hawkeye | dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4

Analysis

max time kernel
187s
max time network
231s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe
Size

257KB
MD5

a911bfbc1a3e58c90af3068277d897bd
SHA1

230a72563a253e262a64d7bbc2ef9f64c317f35b
SHA256

dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4
SHA512

0783d092917a81eb31cff7438b358d1bb066d68e0247c0c2f828e14e1cdedf199f8500da01d36b29a9e00a3dd7fb5680d7728d0766a0a7ba72c7880845a35049
SSDEEP

6144:qha6zCh4avYHQA2R2rdhifyMSGL0Cv9CV+b3rT:qMhHmQAKMi0Y0CVm+bbT

Score

10^/10

hawkeye evasion keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Serial.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Serial.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Executes dropped EXE 3 IoCs

Processes:

explorer.exewab32.exeDirectDB.exe

pid process

1904 explorer.exe
1468 wab32.exe
1920 DirectDB.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1716-65-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1716-67-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1716-68-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1716-71-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1716-79-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1716-81-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1716-80-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

1904 explorer.exe
Loads dropped DLL 3 IoCs

Processes:

dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exeexplorer.exewab32.exe

pid process

1976 dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe
1904 explorer.exe
1468 wab32.exe

pid	process
1976	dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe
1904	explorer.exe
1468	wab32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wab32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\wab32.exe"	wab32.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

explorer.exeDirectDB.exe

description	pid	process	target process
PID 1904 set thread context of 1716	1904	explorer.exe	AppLaunch.exe
PID 1920 set thread context of 1928	1920	DirectDB.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

1704 reg.exe
1148 reg.exe
1072 reg.exe
588 reg.exe

pid	process
1704	reg.exe
1148	reg.exe
1072	reg.exe
588	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exewab32.exeDirectDB.exe

pid	process
1904	explorer.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1468	wab32.exe
1904	explorer.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe
1904	explorer.exe
1468	wab32.exe
1920	DirectDB.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exeexplorer.exewab32.exeAppLaunch.exeDirectDB.exe

description	pid	process
Token: SeDebugPrivilege	1976	dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe
Token: SeDebugPrivilege	1904	explorer.exe
Token: SeDebugPrivilege	1468	wab32.exe
Token: 1	1716	AppLaunch.exe
Token: SeCreateTokenPrivilege	1716	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	1716	AppLaunch.exe
Token: SeLockMemoryPrivilege	1716	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	1716	AppLaunch.exe
Token: SeMachineAccountPrivilege	1716	AppLaunch.exe
Token: SeTcbPrivilege	1716	AppLaunch.exe
Token: SeSecurityPrivilege	1716	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	1716	AppLaunch.exe
Token: SeLoadDriverPrivilege	1716	AppLaunch.exe
Token: SeSystemProfilePrivilege	1716	AppLaunch.exe
Token: SeSystemtimePrivilege	1716	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	1716	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	1716	AppLaunch.exe
Token: SeCreatePagefilePrivilege	1716	AppLaunch.exe
Token: SeCreatePermanentPrivilege	1716	AppLaunch.exe
Token: SeBackupPrivilege	1716	AppLaunch.exe
Token: SeRestorePrivilege	1716	AppLaunch.exe
Token: SeShutdownPrivilege	1716	AppLaunch.exe
Token: SeDebugPrivilege	1716	AppLaunch.exe
Token: SeAuditPrivilege	1716	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	1716	AppLaunch.exe
Token: SeChangeNotifyPrivilege	1716	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	1716	AppLaunch.exe
Token: SeUndockPrivilege	1716	AppLaunch.exe
Token: SeSyncAgentPrivilege	1716	AppLaunch.exe
Token: SeEnableDelegationPrivilege	1716	AppLaunch.exe
Token: SeManageVolumePrivilege	1716	AppLaunch.exe
Token: SeImpersonatePrivilege	1716	AppLaunch.exe
Token: SeCreateGlobalPrivilege	1716	AppLaunch.exe
Token: 31	1716	AppLaunch.exe
Token: 32	1716	AppLaunch.exe
Token: 33	1716	AppLaunch.exe
Token: 34	1716	AppLaunch.exe
Token: 35	1716	AppLaunch.exe
Token: SeDebugPrivilege	1920	DirectDB.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AppLaunch.exeAppLaunch.exe

pid process

1716 AppLaunch.exe
1716 AppLaunch.exe
1716 AppLaunch.exe
1716 AppLaunch.exe
1928 AppLaunch.exe
1928 AppLaunch.exe

pid	process
1716	AppLaunch.exe
1716	AppLaunch.exe
1716	AppLaunch.exe
1716	AppLaunch.exe
1928	AppLaunch.exe
1928	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exeexplorer.exeAppLaunch.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1976 wrote to memory of 1904	1976	dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe	explorer.exe
PID 1976 wrote to memory of 1904	1976	dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe	explorer.exe
PID 1976 wrote to memory of 1904	1976	dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe	explorer.exe
PID 1976 wrote to memory of 1904	1976	dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe	explorer.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1716	1904	explorer.exe	AppLaunch.exe
PID 1904 wrote to memory of 1468	1904	explorer.exe	wab32.exe
PID 1904 wrote to memory of 1468	1904	explorer.exe	wab32.exe
PID 1904 wrote to memory of 1468	1904	explorer.exe	wab32.exe
PID 1904 wrote to memory of 1468	1904	explorer.exe	wab32.exe
PID 1716 wrote to memory of 1460	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1460	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1460	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1460	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1460	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1460	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1460	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1348	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1348	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1348	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1348	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1348	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1348	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1348	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1828	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1828	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1828	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1828	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1828	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1828	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1828	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1896	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1896	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1896	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1896	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1896	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1896	1716	AppLaunch.exe	cmd.exe
PID 1716 wrote to memory of 1896	1716	AppLaunch.exe	cmd.exe
PID 1896 wrote to memory of 1148	1896	cmd.exe	reg.exe
PID 1896 wrote to memory of 1148	1896	cmd.exe	reg.exe
PID 1896 wrote to memory of 1148	1896	cmd.exe	reg.exe
PID 1896 wrote to memory of 1148	1896	cmd.exe	reg.exe
PID 1896 wrote to memory of 1148	1896	cmd.exe	reg.exe
PID 1896 wrote to memory of 1148	1896	cmd.exe	reg.exe
PID 1896 wrote to memory of 1148	1896	cmd.exe	reg.exe
PID 1828 wrote to memory of 1072	1828	cmd.exe	reg.exe
PID 1828 wrote to memory of 1072	1828	cmd.exe	reg.exe
PID 1828 wrote to memory of 1072	1828	cmd.exe	reg.exe
PID 1828 wrote to memory of 1072	1828	cmd.exe	reg.exe
PID 1828 wrote to memory of 1072	1828	cmd.exe	reg.exe
PID 1828 wrote to memory of 1072	1828	cmd.exe	reg.exe
PID 1828 wrote to memory of 1072	1828	cmd.exe	reg.exe
PID 1348 wrote to memory of 1704	1348	cmd.exe	reg.exe
PID 1348 wrote to memory of 1704	1348	cmd.exe	reg.exe
PID 1348 wrote to memory of 1704	1348	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe
"C:\Users\Admin\AppData\Local\Temp\dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
2⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
PID:1460

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:588

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1072

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Serial.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Serial.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Serial.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Serial.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1148

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wab32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wab32.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Users\Admin\AppData\Local\Temp\DirectDB.exe
"C:\Users\Admin\AppData\Local\Temp\DirectDB.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
5⤵
- Suspicious use of SetWindowsHookEx
PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DirectDB.exe
Filesize
257KB

MD5
a911bfbc1a3e58c90af3068277d897bd

SHA1
230a72563a253e262a64d7bbc2ef9f64c317f35b

SHA256
dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4

SHA512
0783d092917a81eb31cff7438b358d1bb066d68e0247c0c2f828e14e1cdedf199f8500da01d36b29a9e00a3dd7fb5680d7728d0766a0a7ba72c7880845a35049

Download Submit
C:\Users\Admin\AppData\Local\Temp\DirectDB.exe
Filesize
257KB

MD5
a911bfbc1a3e58c90af3068277d897bd

SHA1
230a72563a253e262a64d7bbc2ef9f64c317f35b

SHA256
dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4

SHA512
0783d092917a81eb31cff7438b358d1bb066d68e0247c0c2f828e14e1cdedf199f8500da01d36b29a9e00a3dd7fb5680d7728d0766a0a7ba72c7880845a35049

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt
Filesize
102B

MD5
69104f0c944088ee37ca4cf4cbcc9c00

SHA1
3f94dc72bfeea22f624c6ecef5d6e2c17258d2b0

SHA256
7f860d55082a3ff57afc71722dc912844588c505d87b477cded8a1034379d92b

SHA512
827e5df941257efd902e2f3e82dd7f867c9aca97889590f12284696548957a355c5b97f92a198fff53538a4f310e80070b193de4e031783806738e6334081fbb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
Filesize
257KB

MD5
a911bfbc1a3e58c90af3068277d897bd

SHA1
230a72563a253e262a64d7bbc2ef9f64c317f35b

SHA256
dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4

SHA512
0783d092917a81eb31cff7438b358d1bb066d68e0247c0c2f828e14e1cdedf199f8500da01d36b29a9e00a3dd7fb5680d7728d0766a0a7ba72c7880845a35049

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
Filesize
257KB

MD5
a911bfbc1a3e58c90af3068277d897bd

SHA1
230a72563a253e262a64d7bbc2ef9f64c317f35b

SHA256
dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4

SHA512
0783d092917a81eb31cff7438b358d1bb066d68e0247c0c2f828e14e1cdedf199f8500da01d36b29a9e00a3dd7fb5680d7728d0766a0a7ba72c7880845a35049

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wab32.exe
Filesize
9KB

MD5
c9c4b5fd14511b6241a36a3d6437973f

SHA1
03d39cf5b9ade55b41fdabc25c3140ebfd444c1c

SHA256
c0278b9dfa3d59f2edf3f91279676a8a8453e17dec2abddaa9805199f2217bcf

SHA512
67e3a9be2072938aef452e7800d8b7991aeda01a843a4be201a4dffeea3d02c366d74d777b534dd02f0bf20c2b0459f1f4fb18e9f6a4525a4eb9b2c258190e14

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wab32.exe
Filesize
9KB

MD5
c9c4b5fd14511b6241a36a3d6437973f

SHA1
03d39cf5b9ade55b41fdabc25c3140ebfd444c1c

SHA256
c0278b9dfa3d59f2edf3f91279676a8a8453e17dec2abddaa9805199f2217bcf

SHA512
67e3a9be2072938aef452e7800d8b7991aeda01a843a4be201a4dffeea3d02c366d74d777b534dd02f0bf20c2b0459f1f4fb18e9f6a4525a4eb9b2c258190e14

Download Submit
\Users\Admin\AppData\Local\Temp\DirectDB.exe
Filesize
257KB

MD5
a911bfbc1a3e58c90af3068277d897bd

SHA1
230a72563a253e262a64d7bbc2ef9f64c317f35b

SHA256
dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4

SHA512
0783d092917a81eb31cff7438b358d1bb066d68e0247c0c2f828e14e1cdedf199f8500da01d36b29a9e00a3dd7fb5680d7728d0766a0a7ba72c7880845a35049

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
Filesize
257KB

MD5
a911bfbc1a3e58c90af3068277d897bd

SHA1
230a72563a253e262a64d7bbc2ef9f64c317f35b

SHA256
dddc03048feb18016f0c6a34795c3b1bfb9a016fa4301f8efa4b4ae0685f52e4

SHA512
0783d092917a81eb31cff7438b358d1bb066d68e0247c0c2f828e14e1cdedf199f8500da01d36b29a9e00a3dd7fb5680d7728d0766a0a7ba72c7880845a35049

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wab32.exe
Filesize
9KB

MD5
c9c4b5fd14511b6241a36a3d6437973f

SHA1
03d39cf5b9ade55b41fdabc25c3140ebfd444c1c

SHA256
c0278b9dfa3d59f2edf3f91279676a8a8453e17dec2abddaa9805199f2217bcf

SHA512
67e3a9be2072938aef452e7800d8b7991aeda01a843a4be201a4dffeea3d02c366d74d777b534dd02f0bf20c2b0459f1f4fb18e9f6a4525a4eb9b2c258190e14

Download Submit
memory/588-97-0x0000000000000000-mapping.dmp

Download
memory/1072-94-0x0000000000000000-mapping.dmp

Download
memory/1148-93-0x0000000000000000-mapping.dmp

Download
memory/1348-86-0x0000000000000000-mapping.dmp

Download
memory/1460-85-0x0000000000000000-mapping.dmp

Download
memory/1468-95-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/1468-74-0x0000000000000000-mapping.dmp

Download
memory/1468-127-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/1704-96-0x0000000000000000-mapping.dmp

Download
memory/1716-65-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1716-81-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1716-80-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1716-79-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1716-71-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1716-69-0x0000000000479210-mapping.dmp

Download
memory/1716-68-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1716-67-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1716-99-0x000000000044E000-0x000000000047A000-memory.dmp

Filesize
176KB

Download
memory/1716-128-0x000000000044E000-0x000000000047A000-memory.dmp

Filesize
176KB

Download
memory/1716-64-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1828-87-0x0000000000000000-mapping.dmp

Download
memory/1896-88-0x0000000000000000-mapping.dmp

Download
memory/1904-57-0x0000000000000000-mapping.dmp

Download
memory/1904-62-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/1904-126-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/1920-105-0x0000000000000000-mapping.dmp

Download
memory/1920-125-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/1920-129-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/1928-113-0x0000000000479210-mapping.dmp

Download
memory/1928-124-0x000000000044E000-0x000000000047A000-memory.dmp

Filesize
176KB

Download
memory/1976-61-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/1976-55-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/1976-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download