1347beb5a4dc0986d497024cce174137c51d74b7bcaca7a038ac39389b8a0f84

Analysis

max time kernel
651s
max time network
648s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Client.exe
Size

167KB
MD5

ea8325729b4d3ad91721963c248f4f14
SHA1

7762ab41a36fb2fbebfa571a24cab2615fe0f8ff
SHA256

1347beb5a4dc0986d497024cce174137c51d74b7bcaca7a038ac39389b8a0f84
SHA512

bad7f93110a6788a193f7d1e888901853f25796fa5d1386e1275770949b50b2a1f54667c4baf00df04ca939424dd17abe37a4260d518df242313b4967e0f0da7
SSDEEP

3072:vCmG/oN36tcQviFC1xCBn6fWl9zWaF9b6YvMhUJ8T2SXZyrgoBJtbN/3MCK2kev0:v+xw9z1vMN/JdSI5eb

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	New Client.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe	discord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe	discord.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.url	discord.exe

Executes dropped EXE 1 IoCs

pid	Process
2092	discord.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\discord.exe\" .."	discord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\discord.exe\" .."	discord.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 52 IoCs

Web Service

T1102

flow	ioc
69	pastebin.com
72	pastebin.com
84	pastebin.com
85	pastebin.com
88	pastebin.com
92	pastebin.com
106	pastebin.com
23	pastebin.com
67	pastebin.com
71	pastebin.com
73	pastebin.com
78	pastebin.com
107	pastebin.com
108	pastebin.com
24	pastebin.com
60	pastebin.com
61	pastebin.com
64	pastebin.com
66	pastebin.com
83	pastebin.com
90	pastebin.com
95	pastebin.com
97	pastebin.com
105	pastebin.com
63	pastebin.com
81	pastebin.com
86	pastebin.com
93	pastebin.com
98	pastebin.com
103	pastebin.com
104	pastebin.com
70	pastebin.com
74	pastebin.com
76	pastebin.com
77	pastebin.com
79	pastebin.com
89	pastebin.com
57	pastebin.com
80	pastebin.com
91	pastebin.com
96	pastebin.com
68	pastebin.com
75	pastebin.com
82	pastebin.com
99	pastebin.com
58	pastebin.com
62	pastebin.com
87	pastebin.com
94	pastebin.com
100	pastebin.com
101	pastebin.com
102	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
2348	taskkill.exe
1052	taskkill.exe
776	taskkill.exe
400	taskkill.exe
644	taskkill.exe
744	taskkill.exe
4620	taskkill.exe
4036	taskkill.exe
3156	taskkill.exe
2780	taskkill.exe
3924	taskkill.exe
2136	taskkill.exe
4724	taskkill.exe
3140	taskkill.exe
3936	taskkill.exe
440	taskkill.exe
4676	taskkill.exe
2840	taskkill.exe
216	taskkill.exe
3180	taskkill.exe
1224	taskkill.exe
1804	taskkill.exe
3144	taskkill.exe
3444	taskkill.exe
5024	taskkill.exe
3084	taskkill.exe
3108	taskkill.exe
3116	taskkill.exe
1648	taskkill.exe
3232	taskkill.exe
1752	taskkill.exe
4280	taskkill.exe
1060	taskkill.exe
2428	taskkill.exe
3212	taskkill.exe
1320	taskkill.exe
2724	taskkill.exe
4336	taskkill.exe
1616	taskkill.exe
3184	taskkill.exe
4532	taskkill.exe
3124	taskkill.exe
2040	taskkill.exe
4972	taskkill.exe
2420	taskkill.exe
3188	taskkill.exe
4284	taskkill.exe
3128	taskkill.exe
1504	taskkill.exe
4420	taskkill.exe
4984	taskkill.exe
3716	taskkill.exe
428	taskkill.exe
2152	taskkill.exe
4416	taskkill.exe
4388	taskkill.exe
1876	taskkill.exe
3960	taskkill.exe
1072	taskkill.exe
3792	taskkill.exe
2828	taskkill.exe
1244	taskkill.exe
224	taskkill.exe
3720	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe
2092	discord.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe
Token: SeIncBasePriorityPrivilege	2092	discord.exe
Token: 33	2092	discord.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2092	1620	New Client.exe	83
PID 1620 wrote to memory of 2092	1620	New Client.exe	83
PID 1620 wrote to memory of 2092	1620	New Client.exe	83
PID 1620 wrote to memory of 3604	1620	New Client.exe	84
PID 1620 wrote to memory of 3604	1620	New Client.exe	84
PID 1620 wrote to memory of 3604	1620	New Client.exe	84
PID 3604 wrote to memory of 948	3604	cmd.exe	86
PID 3604 wrote to memory of 948	3604	cmd.exe	86
PID 3604 wrote to memory of 948	3604	cmd.exe	86
PID 2092 wrote to memory of 1840	2092	discord.exe	92
PID 2092 wrote to memory of 1840	2092	discord.exe	92
PID 2092 wrote to memory of 1840	2092	discord.exe	92
PID 2092 wrote to memory of 1672	2092	discord.exe	96
PID 2092 wrote to memory of 1672	2092	discord.exe	96
PID 2092 wrote to memory of 1672	2092	discord.exe	96
PID 2092 wrote to memory of 4336	2092	discord.exe	99
PID 2092 wrote to memory of 4336	2092	discord.exe	99
PID 2092 wrote to memory of 4336	2092	discord.exe	99
PID 2092 wrote to memory of 4108	2092	discord.exe	101
PID 2092 wrote to memory of 4108	2092	discord.exe	101
PID 2092 wrote to memory of 4108	2092	discord.exe	101
PID 2092 wrote to memory of 2624	2092	discord.exe	103
PID 2092 wrote to memory of 2624	2092	discord.exe	103
PID 2092 wrote to memory of 2624	2092	discord.exe	103
PID 2092 wrote to memory of 4996	2092	discord.exe	105
PID 2092 wrote to memory of 4996	2092	discord.exe	105
PID 2092 wrote to memory of 4996	2092	discord.exe	105
PID 2092 wrote to memory of 1244	2092	discord.exe	107
PID 2092 wrote to memory of 1244	2092	discord.exe	107
PID 2092 wrote to memory of 1244	2092	discord.exe	107
PID 2092 wrote to memory of 1060	2092	discord.exe	110
PID 2092 wrote to memory of 1060	2092	discord.exe	110
PID 2092 wrote to memory of 1060	2092	discord.exe	110
PID 2092 wrote to memory of 3676	2092	discord.exe	112
PID 2092 wrote to memory of 3676	2092	discord.exe	112
PID 2092 wrote to memory of 3676	2092	discord.exe	112
PID 2092 wrote to memory of 964	2092	discord.exe	115
PID 2092 wrote to memory of 964	2092	discord.exe	115
PID 2092 wrote to memory of 964	2092	discord.exe	115
PID 2092 wrote to memory of 5108	2092	discord.exe	117
PID 2092 wrote to memory of 5108	2092	discord.exe	117
PID 2092 wrote to memory of 5108	2092	discord.exe	117
PID 2092 wrote to memory of 4164	2092	discord.exe	119
PID 2092 wrote to memory of 4164	2092	discord.exe	119
PID 2092 wrote to memory of 4164	2092	discord.exe	119
PID 2092 wrote to memory of 4048	2092	discord.exe	121
PID 2092 wrote to memory of 4048	2092	discord.exe	121
PID 2092 wrote to memory of 4048	2092	discord.exe	121
PID 2092 wrote to memory of 4480	2092	discord.exe	123
PID 2092 wrote to memory of 4480	2092	discord.exe	123
PID 2092 wrote to memory of 4480	2092	discord.exe	123
PID 2092 wrote to memory of 428	2092	discord.exe	125
PID 2092 wrote to memory of 428	2092	discord.exe	125
PID 2092 wrote to memory of 428	2092	discord.exe	125
PID 2092 wrote to memory of 3444	2092	discord.exe	127
PID 2092 wrote to memory of 3444	2092	discord.exe	127
PID 2092 wrote to memory of 3444	2092	discord.exe	127
PID 2092 wrote to memory of 3108	2092	discord.exe	129
PID 2092 wrote to memory of 3108	2092	discord.exe	129
PID 2092 wrote to memory of 3108	2092	discord.exe	129
PID 2092 wrote to memory of 440	2092	discord.exe	131
PID 2092 wrote to memory of 440	2092	discord.exe	131
PID 2092 wrote to memory of 440	2092	discord.exe	131
PID 2092 wrote to memory of 1016	2092	discord.exe	133

C:\Users\Admin\AppData\Local\Temp\New Client.exe
"C:\Users\Admin\AppData\Local\Temp\New Client.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\discord.exe
  "C:\Users\Admin\AppData\Local\Temp\discord.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:60
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:948

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\discord.exe

Filesize
167KB

MD5
ea8325729b4d3ad91721963c248f4f14

SHA1
7762ab41a36fb2fbebfa571a24cab2615fe0f8ff

SHA256
1347beb5a4dc0986d497024cce174137c51d74b7bcaca7a038ac39389b8a0f84

SHA512
bad7f93110a6788a193f7d1e888901853f25796fa5d1386e1275770949b50b2a1f54667c4baf00df04ca939424dd17abe37a4260d518df242313b4967e0f0da7

Download Submit
memory/1620-0-0x0000000074A52000-0x0000000074A53000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/1620-2-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/1620-13-0x0000000074A52000-0x0000000074A53000-memory.dmp

Filesize
4KB

Download
memory/1620-15-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/1620-16-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/2092-11-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/2092-12-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/2092-20-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/2092-22-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download