Overview

overview

10

Static

static

10

55309a4905...c6.exe

windows7-x64

7

55309a4905...c6.exe

windows10-2004-x64

9

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

OGFnPatcher.exe

windows10-2004-x64

9

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...e3.dll

windows7-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...act.js

windows7-x64

3

resources/...act.js

windows10-2004-x64

3

sqlite-aut...llback

ubuntu-18.04-amd64

1

sqlite-aut...llback

debian-9-armhf

1

sqlite-aut...llback

debian-9-mips

1

sqlite-aut...llback

debian-9-mipsel

1

sqlite-aut...ace.js

windows7-x64

3

sqlite-aut...ace.js

windows10-2004-x64

3

sqlite-aut...al.ps1

windows7-x64

3

sqlite-aut...al.ps1

windows10-2004-x64

3

sqlite-aut...re.vbs

windows7-x64

1

sqlite-aut...re.vbs

windows10-2004-x64

1

sqlite-aut...all-sh

ubuntu-18.04-amd64

1

Resubmissions

17-09-2024 05:44

240917-gffsksxepm 10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 05:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    OGFnPatcher.exe

  • Size

    177.3MB

  • MD5

    82db6baf5501b11cf7582d68cb173689

  • SHA1

    ff40fcae2ecfb00eb3f1a36521afbdc93db1e6e6

  • SHA256

    17f48d532943a1160b9c171e183599d28b3a03b4943df8d1b5f8af2aaed142fc

  • SHA512

    9d47fc31fec0379b7ec6461401e5cda54f7b64d6ff0a30136e5ad58bb94446cfa6f1e511380eb5bf99f59174e56fdc7a7cd06cf7cf46898c672bf37c36ec4d82

  • SSDEEP

    1572864:s+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnau:sA5kyGScXQT

Score
9/10
credential_accessdiscoverypersistencespywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
    "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe"
    1⤵
    • Checks computer location settings
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3352
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3728
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size | more +1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:840
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic logicaldisk get size
        3⤵
        • Collects information from the system
        • Suspicious use of AdjustPrivilegeToken
        PID:788
      • C:\Windows\system32\more.com
        more +1
        3⤵
          PID:3308
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4772
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
        2⤵
          PID:4528
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic OS get caption, osarchitecture
            3⤵
              PID:2264
            • C:\Windows\system32\more.com
              more +1
              3⤵
                PID:4968
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:992
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic cpu get name
                3⤵
                  PID:3128
                • C:\Windows\system32\more.com
                  more +1
                  3⤵
                    PID:1480
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4976
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic PATH Win32_VideoController get name
                    3⤵
                    • Detects videocard installed
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3004
                  • C:\Windows\system32\more.com
                    more +1
                    3⤵
                      PID:1064
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                    2⤵
                      PID:2256
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4616
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
                      2⤵
                        PID:2104
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3152
                      • C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
                        "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2148,i,2524379109554564730,11997319315768423049,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
                        2⤵
                          PID:2168
                        • C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
                          "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --field-trial-handle=2380,i,2524379109554564730,11997319315768423049,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
                          2⤵
                            PID:1228
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3352 get ExecutablePath"
                            2⤵
                              PID:1712
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic process where processid=3352 get ExecutablePath
                                3⤵
                                  PID:1068
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v System32Kernal /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe -silent" /f"
                                2⤵
                                  PID:4112
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v System32Kernal /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe -silent" /f
                                    3⤵
                                    • Adds Run key to start application
                                    PID:1572
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                  2⤵
                                    PID:2376
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:728
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                    2⤵
                                      PID:4820
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist
                                        3⤵
                                        • Enumerates processes with tasklist
                                        PID:4520
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                      2⤵
                                        PID:216
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist
                                          3⤵
                                          • Enumerates processes with tasklist
                                          PID:1264
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,61,28,111,48,103,192,200,74,187,56,57,175,169,46,187,15,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,8,218,122,81,177,48,95,253,108,218,130,13,112,190,161,148,54,196,50,90,193,158,228,91,46,204,167,254,123,58,18,139,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,214,140,72,70,183,16,203,205,43,205,4,153,236,226,150,108,139,243,20,224,114,19,84,193,11,208,124,197,196,61,82,169,48,0,0,0,8,76,156,179,198,169,195,116,34,32,0,17,1,81,169,82,33,38,0,5,199,59,97,116,172,20,214,91,152,86,96,192,206,198,241,87,169,221,33,132,89,174,201,177,80,202,153,147,64,0,0,0,200,138,112,152,245,240,101,248,210,103,126,78,189,177,23,119,125,33,62,133,57,50,6,248,115,241,146,151,179,22,122,131,2,173,67,64,232,52,160,148,232,154,228,4,97,45,41,113,104,139,91,33,174,101,33,130,65,111,46,244,195,39,204,194), $null, 'CurrentUser')"
                                        2⤵
                                        • An obfuscated cmd.exe command-line is typically used to evade detection.
                                        PID:2812
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,61,28,111,48,103,192,200,74,187,56,57,175,169,46,187,15,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,8,218,122,81,177,48,95,253,108,218,130,13,112,190,161,148,54,196,50,90,193,158,228,91,46,204,167,254,123,58,18,139,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,214,140,72,70,183,16,203,205,43,205,4,153,236,226,150,108,139,243,20,224,114,19,84,193,11,208,124,197,196,61,82,169,48,0,0,0,8,76,156,179,198,169,195,116,34,32,0,17,1,81,169,82,33,38,0,5,199,59,97,116,172,20,214,91,152,86,96,192,206,198,241,87,169,221,33,132,89,174,201,177,80,202,153,147,64,0,0,0,200,138,112,152,245,240,101,248,210,103,126,78,189,177,23,119,125,33,62,133,57,50,6,248,115,241,146,151,179,22,122,131,2,173,67,64,232,52,160,148,232,154,228,4,97,45,41,113,104,139,91,33,174,101,33,130,65,111,46,244,195,39,204,194), $null, 'CurrentUser')
                                          3⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3020
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,61,28,111,48,103,192,200,74,187,56,57,175,169,46,187,15,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,238,63,56,178,84,215,241,50,61,115,82,189,250,9,179,193,174,149,201,41,220,105,177,218,111,248,219,168,251,253,6,188,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,74,8,180,93,245,211,233,165,172,19,163,246,211,124,16,77,128,48,82,58,147,46,86,77,223,94,248,135,75,189,61,151,48,0,0,0,181,126,119,173,128,7,117,236,213,252,235,135,151,21,211,212,201,2,198,111,34,158,77,255,138,215,5,253,21,236,215,197,198,97,129,185,186,164,130,224,244,196,37,201,251,223,227,130,64,0,0,0,153,155,48,141,191,30,157,98,119,41,61,136,71,244,170,5,192,8,110,66,25,94,147,83,9,255,165,89,19,229,5,163,74,107,229,22,98,234,25,252,28,149,21,92,182,34,5,60,227,16,101,127,244,133,13,170,164,67,61,77,250,19,45,204), $null, 'CurrentUser')"
                                        2⤵
                                        • An obfuscated cmd.exe command-line is typically used to evade detection.
                                        PID:3132
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,61,28,111,48,103,192,200,74,187,56,57,175,169,46,187,15,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,238,63,56,178,84,215,241,50,61,115,82,189,250,9,179,193,174,149,201,41,220,105,177,218,111,248,219,168,251,253,6,188,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,74,8,180,93,245,211,233,165,172,19,163,246,211,124,16,77,128,48,82,58,147,46,86,77,223,94,248,135,75,189,61,151,48,0,0,0,181,126,119,173,128,7,117,236,213,252,235,135,151,21,211,212,201,2,198,111,34,158,77,255,138,215,5,253,21,236,215,197,198,97,129,185,186,164,130,224,244,196,37,201,251,223,227,130,64,0,0,0,153,155,48,141,191,30,157,98,119,41,61,136,71,244,170,5,192,8,110,66,25,94,147,83,9,255,165,89,19,229,5,163,74,107,229,22,98,234,25,252,28,149,21,92,182,34,5,60,227,16,101,127,244,133,13,170,164,67,61,77,250,19,45,204), $null, 'CurrentUser')
                                          3⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3620
                                      • C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
                                        "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1720,i,2524379109554564730,11997319315768423049,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1048 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3020

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Browsers\Passwords.txt
                                      Filesize

                                      19B

                                      MD5

                                      c4efd9a7b61ebf43b608440be5e33369

                                      SHA1

                                      926418256c277f1b11b575ec6e92ce6a844612f7

                                      SHA256

                                      ed4280859199da5a8f25c0c6d533d0873460ac63368c14a69bbd863ea4bfb30f

                                      SHA512

                                      9ea97363868d61d3d51bd3804d638b71ba8dc65260800b3a54051b4725cf08e9d9880a12422a549d94a339c7267e858a7ff5ca9428d64051657134b5c6c20745

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\AddShow.rtf
                                      Filesize

                                      882KB

                                      MD5

                                      e84d72b1a96e198dd782f77e945b2a0d

                                      SHA1

                                      032c622617776d2c2ca16b6dba53bb10e18e7ff0

                                      SHA256

                                      b5d714f91aa1bfb341005ba16b466896a049063fb3831e40ee79ae266e05b9f0

                                      SHA512

                                      324a74e10006fbb89597f361d3135131731920a7bc650f56a22d20d4f4a9c68be6ebfc819bcf5ca4735d60b0e460ee284c87e3e93f46750378606844ed464564

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\CloseResume.docx
                                      Filesize

                                      359KB

                                      MD5

                                      108a0c23ae2610f7de41fc20ee43ba5e

                                      SHA1

                                      d5743182cdee00c29787a408d68e8f94364124e0

                                      SHA256

                                      bc50a9acaab8feae9d4c4f66c9fe96274406329705d0fbabfd240b22282a1f2f

                                      SHA512

                                      0992bfe71fbd9d92dc31e72dc4f094777fdd214f461e696a726d936855cd37cccd356e41d3f23c0cc9e7869bc3d13fb804984bda967650d65f46f194713203ca

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\ConfirmMove.rtf
                                      Filesize

                                      647KB

                                      MD5

                                      b15fbb61d5caddd5eda78443c2bf5bb4

                                      SHA1

                                      725ded89d59652ab81e4ab45aa9195cdc08db925

                                      SHA256

                                      216895ebcb850e0c24243df98678f1f8e9a4d8e9dae5b6c5883600910291f528

                                      SHA512

                                      9e1ff4496e7d0a4e89c633aaffd40d8b85fcaa13b7edc62cb4b0d1917984ddbd20b531cf335deab0e8f77d26452da2c4b2497f2b3f6e6deff80ff71c3d63e8c7

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\ConvertFromPush.txt
                                      Filesize

                                      1.0MB

                                      MD5

                                      098495e1606267e72808fdcc6ab98c33

                                      SHA1

                                      e3704189a6b056e32e3ab7d11e0cd9c926459c2e

                                      SHA256

                                      9ae0b982b756c015880c1ac75df4bcd1bd9b0bb06a2f4af129ee991850dcb833

                                      SHA512

                                      adb0bc9ce5e644fef31c1885184715cdc36c9d4d4e77fcf4b5ecff93daace1e1ae81fd263d32167df923c15f5804f6da7a913f860397696dcfbc403de531cd22

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\DebugSync.docx
                                      Filesize

                                      14KB

                                      MD5

                                      7370c075b16ba5c8b627faa1e4d05c9c

                                      SHA1

                                      0097ec3d55d346d83f50161674ddfd915ff63ae7

                                      SHA256

                                      9f899a9e5e0648206a640f490eb6bd92e45b2b9abbad7ee7b54bcc00586222af

                                      SHA512

                                      c29f1a0e7420b8e3ca0aa5207d798c73fee036b5d790ae7355c8c0512a62119c7fb26513dc554a24bcb705ba15a43e4b2357969f038d115c65e9224315d40f5a

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\NewPush.rtf
                                      Filesize

                                      632KB

                                      MD5

                                      310ac4cb846178f0651d6977191cd8c3

                                      SHA1

                                      c80251533c65cc0297f81a28f6e3bf5563dafec2

                                      SHA256

                                      a3a10431f91be6c3d580539fc6b37bf8824ea5c75c78785890ddba3d194968aa

                                      SHA512

                                      f85d4bb8294de146ec4cbbf8c99a0da1cfde751e44819745aded0a55c68a11e72bb0746c761ad1a4b32d6eb6d69ee75af84573dca4711d9cb4eb06ad23e62ca8

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\RepairRequest.docx
                                      Filesize

                                      18KB

                                      MD5

                                      68975b4e97ee03190d5cc12f6796e690

                                      SHA1

                                      271f27f2f8a514cd4a0010da2143785bd2202b6d

                                      SHA256

                                      450424312f34c1e4ffc8df4932e9c128a7290d49460989a95a0310baf8a185c1

                                      SHA512

                                      3cfa2c4092eaea7720584e55eead78a64f4868a78b59e3e2475ffd9cec5757414b82bf9d18ad55542b08a592f5e0c314a6b7a735112ec6a019afa830ae01c4fb

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\RestoreRepair.odt
                                      Filesize

                                      615KB

                                      MD5

                                      a1a5b148b467e697ee27430b6c288753

                                      SHA1

                                      fff8ae42f68706eedd47db9d568ba755febd8d33

                                      SHA256

                                      093ba9fb56e33300a54842be003a99db35c3f6a4eda8f17216e5969acd9b6a8a

                                      SHA512

                                      b69a449e49b96556ec89a2ef3ee248da38aade558562bba937d4c745aa0eefce7b35a7e270a87b7b151bc984c1a28a8644f51df703bc0480fed613aba651a9c9

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\SelectWait.txt
                                      Filesize

                                      554KB

                                      MD5

                                      9d2ead013ae2b5e9b76481085f2ab9ea

                                      SHA1

                                      4f1618d862acfbbf688ccb1dd03277dd8afd5678

                                      SHA256

                                      15f5c0d7497fd7545dff902ab2aa158895ddef58408e855a05bc29c5bf61012c

                                      SHA512

                                      14632aed67733b13cebc0952544cb94594f9fa7aa22c53942c1d1b7df6ddf1eec4505f1eb8c8f2ec48b7df60a137517d61edc585ffc5bbee22d8bb47f654104b

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\SendUse.pdf
                                      Filesize

                                      543KB

                                      MD5

                                      3a4325c5e18f5cbca88e387877866d8f

                                      SHA1

                                      145abea478f8b594aa7a7bd8f29f85315db6fe5f

                                      SHA256

                                      65c1533cd2e534edea5333ceba3201476840f6b57c7bd60fced6ee8daaddf8ac

                                      SHA512

                                      4da6cefe99672bece73b1bc3cd483f1f9d9858bdbc38668b7694322d8695301495a6cfa7a6ae32c029cba2c0d6f968e3700844703080df0af4db359988a48c3f

                                      Download Submit

                                    • C:\ProgramData\7b758cf915e5d659b9db382bc39e6e09\Files\TestAdd.docx
                                      Filesize

                                      14KB

                                      MD5

                                      f163f23e430fc92cfee908262b37075b

                                      SHA1

                                      577f32129e1500151df82f9aada3e35dabeb87e3

                                      SHA256

                                      6442e6bfd439e6430cd93961482af06a76823dff86d215fc582d084b8f26e60c

                                      SHA512

                                      b1784082b2c18b3bfcb190cef9dc88992eadc6d2fd8670797855f7598300a29b891baddd3b65bf5b38f8fddaadf2a72b1b6689e2a6293f779ca2a1032d341633

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                      Filesize

                                      2KB

                                      MD5

                                      6cf293cb4d80be23433eecf74ddb5503

                                      SHA1

                                      24fe4752df102c2ef492954d6b046cb5512ad408

                                      SHA256

                                      b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                      SHA512

                                      0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      64B

                                      MD5

                                      3ca1082427d7b2cd417d7c0b7fd95e4e

                                      SHA1

                                      b0482ff5b58ffff4f5242d77330b064190f269d3

                                      SHA256

                                      31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

                                      SHA512

                                      bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      64B

                                      MD5

                                      446dd1cf97eaba21cf14d03aebc79f27

                                      SHA1

                                      36e4cc7367e0c7b40f4a8ace272941ea46373799

                                      SHA256

                                      a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                      SHA512

                                      a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      1KB

                                      MD5

                                      8e26941f21dac5843c6d170e536afccb

                                      SHA1

                                      26b9ebd7bf3ed13bc51874ba06151850a0dac7db

                                      SHA256

                                      316f6ce22306f3018f9f57435ea75092633097182646f7e4ca23e2e2aa1393c0

                                      SHA512

                                      9148227032d98d49baf0d81a7435ba3adc653d7790245140acc50c38de00839d26a661b92f6754b15bab54fe81fbcf9003692fd7bef09027f11ef703a5879e62

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqhdtydq.50j.ps1
                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      Download Submit

                                    • memory/3020-168-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-64-0x00000293D60C0000-0x00000293D6110000-memory.dmp

                                      Filesize

                                      320KB

                                      Download

                                    • memory/3020-170-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-169-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-174-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-175-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-180-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-179-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-178-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-177-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3020-176-0x0000017B851D0000-0x0000017B851D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/4616-8-0x000002619CA20000-0x000002619CA42000-memory.dmp

                                      Filesize

                                      136KB

                                      Download