638b73b0c427700bd67f6615d635f2096dd80e25dc6217d4a681cc425c1eb47aaf83dd4202aa4544b65a5a710df162788f84b0a2413453101be399b
-
Filesize
454KB
MD5fec1a77f76b7b90c698d94d16673cede
SHA19cbfa2b5c6a1d78886ddc53ff93439fdf79d65bc
SHA2564073e3ab4154831822913d4ec6be28106332074a4103885c67c9b5adf3d1028e
SHA5124298fa87a46d72a36af5e460b5b92e1baa177e34ba2fb0c4951f7290aa917937fd129f423b50b44d9ae05ff13ec0c87869f20785a1e399c693f305904cea00c2
-
Filesize
254KB
MD54cfb73ff2bcd694b2dde13da5f08ae69
SHA127cfba64d048ede84709aefb1b3d92a46e164fe6
SHA2568cb00caa772dbb1621b8cf397b4d68c8a76ba79bef01bfdbc26afcd85fffc910
SHA512b81d36b5785696f15f5148c4a7733d8ae5c708d4703f4c60d9afca1f1403bdf0cbcb673c96f0434da9269ac657c3b129d1e00f410462d59bb1fcea73c2083f1f
-
Filesize
636KB
MD534322572f372b9c49f9ec06b479118d5
SHA135e846584ffc1cb407cf00de2681c99e13bd447d
SHA2565a74fe605481a33ac6aa316cfae48cb95cf8f27295d891347d0323fec141e144
SHA5125eb4b7609619bc19bfd3a6b1b6b4c6ba1f932b1e4b613bcdf474ead0aa88e5296bee32b62934e79abfbb8f42953ba15630efd10fd8ac664ac3506e361b863a8b
-
Filesize
472KB
MD531034c18c23b3d4d37c72b8c5acd98eb
SHA1f59f9b330de75b30f9a039bb6ff8b6b00917d90a
SHA256c8bb1cb3f82570188275b4edd1f602cd871fbdf2d89d75bcc0de5f38bb56ce9c
SHA5127de8c2b8ea88ac8a7b17ee60d708df7e8c7d3892f257d3f6170edba65cc82ab3160ee32a36b1ff04d6f8080059af29b944494fcffb96935eac53a502eae97457
-
Filesize
654KB
MD552f85132f520239ee3f7b86bec905818
SHA12d87c2ad9c8243d4baeef34f56e9a2fc0c55ecb6
SHA256acdb8151e85b089d7ac787619d62f82d11009db549f56202678d06116ec62980
SHA5129350164001b2937504936c5fd3ed50fcac90f85146c0ca8cdc849d73ce2c36b3b33cd442bb5eb98b5597cb10ab18d6ff5b9cfad5e235d01c7ad45a4e01d8c28f
-
Filesize
418KB
MD5a25db8b3a91fee57557ae4af701e8713
SHA13ab99f7db3d2cb8a18d107f4c07d0425215d17af
SHA256d75f1c3a99015edc9311a8e883db186faf95fdd7d66bfdf0a10d38dbc0192b18
SHA512dc011575ae2741ec50cbfc2944bad3a65572f52e24d415e92c2e985dfd90fc2b07ba389adbb7e1003a01f0447387a51fe326285831e0dc61ab799c78dda2cd36
-
Filesize
508KB
MD5daa2aefe10eb852b3f113dc04b1d5fde
SHA1691124f477a246c05e24471cd0bf6437d3989e57
SHA2564fb32fcf24989d0522f9f816a374acdce9c0723ee05b57ef334afff9ae2bd762
SHA512ed12b2c4c035a2713a8fb39645cebec08fa4d86c4fa87153510986969bf374915ab4735b77ed48995d54ec4b86ca29d4c0a68922d7b4cb831425f6c917e85262
-
Filesize
288B
MD5ba41cfaa9aff58c3b40c7ac73b4d1cd4
SHA1691f19d9330522a47b16c832c6d6b51a3a2efc72
SHA25630fb6cb48d4689a02731dedf82483a58738ba4131e4be90b2a44bd1ab9fd6a0a
SHA512708ebe3314fd85d51ab0e73d83a7e61cb00d6c0ce5e78530f7ed6c9e6bcd827ca5b3ca4cd34842bc2d7337fdd73c4c1f39407f5e8c94ba6a5fa8e9130533350e
-
Filesize
258KB
MD56142ce02177b2944dcc7508597f4d096
SHA1807e2dfcd98bc38766efd6d0190b6dc774fd02e0
SHA256ed8fdef115f9af87ea59834e3613d68212946ea599c847b88c947c8f457bf1ee
SHA51243f45f6a9cd103a70fa2e4cd0984cfb8abac88b38184ab97a648ebd3c5295e014acf5b9d5e22c833bce7dcadcee4bc109f3b22a3c08436c99529168a10e3973e
-
Filesize
384KB
MD58b64d0861192074855a0b59f84563e93
SHA1a003e5c05ae1f851df7c760ccce5e8bb1ee20c1f
SHA2560401aac1651fa5dc83c1ac1d728ea50eebb8c2dba63a23856de046e1c78b7d96
SHA5121f3bafc219ebbf2f327d063cfe0eb85109ce365373db146838c6f5d5e2c4b6ff773742e7fd7e34e826a03096a7ea416999e51eabe591b96c743f144109533fdb
-
Filesize
143KB
MD57397686ad5d8e2360e2bb87f9cffda9d
SHA1dba311c4c4302d31e44801a7e9b35696dbda2d9e
SHA256ef78f171d5ff7d0abc0d07c9fa6571fe6dbaf4a5090306f974541ea06680ac81
SHA512e4e10ad6143f975cd444c1611c00e11cabee4dc1859b3810ef7d2c56097ed633d4f1b92fd54c1f8ee3a459e6abd0654e215fdae492541bf51b1f32a8810dedcf
-
Filesize
235KB
MD55ed7a4da514171c7fc0186154a2c7997
SHA1e8e4e85e7e34110b6503b30767839a644164b992
SHA25699f0a7142a551f4ed6a135463b67d923c5e685fc4b0ead5d6f6c8c1003f1882e
SHA512060ecc7a976c6e08cc786b6e273f41a6b73c90c773f0ec187494cfa4548f8cbc900340dafc499a102a5724285cb805387fc2837be676f2204f1251d0f7efff89
-
Filesize
292KB
MD5e0b3fd3f6dbe28b09cfe2ddb549dd5b7
SHA11bafdc4337fa538aaba3c1588fe3c67dfb3df50d
SHA25668eac1560b732a354740e70adcc4db8d77d7ecfa8163b812c9b3facb1d8bd988
SHA512eddeea9e4128d517f89568aece3ee57f47f216318070f1c9d57f4c91819dc9409da5416895a78a20b38ca211100f11e7c3cd8294876b0791d873038b92a2b08d
-
Filesize
200KB
MD5753583e2ae32e4587362b2a148221a4d
SHA152f56e64f870eab0a1964d67d56a3abaf82f9f3b
SHA256157324f1027cdb564ffbf4d7c9add2502916c66e42c404b9dc30db53d48845d1
SHA5120d8eded0e98c5f1d03d846ba544819dad657eb65b1ae25adaa540ce3d1eec54ab275e6c459365991d6f10ec766728036878d9b02ac6d8c3bb8ea335e5d2b4b38
-
Filesize
166KB
MD52e691274750373bdd3b9b013edcf9962
SHA199c13f6167804c1cdc4b0c7ce86a8dca982fb588
SHA2563e48bb43859dc851e10818742d3a2b2ef8c8ef64bd514825f6097c4e6d2ae1e7
SHA512511d0a61cbd1c5e957e34e1a375db9db15c11bcd94408b1686b23b8fa072681781e946d28720f9a891b6fa356020e20e373cccff496d871c13b91c93d4b3fdb8
-
Filesize
246KB
MD5e0390a36602bc45f27e35a86744e54ef
SHA1f88c8bfefecaadc6c14cf6b8381ac4bf73ec483d
SHA256bcbd91892261217180ab345eb6d29b875c53eabcbc44aa1e931e6b9752a70c93
SHA5124a5d2e44bd93d859561775a57dc5e7566337382b180be1e52bdea292b2331dd3eb1a64e5f8960e269a429f56c7788d8f814749affb5a613b2960c9feb711ef56
-
Filesize
315KB
MD53452d35cb6bb158261b4864885bd49a2
SHA1c69d6afbc58661fd949f666060848d692e13ea87
SHA25653e2c5d107f791de66acca97e70cb1b843c3b6d79143b3a8dc7574b4bf78633e
SHA512a2943b2deb7c618f287396e62b37b8442c79052092e9283e16dba3dbe60c09add1a8246ea7cb4760853ce716dc2116fb6a194812be5963753545c896aa0d9896
-
Filesize
512B
MD53e5d2582a5d0c915afef6c8cafa343d1
SHA17062928a2ec000838f78dce8c48693a1859471e1
SHA25634ae08d15c34e017facda7c39f7b5f9e8cc891b160072b908969a1a2523772aa
SHA5122cb2f561be74448d361099883ea4fdb9a1ea17a82970459fff7e35802617726561b52955b147d5fb23d3a3bb3d88539af645886c2d0e46716fba5c641a2b90b7
-
Filesize
48B
MD59768a0013346f1e95b3bb7a843498ba2
SHA1920868c2f9455cb4dbfd229da81868734017cf60
SHA256469d6d9507c277089454df59c1c686a8fc511a9f17b4b9c6f9ca9c5070c2d1dd
SHA51241a9f3f6f63ebb32256e59d8562fb21e80dc1e53b5c988ed0dcef66dbf556f799559085b7f54426b0a29209ac1cc5e2dcabc2754d89d1b7c4e32257b8a5ae825
-
Filesize
60KB
MD584b81f71beda7afeded4085a84808465
SHA17199bd12cc0ef1f77fcaaba8b3ea5645ab388dce
SHA2560884ecdc6f9a9ce52f67f6fdeaf02d579b2d7a1c7cf14d20d77c2906e41196a9
SHA512698bdbc47b061ad37982195a16930caeaccda52f95f9c0d4ed33653590023eda6a2c3f110ea2112aaa67c99ed588d9117797aedd9298b36b37e78dcc5c74a5ae
-
Filesize
27KB
MD57c96d6b14ab956a856d47e87c4be4553
SHA1a4626ab555204ae9221547b539fe9fe8b21cf500
SHA2563e6482553b51c3bf6d419f8333647f59762240861c79f166d1995fc59eb189b4
SHA512aef86dfb77cce4064a634f3b1accdebb3c066e6d9fc966538df80b2c0d948a017b1af1bd34d93d525f907bb983504544d541ae1a1f074caabaea55d71b4f3f3c
-
Filesize
32KB
MD5c30df0f1ba8d92eccb020946a107c7fe
SHA1fe95d0b0246a4ecc25fc89ee7102647e12c1dcb5
SHA2563d6d12cadb2ef6fe5b2a03d15964512bc32895e338c2da25ae2cb07bcb31deae
SHA512624aebee4d918c8eed1716d17829a36104eb5aeb2d23be021e61f9d8e59a6aeb7215c14365ac081fa2f820e561aa108be25640d1634983dff7ca8ebd4dbd6a45
-
Filesize
42KB
MD543042269818924374a29891d79cb676b
SHA1f34ef8a688e15efa9c0117816a617892a2730bb8
SHA25677aa5f8536b9c30133f8083712b2d5434123d31a6ed41f0680fce52e06144187
SHA51209cefcf48c1ebd4d5593d6d4f6973ff39330d23cf606da54bf79eeecd355842c675bd530b4e43d19b3dcc3fa6f4539d5d161ca423347197d6b319c17abab0e31
-
Filesize
80KB
MD56d362a3e515cc18d537f74fca1f75293
SHA199a5b363ac274e027530fa7a532a007b0e6c56f3
SHA256c87dc1a91720070afe96d3be716d6203540da4d08e9d2339967a8a2a6a521d42
SHA512896ac439ff7ff58b33413fd978bee25afffd9f4b2a8183ad63db861b92c7118bad0b845ccd85390c8b8a76ba57f6a6fb7d0ad3970bdb0a28fb9f2ed718979821
-
Filesize
149KB
MD5f6d67bd69fe398b2c5238fa4c9d6455a
SHA1a8c7dfb2cd54dd46f2eb1e2fe6a19bdf40c47e44
SHA2563ad823c535650fcba2de953fb2ce6fc46afeb04e529494e6b60b788cb28ddc32
SHA51263e0e262338850ffe35929af320d17eb850efa046f860ca4fdb93518dbeeb2fe9ab3d4d13305c6d1f5c9fe78b42615ac0794d160b66fad5e3a30309dfed117e8
-
Filesize
109KB
MD535ed09899d21d2f9806e5c4eb1411324
SHA15afa7972868a84f4e49d65f149aa09dda07870d2
SHA25666775b29fdbd36e7ea15b038224a12271fe84b0e1129b11dec008af1dec986b3
SHA512625d060ab49f371a9416315f85f6c01874cc19bfd5a4fb9b0a84287f1af0411695623e4176e62afa6623b16339b4c603f6a2179fe00ef505fdcd97e2b36cf820
-
Filesize
37KB
MD51c782f17124b6eea9619acc46fc165a4
SHA1aa22fe4a52723cf2ec83af3b478531c83ac1c589
SHA2569f1c04f4d37d995f9f6cdb7751be399468c275f91c35f30bdb45ff9ff31190eb
SHA5122b63129054cffd9037963f9e42c46c489e697f81109f8465c9cf3915894f143ffa444e9fb1bef195111ea915f36b51f08246b5ddc7ae5763d056bd0c8b0a7921
-
Filesize
91KB
MD58883262af502c220932bbc50979391ca
SHA10be9ff95e86e798493f5f067a6dd3ddec9ed6832
SHA256f500586d27d938ebfc965c59cdc42e361b78bc41246d52a075bc278271c96fc6
SHA512ca78bd4cbf199ac1ec91058e48f357b3dae908a5bc06eba132ad9e143d5791d11e04462a96bf836999dd412ff0d9f37d06243c8b944f84ec354a3fb223b1d076
-
Filesize
38KB
MD5e87a6a5fe2591cb8c7a88c0bd4cc8d3c
SHA175c4ca221b2f4782709f16230059bf8413de13b9
SHA256840bbecc0e95ca503740df9ac0ac944303c4a4c5f163a3eb4d4aea329629371c
SHA5122fce9c3827b0d16828175f8ac86029f615614ad0f147c95842113824d8177e2919cd0e09d67b9723396d259dea99e3b465b7a83972a8f1d344925cd8c14f0605
-
Filesize
81KB
MD5caf2b6d49aae9303b222fdd06b91f10a
SHA112b967bd3aafa465c228551a7cb2d70f8b9f972e
SHA2562b670bfb2029e8f023f13180780c648f606bb91fd5854e45e08c27bad2f4e1b8
SHA5120eb51b3e222c4843fb3d79bddfd04faf41135845f1d20a320be84f076289be9890624cb34b73bf4093b2ddbb8d48ff409deeec5aaf3b10216204a24da4c2f92d
-
Filesize
77KB
MD522aa4efefa11404c5656516f4f257a59
SHA12b7476f4fc38d51303dc78dcdef4577ea59efa09
SHA25688f4e80980753871fe322f8dda83e72900cca29961efdf25bd119b259a57d05e
SHA512167d77f6f5aeb19fc98b6dc969f8ea91906aa23f5771b3f764884a685acbea5fa545486e72daf79decfa86265e6718a0d5e95c6f9c01bbc14a5c6b7c0ad2380f
-
Filesize
91KB
MD5f89f675153effeea979e32716d1dcac8
SHA184780277f79505ccf920d13391726741e127a79d
SHA25699232a1b8d11825ccdc89ad8a9e095c6a1c36731836c17207ec5f45cfc0270f7
SHA5128c447c5a226a127cb671eac033bc7db370a5dd47aeed7e46fcbd112684bcbff300827292c8bd87aee6f21bff887c4c04b7620b3bc22a3b6bd3b6843678083fff
-
Filesize
51KB
MD54f0ad7516cd72bc8e78452edbfb7675b
SHA1fdaf974becd0d3d66eb580df0e4beaf048ef22b4
SHA256654700adddf4f3b7f18f08d3d7ba2df035a026fd38b86f700b950d4ce4cc0cfe
SHA512d973a212cb46199bfbb938edd724e187f52d273eb92f0f32390f6b8c269886d55a2009545a3b46d456eb8a42f1c76e4956bfde803898d053e2164aa58a92f584
-
Filesize
35KB
MD52483ba5ed0b989e311c585760c624055
SHA1e4a793b783beb97a94d04c2e2795f02aced64d14
SHA256651ab26c519b7a0ac97e0adc3c452efbc9233f695f5ae0bb70d42d5b3e37cac5
SHA512a37554d540383958614fbd898dd7435476480b4c7aa83b9191f626567c1835f338ec35c4799fa544d9cc0bc2aa7b2139ec929f26bffb4fc0424c10c09b8a72b1
-
Filesize
56KB
MD556afb11ebd7367af4c03b065ef3580f3
SHA14f30fbf3d5c0469533c1b33b98aa612e6704c14b
SHA256da6e60fa7d074a5b8a90e3ebe53ed1c01661423ec0ec1ff154857bcef14ecff7
SHA512eef0e1be7dfde83f546d36f41a6339ce17d5c7153da3f3d003838c333884458697b2d156abf9c119f4786d4d53f08563b79d17c0c3e316dabfa519db145e32c4
-
Filesize
53KB
MD52d714bed0f2a11e2daba10305c667e93
SHA120af1afd4f3283cd142904a285b6471b119f8079
SHA256a65f7847e0c4ec164b204cb5abb90a4b58cacc4c957f0749b52c7130094b860d
SHA512da26fb5aba9377c746993daf6ffbe3df60db4ce0992058b7d70a1a26398f9014a7c111775e1acfe26526500a90daaacf805dda3b8a7cce87c36b60f641fd0119
-
Filesize
52KB
MD521a8888b16b257c094fd38d09612fc48
SHA19ce7e89da63c663987c9624a845144a4fecc3e72
SHA256e1e71925f5169df514d0c196f41fe91ae1419426ed28422aea78ab85b4dafbc4
SHA512cc554f7180b8f79de7ee6278b19fe8a4331ab9caa5cd980caf66eeed973a3577b56dfb57e4c0797d7987ce55ff8ab305a9a51b27568ae0fb9414498d3c494af2
-
Filesize
66KB
MD5a0bd05bdf6641d55fff217fc45b6e7a4
SHA19c4f824bda8ec17d0c23fbe50cd8f6c55d5784e3
SHA256c34b87c2f0454d80f7b1989e80eb5b6ca04052c16f94ce294f15a0053cc76ce2
SHA512bdecd28c096925852936f0aa96a406596a3d60bbff51ac1e12d9241f4c7552630bf12aeb73cfed8cf8afc916cad90d4e6d23e5eafea6e14f73b73ced4992bad3
-
Filesize
16KB
MD512b162b0c010fcc23fa43b03cbb76509
SHA1a696c6b6d5c0216b3eddf8dd4eb2a269abe19d00
SHA2566be68911f16ec9283da61ce222d946c9e8e5ea39d71ad9d23216b4961947d180
SHA512f983d2a19c18574cd09c1be30f44a6c8b586bfc74341367f6dfab26a6c7440f73e7ba252e66d1ed5fa6af5a78dd3f69de3909a369fe08ad78ca1e539eaa036c4
-
Filesize
38KB
MD58853da13437c21bd8c8b131dacd73d4f
SHA1844f143af3aab36ce1cee355eb7e7c5a4ba67f4a
SHA2567616c3dc3ef9a7a6d08a54a5e955b33f001647f0821c29b92b022c044226e480
SHA51231a3989fddbffbb8e6979bf3e855eb13ba97146cc1cee4ab6f939cf002e0a2e698a12383f0f2a8d3d6aab437da9bac7e641189565a7ced1d2c5ae1a8f149cf30
-
Filesize
68KB
MD58e1462f2d993e1bd6fd00268623abece
SHA167367e20f64d32ab8d1840dedd91d686ac989952
SHA256ac084f24272a89b616e21add98739a7c4dc55830e6c7ac8fff74a9d495eef4c5
SHA5129184a8a87c2b5ec222df4d51a940977b2ec784c634ca66e5d11a46d35ef1a38162b6e1090e1df364eaef3fc1313a39a989a803c2ace603e90fb4473ec9105ace
-
Filesize
20KB
MD5afc635b14cc1d36ce347aa3ad423bcde
SHA1306b78de47455914a0550229035516b951e638c5
SHA25680d9439a20f9f0b09bfb6b7b71a84bd9875c2363141b323522ab0473df90c0b5
SHA512ce4b43b1b876b741d312a045fede59c4b1287f084a4fd0a1929aa8e6da3820450f25ae9436d48885e30908201e6a82cd3ad7e8e9d92b16aa68aa1e0b37366d40
-
Filesize
59KB
MD56e3e6e1a0f01c0168c7b1fcb4e63a89d
SHA1785688b7caa8f28583e417a651517b721405d835
SHA256b856abc28d3d026fbe327376bbd72f7a169012bc987d59dc9fe600e9714ff634
SHA512d2038420bb997ff0d97561ff8b167822de36fa1f924962abed0f29b3c8b2ef7bf9a9f52311738d498b894cfd7d488ee0a1741150e45782e555028483bb1ecc99
-
Filesize
113KB
MD5fa516d1d0fce7db4dfa81e73cf74e917
SHA1ecbb4b0ab88b6c7574279693bda9a7cfd0a2d9c0
SHA256335b92e10ea035e1061ab8d44d02472d2db80a838eae63900b9d02ab9483c4af
SHA512f9adda2c53121fbe6a0c42582f2af6d19dc8225f9422a2163210153bd5bc458cd4fadb1d97085fadc658b45557ddc3650ca96d68764241a153c70b68569dec8f
-
Filesize
34KB
MD5a55dee0b6901e6cc5dee3ee6db227b41
SHA1914b3ff1faa2a3009b13044ba08f08a71f2f3f20
SHA2566fd47a0e90adba6e9560ba5fbbc162b346b528aba268300f560d5a144924bd9f
SHA512ecbd6e493df019e3045a420e0aa6235fdee1d1e97e455370e29ee7563e7c25f9d75afa9b7c1c9d8e2693e90e1271811dbe88072ba8ec4e93cf23d08cdba0f4b5
-
Filesize
89KB
MD557a21de76111fd67dd32bbf5b8cbbe8f
SHA1127d6c20da0234ac8bc9dd65391fcfd695185274
SHA2568a5f22591d81c5ce727cab12fa380c3331fd9a3118a69667bd21b8ed9d6bb96f
SHA5124177b17475c7dff84fa577077d844e27af7d8dafba7f6beacc1b45174d4df2ae88f242529dfbd5f6e5b80bbc5ceb949ba0fcd2c3c7065dcf32226b0e9da85629
-
Filesize
34KB
MD5312462041a762b3ca42e106dd23c77ef
SHA1199e0d9650f70bc9d4aceb95da7d7200668dddde
SHA256df0e53d5be9ecf641313960c107ab41bce93c8cf4849d006077e33a424cb15c5
SHA5124d57c6b4659ededbecb127a9676f6cc64644cc270e33ceabe469e84c2a1b38981134aafb8f1d1e53cd0d6cc1f22f08fa3bd7e8568e8f1d907efd4bd07b51f790
-
Filesize
34KB
MD5a6a4e4e3398f437cd4d431d85e9d54a8
SHA14afca6d917412205203b9498fd1fde26a926b7af
SHA25603f9584495fef61a2f54a0f0cc469f26f25f35394be48b5d954d449ca37bc784
SHA5122ef129c544c12373b8eb06160450ec4c925d2b3075d1f7925859c4a0f184911dda59b6687944b7fc086276b3966e1111535e4e859b3f3715078e1e68dfe6ac2b
-
Filesize
33KB
MD5813e47eaed5990689d0d53815c68d29f
SHA1a20cf1de1b653e7267c5dd134db2207fb1150e3d
SHA256710b492db43e192fdf281d9d5ae58a06500b506694ce4685c64d413188c4b245
SHA5129aa5898a1e6942e41d7cf2ccb9dfb96a0b12c4d148d24a9ec8b9f5bf608bdc0312fdfd97c779a73ea81dcb9ce7df06941efd2a0841b2afc6b439528ec0f84fa5
-
Filesize
33KB
MD5fafd6d2d4a64f53220994bd4bbb9de94
SHA105d90ef5327c3ec114d0a36cb29927ca4796e5b7
SHA256a8cac8b5521a9ff85faa0999ed21af3669c57a9cf51eb14760c001305c44c195
SHA51264cc77861e5a3679cf2f323ecd673805aa6df266e720d4e889ca283017201d25f194767b7c36aaeeb4a4eebe062d2597fc3e13f1b7e6054b4707ee74178df232
-
Filesize
33KB
MD5398df692cd2ec1bb7920ea5449d965a1
SHA1d4fb9dc4e31cb5ec3ca4e2dd2223a0d4bc4256ec
SHA25676fe950ef1408b93f1a13a7197cd3221d8eb6f6660ccf9aaec3bf94f8b9ef703
SHA5122156c194183d961a06daeca442fe8da4808f2065e8936f4fee10f487784721c0976a69e39a466f1bc1a0c31e082025774a391bbad2138cab638bce4153ca7201
-
Filesize
33KB
MD5b28cdde3e6551f820fbf4d1ae4da6677
SHA18e1fbc56e308b24dca374eb5debc9e9bdd5f6135
SHA256dc1a15e29698e60ac326185e619eb875e869ea3d01746ac0701d11a2716f6b85
SHA51221bab2e588190151a380d0663f0d8f307c95805af7197bb2adf6019bf28eb3cf57d9e7f621395a7f23ca847811e5a9fd316bc45fa3208c71832966c4127b8cc6
-
Filesize
33KB
MD566bd198bf0cfca918c45067bdbc354ea
SHA104d7bda4cd83a7d1e950a8da7f409eea72033578
SHA25606f24e06f12ce66cb87a29d7eac67befb737ee1400f11071d4ca83ecb5c78dfc
SHA512d2d775f19e5cd72671c739d03b6bed554dcc517f93bb83cba7bbe54fc3408cb8d177bb237620894f0cb45117bd902b6e39a7ce3f630f21c8c45b08d2280306c7
-
Filesize
33KB
MD59225599ab65c613124185b2529989cd5
SHA194cf9fdd8808ddc34d8c552a5fd52dd3bd6b4043
SHA256e64658b6ee5ee61b29cbf79812b1f6cc45367eeb2cbe9da9fa5f1e63979644e8
SHA512b535e4bf42d1bfe8d0280a694e8663fdfda224b030a80f0ccf0568009e1476cc062c3e88f9e3a3c31b62e5156504570fc17f1466acc234e83cf1f3628ac999b1
-
Filesize
33KB
MD53807d3a5a2f9fb626c97e048e3b64b1e
SHA11b14e6ef507551e72370b03a876e9534b0da3883
SHA2565d99c8bc9f302d87e86addeebe013c34ca4305f3c9752fd92e979ac6d97aca34
SHA512fd5ee94044f25dd20495dc3bae17ba89257211be6ca36df224813d7a71afe8270df7e8a74d11655dc6ab1397b5ceab3e56bfeac149a09d3015f10d4b50755164
-
Filesize
33KB
MD5f6ecf41acb43f283021fa952e762b9e4
SHA1cdd89bee571630d93ceb186ec5dbef3fc28d0019
SHA2569962141bc3e2a1936bffa25de1e8ad85aa630d4a9770f90e9900534784683be2
SHA512af637de1c505023a03e2fce65847fbb596a3c7dc6789f636dfc78b185b583e801274fc00f63c12e531a6eefb505a0c2bb29222a133a4f0d08a1eafa3be17acde
-
Filesize
33KB
MD5ea930fd90cdcf6d31a2ec4c1559b41f9
SHA1498db95c46ed784d6c6b83b6ad30184ceb7f80f0
SHA256aba2367393eab39caa359b90c62ac0231e7af228070c50496a984be89bba4f3e
SHA512726bf8c578a9019ac025c2fc021cdf7c111597d182720d62c48be9ea4fb3c8f4da777ff2305695a27d0db61c3af9da48e99ada694eab71df9fec459c50a00656
-
Filesize
33KB
MD50e027d0c11f6adfa7aaf640ef5cbb83c
SHA1b9d69ff6f1ea832de0c713fd2011a1d588cc1d6f
SHA25693bd144b21f021708564d17a127b241b6236ec7922cc772a78bbdfa9b0fd8ee4
SHA51277c242c76e6f3aaea9df664ccfa280af6c4931adad908a069073d35cbbf521f5650a0135239f6f831049a5d13ebab595169f27eb9f847a952f8a47a18e092d7c
-
Filesize
33KB
MD50c12f084e52be0801c90d48ebaaa9c4b
SHA18954a0a34e1344e0ef0a8920c9935dedd1eb4dec
SHA256b1b86e511ff375352a46b9b6fc8f3a7a20c55b7516dd1dd9d5af38adb7f527e9
SHA51201b8f27eb18a77a7be9a1b910b93c16afcfda1e0c371463619dc6562bfc469af34d152282bde6fd4c14fc191c6b7cf1877d8607e257489498ba1c96f68c52e2c
-
Filesize
33KB
MD5adb1b10c27228fd7a59a50a5839ee6bb
SHA1579e67dca36773986fcebdd955f86cb6d47a7164
SHA2564e876b157be27295d52d754db4367a05e2bd10550006355fef27542de0603c1d
SHA512a2efeda33021d205b11cfce73b9897e82571f42596438020786dc58abcb0e42287ac3730f5f57fe92249f5b8fc8cf74f391fab5ba25004ee84b3741be4849499
-
Filesize
32KB
MD5cf293a4f73d67d90b43d6fe2fc707e0d
SHA1c779c8794392ac1d907170999a15d8a7440e85c0
SHA256d2767668d76008045bb9ac633f6ae30daba499cdd4c803030b3f4119169220f6
SHA512cd2dbe59f40101d36bcf9b2da70ed8f03e66e5c57386be68bc929e1fd05ef2b806afae135ec703e960bc159400cb402d409e7745f7b348ff47fb24861267dea2
-
Filesize
32KB
MD5d129b378192f4f70d831fb7034d7992f
SHA1c782ed401d9a33644568dd3d4c78b49ec3d9a4a0
SHA2563d41e7d8040bc0c91f371f88dbbd7eee29e7c8408d2de331636096f81cc57b4d
SHA512b31d3191ad62011d53f77e789333f3669b515172aa30f914ca116af0b8b6949a031b002aa391637fdd7ab9a63a5b0dd5ce37dd691766f3d896ff570dcf23b2a7
-
Filesize
32KB
MD537cf805ea6e33432e8bcd4e028938faf
SHA1c0ea05823441d9115a2f079346efff5ad2967930
SHA256c638d0fedabee0972e593ef24aacb2bc86ddcb6a3357d0ddc2228e76d73051bf
SHA512091bd6d4e0f5707df74a461657b513cf7c61b94e780b80f8f93fb000b0e29b7f59c08a35964d4dbee005e7bd9d3c9be5a69a2486996e3a9f09a3d3784d424a4f
-
Filesize
32KB
MD55e3393e772f5aad126c10b86b8b59c62
SHA1ac70b3a5ce29c2d432263a11a4f157fa53222c23
SHA256049e8a377ff04c64b0e804d14a96f1469bfdf60c6b38d807d8b1af5b293221ef
SHA5123903acb567fdfd0abff26dcbd4c7c9ebfe569569b1af78283beedd7c2343baa3e3fe19a2e851e43b7313017624435ce814dc839f79c67d3c7ee528b3c71666a7
-
Filesize
32KB
MD5ef185b61dfa8298a39bd12bc5b5ad56e
SHA13401678e4ebf8a78c664994e864a18cde058c20f
SHA256ff3838388c2ed572a4d2ce6b8b6d77490bc56bab33ccf8c586bac27d2df83b68
SHA512e7fa3e4f302801e617442764a28b7f7a24a394319903a411f40d6da31d03b7530a8160193010ef868c90f9259d44085d113b73fc09a0e72c5a1f9f990d87e7bf
-
Filesize
33KB
MD5fc5f065a5e8ede646d1595c50f9253f8
SHA15c9a10baa223eca0ca3005b760b21f9dfe656e94
SHA25690a1510f938da7440b9b0d2f82428885684761898d4f76575b1c2fbdfc245d92
SHA51249a96c244bacdf8b5dde05f3b57c18d2f83a53f3f82bf32f6c8026d890e047f6b11d0d7d9357e8d6f509acbaa5fa37d5aab72c26e58f46c99885f272a747f544
-
Filesize
33KB
MD5cb099d15874bc078218294749eb7b6bd
SHA127647365028ef3fe8df37d9341595501c5748b9b
SHA2562efb6ed0f26f8a561014536a1eb846cd4467d830998f6bf2c89f5dbd4a87f1f3
SHA512c350bd8959004da8cf76a4d79a25629c4e38ad57e22230a29c339685c076cfc0044cc241dc206016183549ac66da685a3d673938f0af6c69f40c0bb6ee5fbc2e
-
Filesize
33KB
MD5337dc66064bf405d08a2c9c2f8b80ee1
SHA134e79eaf97bc9274222df62331ed464b06c26deb
SHA2560bcb24229a3ca5ab524b3241e79d71d0b190994b77d4c420985e8f89b9557774
SHA51261616a7d4e29c9a47b8f0f6c3a21e68b51ee2a185a2e0e6d3f7933a932305a246091c9ae757aa4d49601f2631e3cb5c62618a1e2a2932b957b9b279d019db337
-
Filesize
34KB
MD5c7e83c267bc0e3238163b11a968d59d0
SHA1180d269f95d88ab98c4abfaf5024119ab22f5424
SHA256939f8ad378a8372438fdea72adb3f56cf4ecf3ab3d517efdbf5588c3a34be3dd
SHA512054593312a083ae7f86b6aaa18ec206193b08368a8166f09815056ed339d1370ed0f03500fd39ad45bcba7a4a450b819415e695ff0a8cbca6db2a5999f9bb741
-
Filesize
75KB
MD50f111a8457f17592240624b2e80a6c61
SHA123b009e988c3a95d9e8ac97e9baf2979dda3211d
SHA2568d49d92735d094885cbb57a63988e6205b5a477f2a571aff2f1e8d295f3d8e2f
SHA5124e14e5e9c834723a23d3982fa2c5223eb0ac09403bc5cde638733c2a96dc28f820f76b6614e444b5a2aef3fb9f53c6e8f1fffd265ae7bb0af0c372aa7f548bfe