Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 09:43

General

  • Target

    a1a334aa5fd2ba1b468b2fac316ffd7ffbf5708dfa85f966689fe43bc18602e3.exe

  • Size

    948KB

  • MD5

    b31e94b9aa3fc572228587333b83ebfe

  • SHA1

    59996644977220b310542daa6163115505aa8c59

  • SHA256

    a1a334aa5fd2ba1b468b2fac316ffd7ffbf5708dfa85f966689fe43bc18602e3

  • SHA512

    7d5a8f844d0e048af811c26d3e13ecaa674206da041378181d482e6e673da739f7facd98eba545a0ddf73953d57010e678515010e5a96adc00c5858d80c1b6bb

  • SSDEEP

    24576:eYE1uJu2UOgZNYZmFhCzc3a2YZY6YixjoJx:tXDUI8mqa2YZjxMJx

Malware Config

Extracted

Family

remcos

Botnet

Document

C2

45.138.48.25:3333

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    WinUpdate.exe

  • copy_folder

    WinUpdate

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %Temp%

  • keylog_crypt

    false

  • keylog_file

    WinUpdat.dat

  • keylog_flag

    false

  • keylog_folder

    WinUpdat

  • mouse_option

    false

  • mutex

    Rmc-E10MWO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • Hawkeye family
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1a334aa5fd2ba1b468b2fac316ffd7ffbf5708dfa85f966689fe43bc18602e3.exe
    "C:\Users\Admin\AppData\Local\Temp\a1a334aa5fd2ba1b468b2fac316ffd7ffbf5708dfa85f966689fe43bc18602e3.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a1a334aa5fd2ba1b468b2fac316ffd7ffbf5708dfa85f966689fe43bc18602e3.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3292
    • C:\Users\Admin\AppData\Local\Temp\a1a334aa5fd2ba1b468b2fac316ffd7ffbf5708dfa85f966689fe43bc18602e3.exe
      "C:\Users\Admin\AppData\Local\Temp\a1a334aa5fd2ba1b468b2fac316ffd7ffbf5708dfa85f966689fe43bc18602e3.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4420
      • C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe
        "C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4712
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:2616
        • C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe
          "C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe"
          4⤵
          • Executes dropped EXE
          PID:4312
        • C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe
          "C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Program Files\Google\Chrome\Application\Chrome.exe
            --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
            5⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4732
            • C:\Program Files\Google\Chrome\Application\Chrome.exe
              "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd8e8dcc40,0x7ffd8e8dcc4c,0x7ffd8e8dcc58
              6⤵
                PID:3440
              • C:\Program Files\Google\Chrome\Application\Chrome.exe
                "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,15930913074198093216,13499231459140243350,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1932 /prefetch:2
                6⤵
                  PID:4344
                • C:\Program Files\Google\Chrome\Application\Chrome.exe
                  "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,15930913074198093216,13499231459140243350,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:3
                  6⤵
                    PID:3904
                  • C:\Program Files\Google\Chrome\Application\Chrome.exe
                    "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,15930913074198093216,13499231459140243350,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2232 /prefetch:8
                    6⤵
                      PID:4516
                    • C:\Program Files\Google\Chrome\Application\Chrome.exe
                      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,15930913074198093216,13499231459140243350,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
                      6⤵
                      • Uses browser remote debugging
                      PID:1588
                    • C:\Program Files\Google\Chrome\Application\Chrome.exe
                      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,15930913074198093216,13499231459140243350,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:1
                      6⤵
                      • Uses browser remote debugging
                      PID:2248
                    • C:\Program Files\Google\Chrome\Application\Chrome.exe
                      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4616,i,15930913074198093216,13499231459140243350,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4636 /prefetch:1
                      6⤵
                      • Uses browser remote debugging
                      PID:3212
                  • C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe
                    C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe /stext "C:\Users\Admin\AppData\Local\Temp\prjwzcp"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3928
                  • C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe
                    C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe /stext "C:\Users\Admin\AppData\Local\Temp\alxgavazxr"
                    5⤵
                    • Executes dropped EXE
                    • Accesses Microsoft Outlook accounts
                    • System Location Discovery: System Language Discovery
                    PID:2376
                  • C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe
                    C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe /stext "C:\Users\Admin\AppData\Local\Temp\knczbnlslzhmqd"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:592
                  • C:\Windows\SysWOW64\dxdiag.exe
                    "C:\Windows\System32\dxdiag.exe" /t C:\Users\Admin\AppData\Local\Temp\sysinfo.txt
                    5⤵
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:912
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\enbfaiwukcfhbtd.vbs"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2116
          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
            1⤵
              PID:316

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

              Filesize

              16B

              MD5

              46295cac801e5d4857d09837238a6394

              SHA1

              44e0fa1b517dbf802b18faf0785eeea6ac51594b

              SHA256

              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

              SHA512

              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

              Filesize

              41B

              MD5

              5af87dfd673ba2115e2fcf5cfdb727ab

              SHA1

              d5b5bbf396dc291274584ef71f444f420b6056f1

              SHA256

              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

              SHA512

              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

              Filesize

              20KB

              MD5

              066a537b995fe292f153bf37fa7386f2

              SHA1

              c63888164ad71f8b619d22bffb3348d7d4f386ee

              SHA256

              4c0eb0dbe16a4ed706ca649c8e220fda74472fd5275cdbd2fab2bcf17eb34a89

              SHA512

              3c68949672b34ef560518721e034883758ac2248bbb1fcd390477494cb4b319d709a8bcad1376428f8d96736c3406677a10512eb59ec804f8ee0970fe3780c08

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Network Persistent State

              Filesize

              696B

              MD5

              d46d5053c9275a36b498505f29eb64ab

              SHA1

              8613fb601e2742a8f9e6c5202c9050a0d62a6968

              SHA256

              60bd1eb9ab508bc4a5c5267ecaf81a39c1ab0374faa410d4e954aff2e97cab50

              SHA512

              640a2db442490ab2d58dd31ce5ca7952688bbd8adc267b62c92b0645a0d8559ee8f23f6a5243827e6f29d24178df2d28db14825aad7db15c6c45f089807b8bee

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Network Persistent State~RFe593723.TMP

              Filesize

              59B

              MD5

              2800881c775077e1c4b6e06bf4676de4

              SHA1

              2873631068c8b3b9495638c865915be822442c8b

              SHA256

              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

              SHA512

              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

              Filesize

              2B

              MD5

              d751713988987e9331980363e24189ce

              SHA1

              97d170e1550eee4afc0af065b78cda302a97674c

              SHA256

              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

              SHA512

              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

              Filesize

              6KB

              MD5

              107b6aa4e373c45023eba98f184e2e2a

              SHA1

              0ef56468d84c04bcfea2a7621801fb2e2d936bb8

              SHA256

              687af32b7f2784f8ab5ed3c474e1fa0cc6aa3218b9ce2865abae88ec7889d3d8

              SHA512

              de5246f8e6b42694c73aa42deb995f8a191990608cdfafec51de623ca5f502e038f37d2697244baca29ed4e4195900d30b6c191743a74ad0cb3177690f75f8c4

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

              Filesize

              6KB

              MD5

              46c87eeacffba217fee7f1604985fc5f

              SHA1

              f246e933de83508ebdf74db63955cdbd7c2d6f51

              SHA256

              7165ba9a208f660d9fc4a2d95c7b1d14fcf775dcc55a4a44331af00dba932d50

              SHA512

              5ebdde08f498bbf01dd95a705f4172be45413c0d8edee94d9bd4d7a3c187e8b9da9343e62851637d2a69d99c39e218d2e517aa9b5f9f44d8c1a0d7dbf4d5e4e5

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

              Filesize

              6KB

              MD5

              29fc325c62def534490b77cec297b371

              SHA1

              746056b7b82ee28391a64ac667bbead382c252f6

              SHA256

              7ccdc9e87f7295a92468bf3875dc3f7c2b62ba3e311b50ae3169634050def4fa

              SHA512

              0c9bc1d1bda5514d0280d593f08b41a9db285bcd17663a3ed0eaa428a4e0a06b2b75a4c281000724e05afaf167b0f34b7dec068fb98c6ac2c8aa4b2f6d1c6436

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

              Filesize

              6KB

              MD5

              d3111e2e7464bfc7bcd6b70a56ee8bb5

              SHA1

              d3f0684264679efe28a064e070e60b940a158047

              SHA256

              616f38fe70ede57816ffb6d8dd2cbdc59aa32a262b981e50b5dca86e7651a444

              SHA512

              fe1294ac8b5481de91bf725c8b856279ce1e3bb93a75c45fee020c20e8243910f023481d0d2436cfc9ef3cad8f36f0fa0f62a51ef0d726dc74dd9c1555ca3639

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

              Filesize

              6KB

              MD5

              6aa9a1e0aa8d852299285a1964f6b792

              SHA1

              9cc6e6a10e81276e748213641ca0d860e7b3095d

              SHA256

              849d537e97e47d7cd070c9e78f8eb6638cb7e0c75c7103cb9027691636077c4e

              SHA512

              64be68c3c24e5e47d0073c310cb92d2f778073fdef5c98e7c9ce28ed93aba3918ed957ef7258a3eaeba5bbbcb64d3dd4e3212cfd8320f41d2b9b75eec371f559

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

              Filesize

              6KB

              MD5

              31fefe4021ad3351fd864efa78f15c43

              SHA1

              c5ae7733ba6e72ee104937c605bdd659ac4d6311

              SHA256

              0706c000b13983f371622c03f0c3c9e40115739caa7331ddc2c07e0457fa9ec9

              SHA512

              e6392c6f744a10a44fe825e10adb2dbbdac951ec3c17cb4b4cd91aa6f40cf04517a08b5e7fcdfea97dd985f8b13c189260c3714c269d9ae8935f90ceb5bddaa0

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

              Filesize

              6KB

              MD5

              9748c8b9a5b63a68e1c22f80c8c984e0

              SHA1

              b1d62541e230a2314a39ade6a5eb40faf68ac51c

              SHA256

              fca8983c492d35081e0c866debcd9e00be3d76a010fc49e90c81402ea23f5229

              SHA512

              80c186de514c2dce2ef0aeccfce01e4f8c656bd77e3c94e56f4ffaf99d3350c74f8eb0d197485cd98fde92856722285665c806880efb37171f91aa838025b89f

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences~RFe5844f3.TMP

              Filesize

              1KB

              MD5

              a862864d10313a857f7f781ce1257f8d

              SHA1

              4ff234d2f84c5cc7f55ab4f88dfc4674a243351d

              SHA256

              3e2648a231880f6dbd989f6f17cb739d833ba2563ce85869873d29e568cb8ba2

              SHA512

              f7c8e1df09230c9d6cbbd8fe007bf458b0e13bbe8d7f7785a8f006bbd00aacdf253640e15be34ec2e35b2a7a649b9e440db0c70e2871db9cde7759974fb7235d

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

              Filesize

              15KB

              MD5

              3500c39cafef8c42e21c0eed0068acf0

              SHA1

              4acab10148c3cd8644497fb1e2671609db926832

              SHA256

              9b3cd3d94f1d2f873464301319e4dca3d34f7c549b3cd9ab868470202d1574d5

              SHA512

              a7b49f1755b5161a693d7ff4413469b684043ea236d225698838713bdb20b0fe8fc557c2500e1b7d0fde02bf945d356a636a2c0fff7097acf50246abec32f092

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

              Filesize

              15KB

              MD5

              c32b0404d793d286be948a96b0eed2e0

              SHA1

              839f5e5e1b17fb8dabaf36b227795bd98bf95236

              SHA256

              2776be61f7010e203994ad241f62c847c124fef80be9137568cb07cee5350b2a

              SHA512

              bfb68c248806a908463009242b2c5c4ac539b04f59e9f3581c45c94356b11cf935e96a59548107a32d0412eb54dc0d8757640f4e0f9d9ac53e856363dfa10c26

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

              Filesize

              8KB

              MD5

              cf89d16bb9107c631daabf0c0ee58efb

              SHA1

              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

              SHA256

              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

              SHA512

              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

              Filesize

              264KB

              MD5

              d0d388f3865d0523e451d6ba0be34cc4

              SHA1

              8571c6a52aacc2747c048e3419e5657b74612995

              SHA256

              902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

              SHA512

              376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

              Filesize

              8KB

              MD5

              0962291d6d367570bee5454721c17e11

              SHA1

              59d10a893ef321a706a9255176761366115bedcb

              SHA256

              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

              SHA512

              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

              Filesize

              8KB

              MD5

              41876349cb12d6db992f1309f22df3f0

              SHA1

              5cf26b3420fc0302cd0a71e8d029739b8765be27

              SHA256

              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

              SHA512

              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

              Filesize

              116KB

              MD5

              27aac866aae491aa89a5ab9132919c62

              SHA1

              554fdcf54f2e31c858c49585e8d9c436ba17a307

              SHA256

              8a079893d7397aa7030e65147a37c0b43e3dbbda722ba6b8167fc61796454821

              SHA512

              7fe6670a000e54ea137486c28d1987893da180a3382daa837e8f988120602a5ad584ce26f66727480f4ca305167a62fe5f524dd8db3e2be4fa6ee044dbcbc4c0

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

              Filesize

              116KB

              MD5

              9a30f7d3f4c08801c041711c56907e5a

              SHA1

              1ff1f6cb8ba8c4fab287a02fa04719556865f920

              SHA256

              521b5e17b93aaa46c35011e31bfc25e2d8d26babaa1064c377793b9d93d6b6e5

              SHA512

              5cd521e155c20cb6f43be79a214878d682e17d2e11f2a18d3b6b77d818af3b29b8f8133d4e51f410018bcf729f2d55ce84e561b1b08cce874d343200723212cd

            • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

              Filesize

              116KB

              MD5

              ccfc0a00a81abc5e4640160307b49ed6

              SHA1

              25ad74d6933ab9e7b0d60e8d7ce43b3cf340c1f8

              SHA256

              bd7d81f5385bef0a01701e445c953ff3e94debf9e226f14877313dd29a2ad3da

              SHA512

              c286685d76f297b92d3d33d67acc0226db274136e0508d774308f07c9bb4b3d9982b7cdb09608c91a1addbb9e03ad8d35004f8691df5de9e17be70635a70f5eb

            • C:\Users\Admin\AppData\Local\Temp\WinUpdate\WinUpdate.exe

              Filesize

              948KB

              MD5

              b31e94b9aa3fc572228587333b83ebfe

              SHA1

              59996644977220b310542daa6163115505aa8c59

              SHA256

              a1a334aa5fd2ba1b468b2fac316ffd7ffbf5708dfa85f966689fe43bc18602e3

              SHA512

              7d5a8f844d0e048af811c26d3e13ecaa674206da041378181d482e6e673da739f7facd98eba545a0ddf73953d57010e678515010e5a96adc00c5858d80c1b6bb

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_po41bjry.gpl.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\enbfaiwukcfhbtd.vbs

              Filesize

              674B

              MD5

              74399a9b0a4d00953173e483cef18815

              SHA1

              0cba8e841f70a6a4e7797ff2403121bb25c26612

              SHA256

              6d92b2898cba9b5ccb696b657435483b9bb49f4f375454e761d2c7c8cc32bbca

              SHA512

              6031454fc82293295fee54f4a46d250d4d63900a78487f49b83d7a6467d259547a1659741c217d63076b71fd837256e61dc24acfd7104426ce316b962c2d971d

            • C:\Users\Admin\AppData\Local\Temp\prjwzcp

              Filesize

              4KB

              MD5

              79f35c7500a5cc739c1974804710441f

              SHA1

              24fdf1fa45049fc1a83925c45357bc3058bad060

              SHA256

              897101ed9da25ab0f10e8ad1aeb8dabc3282ccfdb6d3171dbac758117b8731f4

              SHA512

              03281e8abecff4e7d1f563596a4fd2513e016b7fbf011a455141460f9448d00b4a4666d2036cb448a8ac9a6feebeb51b366289ffa2ee5524a062fe8869aec61e

            • C:\Users\Admin\AppData\Local\Temp\sysinfo.txt

              Filesize

              84KB

              MD5

              f7a599fd2c3f19ef038e0b136169c783

              SHA1

              f8f21cd79f96ff8728aa801e899859f622e87c53

              SHA256

              6cdc2b412518025867eb07c0e9139e3a000f1d88920a87f32af581831b45f096

              SHA512

              22f5a6f7244354243a52d0cfc6a680fb3a7d392694d32089a41200bb0c24c4952e1acb67590bc319ad4be5513b394dac383dfb4b267a723dd642da82e1f6d33e

            • memory/592-116-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/592-115-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/592-110-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/912-259-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-257-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-256-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-255-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-258-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-253-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-248-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-254-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-247-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/912-249-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/2376-103-0x0000000000400000-0x0000000000462000-memory.dmp

              Filesize

              392KB

            • memory/2376-105-0x0000000000400000-0x0000000000462000-memory.dmp

              Filesize

              392KB

            • memory/2376-107-0x0000000000400000-0x0000000000462000-memory.dmp

              Filesize

              392KB

            • memory/3292-47-0x00000000063D0000-0x00000000063EE000-memory.dmp

              Filesize

              120KB

            • memory/3292-63-0x0000000007720000-0x000000000773A000-memory.dmp

              Filesize

              104KB

            • memory/3292-61-0x00000000073F0000-0x0000000007493000-memory.dmp

              Filesize

              652KB

            • memory/3292-49-0x00000000069B0000-0x00000000069E2000-memory.dmp

              Filesize

              200KB

            • memory/3292-60-0x00000000073D0000-0x00000000073EE000-memory.dmp

              Filesize

              120KB

            • memory/3292-48-0x0000000006420000-0x000000000646C000-memory.dmp

              Filesize

              304KB

            • memory/3292-46-0x0000000005E10000-0x0000000006164000-memory.dmp

              Filesize

              3.3MB

            • memory/3292-36-0x0000000005DA0000-0x0000000005E06000-memory.dmp

              Filesize

              408KB

            • memory/3292-62-0x0000000007D60000-0x00000000083DA000-memory.dmp

              Filesize

              6.5MB

            • memory/3292-50-0x0000000070C10000-0x0000000070C5C000-memory.dmp

              Filesize

              304KB

            • memory/3292-35-0x0000000005D30000-0x0000000005D96000-memory.dmp

              Filesize

              408KB

            • memory/3292-64-0x0000000007790000-0x000000000779A000-memory.dmp

              Filesize

              40KB

            • memory/3292-34-0x0000000005B90000-0x0000000005BB2000-memory.dmp

              Filesize

              136KB

            • memory/3292-19-0x0000000002B00000-0x0000000002B36000-memory.dmp

              Filesize

              216KB

            • memory/3292-18-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

              Filesize

              4KB

            • memory/3292-73-0x0000000074EA0000-0x0000000075650000-memory.dmp

              Filesize

              7.7MB

            • memory/3292-27-0x0000000074EA0000-0x0000000075650000-memory.dmp

              Filesize

              7.7MB

            • memory/3292-29-0x00000000054E0000-0x0000000005B08000-memory.dmp

              Filesize

              6.2MB

            • memory/3292-68-0x0000000007960000-0x0000000007974000-memory.dmp

              Filesize

              80KB

            • memory/3292-70-0x0000000007A40000-0x0000000007A48000-memory.dmp

              Filesize

              32KB

            • memory/3292-69-0x0000000007A60000-0x0000000007A7A000-memory.dmp

              Filesize

              104KB

            • memory/3292-67-0x0000000007950000-0x000000000795E000-memory.dmp

              Filesize

              56KB

            • memory/3292-32-0x0000000074EA0000-0x0000000075650000-memory.dmp

              Filesize

              7.7MB

            • memory/3292-66-0x0000000007920000-0x0000000007931000-memory.dmp

              Filesize

              68KB

            • memory/3292-65-0x00000000079A0000-0x0000000007A36000-memory.dmp

              Filesize

              600KB

            • memory/3724-17-0x0000000074E90000-0x0000000075640000-memory.dmp

              Filesize

              7.7MB

            • memory/3724-10-0x0000000006550000-0x0000000006612000-memory.dmp

              Filesize

              776KB

            • memory/3724-9-0x0000000074E90000-0x0000000075640000-memory.dmp

              Filesize

              7.7MB

            • memory/3724-8-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

              Filesize

              4KB

            • memory/3724-7-0x0000000005280000-0x0000000005298000-memory.dmp

              Filesize

              96KB

            • memory/3724-6-0x00000000050C0000-0x000000000515C000-memory.dmp

              Filesize

              624KB

            • memory/3724-4-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

              Filesize

              40KB

            • memory/3724-0-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

              Filesize

              4KB

            • memory/3724-5-0x0000000074E90000-0x0000000075640000-memory.dmp

              Filesize

              7.7MB

            • memory/3724-3-0x0000000004E20000-0x0000000004EB2000-memory.dmp

              Filesize

              584KB

            • memory/3724-2-0x0000000005330000-0x00000000058D4000-memory.dmp

              Filesize

              5.6MB

            • memory/3724-1-0x00000000002E0000-0x00000000003D4000-memory.dmp

              Filesize

              976KB

            • memory/3928-108-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/3928-106-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/3928-101-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/4356-83-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-85-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-172-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-157-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-154-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-146-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-143-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-179-0x0000000005DD0000-0x0000000005DE9000-memory.dmp

              Filesize

              100KB

            • memory/4356-182-0x0000000005DD0000-0x0000000005DE9000-memory.dmp

              Filesize

              100KB

            • memory/4356-77-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-118-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-79-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-82-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-183-0x0000000005DD0000-0x0000000005DE9000-memory.dmp

              Filesize

              100KB

            • memory/4356-91-0x0000000010000000-0x0000000010034000-memory.dmp

              Filesize

              208KB

            • memory/4356-84-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-184-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-86-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-87-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-95-0x0000000010000000-0x0000000010034000-memory.dmp

              Filesize

              208KB

            • memory/4356-94-0x0000000010000000-0x0000000010034000-memory.dmp

              Filesize

              208KB

            • memory/4356-90-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4356-88-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4420-11-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4420-12-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4420-13-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4420-16-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB

            • memory/4420-31-0x0000000000400000-0x000000000047F000-memory.dmp

              Filesize

              508KB