e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b.dll
Size

24.8MB
MD5

50c424218307e9cb81ce2b1febbbc9a4
SHA1

f57ddd3ac726bfa59de0edf309edac4d63c3bdae
SHA256

e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b
SHA512

a2eb3eb990685657811839cf3d6af582e8a8341615f28601c14f0d709f979b8d2db20f70b2aa5564d081bd5e60956e55546fa7b0214a0692aa60d14df2d40f3d
SSDEEP

393216:+iCfMh8Pf/v3ye4CJjQTqi9YnVDpzeH6aNtpJMjNzkoy4mF:kUhe/vLXxSaDF2NtjOZy4O

Score

8^/10

collection discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1232	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	secd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
4372	secd.exe

Loads dropped DLL 23 IoCs

pid	Process
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	secd.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	secd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	secd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	secd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	secd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	secd.exe
File opened (read-only)	\??\F:	secd.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	secd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	secd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	secd.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	secd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	secd.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	secd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	secd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	secd.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	secd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	secd.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C2C2BEAD80CB923A86999D16946BC73D50AB98C	secd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C2C2BEAD80CB923A86999D16946BC73D50AB98C\Blob = 0300000001000000140000000c2c2bead80cb923a86999d16946bc73d50ab98c2000000001000000900200003082028c308201f5a003020102020862fd0f742609ac10300d06092a864886f70d01010b0500307e313d303b06035504030c344d6963726f736f66742054696d65205374616d7020526f6f6720436572746966696361746520417574686f726974792032303134311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b30090603550406130255533110300e06035504070c075265646d6f6e64301e170d3232313030323131353032365a170d3236313030313131353032365a307e313d303b06035504030c344d6963726f736f66742054696d65205374616d7020526f6f6720436572746966696361746520417574686f726974792032303134311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b30090603550406130255533110300e06035504070c075265646d6f6e6430819f300d06092a864886f70d010101050003818d00308189028181009d4b24d7998dbdd1ec23c9c54e0cacbdc843ba8d36232a383bdbfb0040987357adf7d8a7d1db748c972fad71728a2c31058a3b602e9dbc2b20ce290ff4a9fdae8f4fe5e7221da589276c77f633498f5855b72f903bc1685a29d7ed982e3ca50dd1214e425666618fd8874c9b3b1351f11d9358286b45b0520cdc8662690d5a850203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003818100864f7fb3e9c8fd9d440d247a567eb4d887310f870a5900b51a0df0bf35d5d2d3d6ee3cdf7edb379547bdbe98e8dceb8f7881dce6c9ada7f3b85dea65dee0bb74ebd9bdead207496833c0c3666d1032357e179327144af0a358eee4a373acadcb21243a485734d3da0432698c460798218ac0f16b48a04fda42cacb5c479a9c55	secd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
4372	secd.exe
1232	powershell.exe
1232	powershell.exe
4372	secd.exe
4372	secd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	4372	secd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4372	secd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3380	4960	rundll32.exe	84
PID 4960 wrote to memory of 3380	4960	rundll32.exe	84
PID 4960 wrote to memory of 3380	4960	rundll32.exe	84
PID 3380 wrote to memory of 4372	3380	rundll32.exe	100
PID 3380 wrote to memory of 4372	3380	rundll32.exe	100
PID 3380 wrote to memory of 4372	3380	rundll32.exe	100
PID 4372 wrote to memory of 1232	4372	secd.exe	109
PID 4372 wrote to memory of 1232	4372	secd.exe	109
PID 4372 wrote to memory of 1232	4372	secd.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	secd.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	secd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b.dll,#1
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\secd.exe
    "C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\secd.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - Enumerates connected drives
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:4372
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\secd.exe
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\ASL.dll

Filesize
67KB

MD5
9d4285cbb6f8be63fe18426a6ad49c3f

SHA1
17863703b77220ad826be9e845d156b75eadb1e6

SHA256
b6cdd784675f102dfd811dd621a04cac97d0ce36bdc73c373870d1a84f9449d8

SHA512
9efc34b02e5be286a143b0386a7aa614a7293346f8ddad8a0ae72317d12abc127259f5d6576a11c82f1c37bcdd57f7064d2ddb034ceabec30c211225c6d93930

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\ApplePushService.dll

Filesize
88KB

MD5
5833da04537db47a9a5f3c53771d2874

SHA1
50453c87f7dda7d13a0820da9d459e10b787c843

SHA256
146d8f7ab57a2d288831e3fa46cdb59bc8fab17b8800a820c3bae2f77d8d3edc

SHA512
e6a0810c30c6d84c41a3ce933b60b00b5fb543dc81b4cacc6acf1fd25336b8799b78c5f7bb35157ad18a3b3be22ca80da0fec6c1501f5d2f0fbe7fa0d1db6763

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\CFNetwork.dll

Filesize
2.0MB

MD5
80038b5a64f915c4eee38271ae666250

SHA1
e4df672568a63ba376b6aba683e1d53696ca2f1f

SHA256
8ce28693f8e55d3824f14ed71ef08e8cb7bdf23692694a60078f7b9ad70fabc9

SHA512
49fb19a3bc9d199bbab5f1660a1dfe3fe4d80807123db06e3fa5ea6c32540cae57dd4163123c8cdbd1a7131654060b5572bf93816cc1a8df48a6e6429bf447b0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\CoreFoundation.dll

Filesize
1.6MB

MD5
f8e1afea1ff44a643d44bd2e7bfecfbb

SHA1
fa6adeb49947c490d29c1b61f2b03a4938373ee1

SHA256
9d8eb1314d91240641fad144472eb897aa3a95bbe9e59674c200a86012bb4a9b

SHA512
19633677b49e6eee8b8c28c13f95397a36bc2b50c7fe4764896eb420b1b6d45a467ad370ab3c003bec31bda329e429fad676f6f4d1e91dd84c2178a721ccca67

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\IDecrypt.dll

Filesize
5.1MB

MD5
d2f9628b2689de60b8930e23ce75d791

SHA1
3de06ceb7d3defdb0d4eff65fae6e6f503d02539

SHA256
37ace8cf5fae40095727139ba1d21054ff7d7cad2db7e1b7fe193da1ea40cf95

SHA512
007425e30d5f37022ba64fb203ede9e6c22565c423cfa58a20d211b2ead5679309cc1f8242fefbc19c4dc489c407dc9f5b385f407c68013bd1f35ac945483f2f

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\MSVCP120.dll

Filesize
444KB

MD5
854fb5751985d6d40fa12bc9c3e82be5

SHA1
e57cc61a59e88d2b6a373abca622af259c58be4e

SHA256
0e535e147d253fc645ccb9406c888aee374ab1f3f9d99dc057a2b19cf401458b

SHA512
03c9e9886f20249547193351750fc5bd8b5f32e354162ca9be04d8a65a701d73d2ad86ede9606a38ba6e030f2a9c02efc60d409411991bbb636340f1c258c32a

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\MSVCP140.dll

Filesize
438KB

MD5
0e7ee09885e643f8b2871d5ce0ccfd25

SHA1
a7d14206f2f5b96eac1f88e2f4c89a79247fd1d8

SHA256
a3e0b72081f932ade69b4004035e399dd6e7445ba3b646db2ab750a4c4e4241e

SHA512
f61d0dac40bbe4a54a3f4d21349d3677f69b9e0bd383b89d1cb32a74d785c5ed62fa73c4203833d2b809b55183e65d632d0791e92b1dc01631f5fd7649705bc4

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\MSVCR120.dll

Filesize
948KB

MD5
7dabb11da67d32c5dc917839fcbeb16d

SHA1
198923794549bc37e8b05a326a403eedadba7b55

SHA256
82225ec7e2da43a7a72a3d523698747512523afa488767ca6839c63a7a5706fa

SHA512
5e65b49ace7bffddeea1ad3c3aa777d6e23024b91b8bff3db1d1f4955d718d277e88428d671ce232807fc166818b891e8b0535b6aa4c21032dbc99840321fdd6

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\Module.dat

Filesize
5.5MB

MD5
c5e5f171043d69a7723cf5b1660400a6

SHA1
e88047d8c94994deba7852388102994b9eeaaa6d

SHA256
91ec3e3a9d1c5f687e426e47ef61417f37e1f674868b8e25df79856ce0957585

SHA512
0bd21f15f043c48b5e24cc436e5109e6193a559bad80e070546d6feca60bb481d53e569636c225a9b6dc8de2b54982f0be87382f622f992387cb6caa6e51b8f0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\SQLite3.dll

Filesize
677KB

MD5
740fdf092ff0d262c26a81568fef2ce2

SHA1
4c64715b749abf153d0d56f02a3e11e025892d33

SHA256
84ade026836552746c4907c5c5fa18b327dcbcb3426e93a183b82a7fef55d7a8

SHA512
841723b7aecd938d15d30cadefe14c274cf8455f5fdb60e944db651c2b2c4989bc7f4582b67b7e27e0875d90c3e01cc362eda50b8bd8e5f8a327a951a00e786a

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\icudt55.dll

Filesize
25.1MB

MD5
5ba2ba4c4df2ca24dec0d37d74d319c3

SHA1
2959ee5743ec611161bb126201cfb3e9930a84a3

SHA256
2cbafcc04dde73b3f9d00ae91c8bc2bc3d2eb47e376bfc76a1077a762b50feb7

SHA512
f4e297ad39fa8f4434f07870982b5fbd4ddd0ad1e0b76d38bb78d45ab68b60b5df0b4f97cddc03e3ac35bed96115ffb43ed43e6c992bdbbacd383e59f160b75e

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\libdispatch.dll

Filesize
79KB

MD5
da0ef99eb4a5ef8909f3119ce4dfb208

SHA1
803e6259ba5ec8d421895a4223dc1b0b338c9a3c

SHA256
a6018eb6eca06f22c5e9ea255432490336f8fe6e0b69dc0249afefc7f0e38158

SHA512
9efba00fe0c5a477873dc9e22c1c470dc06b4eb888f6241f8f2284d932b9ad1d92eec3e5ed011742ff5d96a785fc3f12f5fc0724d43e4eb3e6c6d9338094fee0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\libicuin.dll

Filesize
1.6MB

MD5
b67a251689f207c0661cc5983d3dd904

SHA1
f437bd42f687e08decf9d902c533f3ca15d345b3

SHA256
3111bfd4ddde595ce01318c260300e4c5ce9ffc5f905c6bbd53c9f299355bed5

SHA512
f4ca81cb1756c37d2eb16ee05395eccdd087693133a08f46dbe73fb6116db58c63e8dfdfff7778a1ec80c6b8d36784db656a6070e5fb9ed95e596c8ef7c76831

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\libicuuc.dll

Filesize
1.1MB

MD5
0e85a881e04964d742174f35e5df136a

SHA1
0fdce7e5b835e797211d965b263697b1367c97a6

SHA256
499f014571a2612c755aa8812adcae0c3b288f04594b885333c36faef2d3d40f

SHA512
8ee4e6e5fa04f42585722a4e9af2660aa8d5fb867fe2068fc1c6669df89eab56470ff3194bb96a51949463012bc908092cfff563a2a8bc1f9220b42610b9c021

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\libxml2.dll

Filesize
1017KB

MD5
358419494e8362ed3c1e590642351b68

SHA1
7e86d016441b6384fc682f40fbf20b8b2b9d68ee

SHA256
89e37eba1093cea800e83a9252c0bd3e310b1372a74c1ac978f42b771ec35c34

SHA512
b74d9cafebfbee6336d0ccf42c68adb3e085a3570799ce0edf85b2d840ed2f7d0cb5a25087f5dd02304da5a07aae6157b0ce407e0c55310bd442828b8d7759eb

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\msvcp100.dll

Filesize
411KB

MD5
03e9314004f504a14a61c3d364b62f66

SHA1
0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d

SHA256
a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f

SHA512
2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\msvcr100.dll

Filesize
752KB

MD5
67ec459e42d3081dd8fd34356f7cafc1

SHA1
1738050616169d5b17b5adac3ff0370b8c642734

SHA256
1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067

SHA512
9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\objc.dll

Filesize
164KB

MD5
1db7b9eda0f3aa39c28991e32fcbcf6b

SHA1
f9aedf86b26218690d899eeae5fe90f14045d211

SHA256
e4b0aaaf8349b4f2cc33191df12fbfbe10ac9ef4b25ae44ba73e9ae1d4a051a4

SHA512
103953644161c9ee05bf7358e93811266fb5a17b3f81940d9126d2b801481c86388690020ede484e151ac3695e72617fc4d39634f26e9e82a5504d802c5021da

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\pthreadVC2.dll

Filesize
64KB

MD5
45c309624de9df425b2f8873640b0bbe

SHA1
9683beb7b5462e055a56e69d15bb7f99d5fd8d99

SHA256
40adb345073f2133dd766147383319e8350b2d9d0692b4a832905a883656eb0d

SHA512
85b40e50a22174965328278e9f7395a52423f77d7dae9197866c51a87e43fb6f41eb71e8f2dc2faa9520cb6ed694ba5db85edb90e29eb3f0af4ad97514c965ce

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\rnp.dll

Filesize
2.9MB

MD5
8b6b957adceadf00107a58671052fdf3

SHA1
763d5b30b52dfffa19afa6845ebbba9e5267290f

SHA256
79d2d9df16948ffc2ec7f4e4dbe9d95659b1300a3dd5def0017762d91fa57316

SHA512
1e184bb64201ed6a4d19b6bdca30b7d8e1ad6ffa95256b0dd3228d2834ee819bef09bd8b93ff14a25e6d16da41ea9434fc66aa71bc0bc013828dd7856277bd7a

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\secd.exe

Filesize
1.3MB

MD5
30020e84ea131c4c99f401bbe72ad2f4

SHA1
4d6453dcce60a584a70c135b304207404fb9678f

SHA256
b744e873d94f93bb5ad6025096e723a25f1b9fa810d777fdb56eb8a66557b918

SHA512
1abbf03cfdd65bad3e5a40882a35a2ef3c9976adcd06c27a0aecfff9044497a4b63dab29c3ca95479f4356ce09f7e33cfa1b814526854576e01f3b852810698b

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\vcruntime140.dll

Filesize
77KB

MD5
1be9d544dd1c945e456ae771e4342d14

SHA1
5d7cdb8bc2812df79b9a8dcb2be77f7cd21bc1c4

SHA256
16767d1457bb250974710ade0f49b8d8fa71f77621dc2aeb5e4b089553aed363

SHA512
5ba42f15049ac6619c3de56df93985c6fcd14fad502d369d845cfb4fa63752335bcdb6a53bb6adf5d59c602128b06a020752831ed620a526214aa1fb5e540706

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\workout.wav

Filesize
3.1MB

MD5
7b89592151464805e0530a79df9a4324

SHA1
24fe824782830108c8a2a63c1a88214691477d05

SHA256
97424b6b492765669d32224d8d7a271710a9b972a0be39ddf250b9fa1dd2a385

SHA512
703c3bfa420cd40c902d41049f15fd2c6156f5a136bb84f9ad21026f40446c5c4232d9968158a6cd90a8333bb40a903fb8f64accb047727306e3f239cecd1091

Download Submit
C:\Users\Admin\AppData\Local\Programs\Apps Security Manager\zlib1.dll

Filesize
74KB

MD5
a671b4825611fff573ef182dfb33adf9

SHA1
7fffb72aceabee466933eb7b9f07c14c49c1ac8e

SHA256
fd6f049daadf45cb3d77906f8312a15edda0f2db034ad4333877e9198d233240

SHA512
b01c9aa9dd0f3306ee42ec1f3813b7ed85d97f3c688f9ffd677024052c357510875d239ee8b72fe91f230e6e849b212fbb4addbf4d8d1e084ff68dbc95668738

Download Submit
C:\Users\Admin\AppData\Local\Temp\Oufaodwthhwy

Filesize
40KB

MD5
ab893875d697a3145af5eed5309bee26

SHA1
c90116149196cbf74ffb453ecb3b12945372ebfa

SHA256
02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba

SHA512
6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vt5gbmrs.qko.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\s2lw.2

Filesize
16KB

MD5
12924571a602fbfdb9698a876fca7fde

SHA1
3e0ee7cb7c474d404be7a8fb3e869f4b470b3eaf

SHA256
d717fa8e97addd5d586dfd7fda0a08d3b3dca7d9e498e94db8c3ebc90813d916

SHA512
c14005ef092e7305423613c2f22b99a1c49ccd75d58a6df81ef30047184c880dfa0fb10bf672d70987d4dc4d4a351a2a8b538829bb444606c6f410b173f2c3ba

Download Submit
memory/1232-150-0x0000000006900000-0x000000000694C000-memory.dmp

Filesize
304KB

Download
memory/1232-190-0x0000000007AC0000-0x0000000007B63000-memory.dmp

Filesize
652KB

Download
memory/1232-219-0x0000000007F10000-0x0000000007F18000-memory.dmp

Filesize
32KB

Download
memory/1232-218-0x0000000007F30000-0x0000000007F4A000-memory.dmp

Filesize
104KB

Download
memory/1232-217-0x0000000007E30000-0x0000000007E44000-memory.dmp

Filesize
80KB

Download
memory/1232-211-0x0000000007E20000-0x0000000007E2E000-memory.dmp

Filesize
56KB

Download
memory/1232-200-0x0000000007DF0000-0x0000000007E01000-memory.dmp

Filesize
68KB

Download
memory/1232-199-0x0000000007E70000-0x0000000007F06000-memory.dmp

Filesize
600KB

Download
memory/1232-198-0x0000000007C60000-0x0000000007C6A000-memory.dmp

Filesize
40KB

Download
memory/1232-197-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

Filesize
104KB

Download
memory/1232-196-0x0000000008240000-0x00000000088BA000-memory.dmp

Filesize
6.5MB

Download
memory/1232-184-0x0000000007A90000-0x0000000007AAE000-memory.dmp

Filesize
120KB

Download
memory/1232-173-0x0000000006EA0000-0x0000000006ED2000-memory.dmp

Filesize
200KB

Download
memory/1232-174-0x000000006DAD0000-0x000000006DB1C000-memory.dmp

Filesize
304KB

Download
memory/1232-149-0x00000000068E0000-0x00000000068FE000-memory.dmp

Filesize
120KB

Download
memory/1232-148-0x0000000006430000-0x0000000006784000-memory.dmp

Filesize
3.3MB

Download
memory/1232-137-0x00000000062C0000-0x0000000006326000-memory.dmp

Filesize
408KB

Download
memory/1232-136-0x00000000061E0000-0x0000000006246000-memory.dmp

Filesize
408KB

Download
memory/1232-132-0x0000000002FA0000-0x0000000002FD6000-memory.dmp

Filesize
216KB

Download
memory/1232-133-0x0000000005B00000-0x0000000006128000-memory.dmp

Filesize
6.2MB

Download
memory/1232-135-0x0000000005A10000-0x0000000005A32000-memory.dmp

Filesize
136KB

Download
memory/4372-123-0x0000000063280000-0x00000000634BE000-memory.dmp

Filesize
2.2MB

Download
memory/4372-119-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-130-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-109-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-127-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-147-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-129-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-101-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-100-0x00000000745A0000-0x0000000074893000-memory.dmp

Filesize
2.9MB

Download
memory/4372-162-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-222-0x0000000009F00000-0x0000000009F29000-memory.dmp

Filesize
164KB

Download
memory/4372-131-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-125-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-107-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-134-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-124-0x000000006E600000-0x000000006E69D000-memory.dmp

Filesize
628KB

Download
memory/4372-112-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-116-0x0000000007B70000-0x00000000080F9000-memory.dmp

Filesize
5.5MB

Download
memory/4372-122-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-118-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-120-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-126-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download
memory/4372-117-0x00000000058B0000-0x0000000005A09000-memory.dmp

Filesize
1.3MB

Download
memory/4372-128-0x0000000008910000-0x0000000008E90000-memory.dmp

Filesize
5.5MB

Download