30580d9e753a4b7ddd780dde9cb8d6158ddd2f6a9dc9874838478b68a5432349

Analysis

user interaction
yes
max time kernel
319s
max time network
320s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ACME_Corp.exe
Size 67.2MB
Sample260707-ejenksev6n
SHA256 30580d9e753a4b7ddd780dde9cb8d6158ddd2f6a9dc9874838478b68a5432349
MD5 8e2b8943e6a6a40af6c8c547c440d9b3
SHA1 3406932dc784ad48ebb704ca48785794dd793028
SHA512 8bb8d3d0b5230eaaebc40fad62e8bf8975ea9cbfac2ddc7295681bd55287f5a9ae63142c6c118b8d35150708a9dca19f9cd0acb692e29b37005c832b9d09f272
SSDEEP 393216:5mHNzQa2wWuq+7QJuGh8OsP89OFlZiiYdYG5zglb/vG5L5OtsFtoNTaUYd44/J8D:c2wL+j8Oa89TsG5YWV5OtsFGtatWD
TLSH
T138F79E11A7E80B06D73FC27CC5639252E7B1B4531351C6CF0498EA993F53BE1AA362B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2608	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
7	1984	ACME_Corp.exe
9	4820	3ClickAgent.exe
16	1984	ACME_Corp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	ACME_Corp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	ACME_Corp.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4820	3ClickAgent.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACME_Corp.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Program Files\\3ClickAgent\\3ClickAgent.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Program Files\\3ClickAgent\\3ClickAgent.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACME_Corp.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACME_Corp.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACME_Corp.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACME_Corp.exe"	reg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\3ClickAgent\3ClickAgent.exe	ACME_Corp.exe
File opened for modification	C:\Program Files\3ClickAgent\3ClickAgent.exe	ACME_Corp.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4156	sc.exe
2084	sc.exe
768	sc.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	3ClickAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe

Modifies registry key 1 TTPs 8 IoCs

Modify Registry

T1112

pid	Process
3804	reg.exe
3140	reg.exe
2000	reg.exe
720	reg.exe
1144	reg.exe
4664	reg.exe
4336	reg.exe
1464	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2608	powershell.exe
2608	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	ACME_Corp.exe
Token: SeDebugPrivilege	4820	3ClickAgent.exe
Token: SeDebugPrivilege	2012	ACME_Corp.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeShutdownPrivilege	1976	LogonUI.exe
Token: SeCreatePagefilePrivilege	1976	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	LogonUI.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4664	1984	ACME_Corp.exe	88
PID 1984 wrote to memory of 4336	1984	ACME_Corp.exe	90
PID 1984 wrote to memory of 3652	1984	ACME_Corp.exe	92
PID 1984 wrote to memory of 4156	1984	ACME_Corp.exe	94
PID 1984 wrote to memory of 2084	1984	ACME_Corp.exe	96
PID 1984 wrote to memory of 768	1984	ACME_Corp.exe	98
PID 1984 wrote to memory of 1464	1984	ACME_Corp.exe	108
PID 2012 wrote to memory of 2432	2012	ACME_Corp.exe	115
PID 2432 wrote to memory of 3804	2432	cmd.exe	117
PID 2012 wrote to memory of 3140	2012	ACME_Corp.exe	119
PID 1984 wrote to memory of 2608	1984	ACME_Corp.exe	121
PID 2012 wrote to memory of 2924	2012	ACME_Corp.exe	123
PID 2924 wrote to memory of 2336	2924	cmd.exe	125
PID 1984 wrote to memory of 2000	1984	ACME_Corp.exe	127
PID 2012 wrote to memory of 720	2012	ACME_Corp.exe	129
PID 1984 wrote to memory of 1144	1984	ACME_Corp.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe
"C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SYSTEM32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Program Files\3ClickAgent\3ClickAgent.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4664
- C:\Windows\SYSTEM32\reg.exe
  "reg" add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Program Files\3ClickAgent\3ClickAgent.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4336
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "3ClickAgent" /tr "C:\Program Files\3ClickAgent\3ClickAgent.exe" /sc ONLOGON /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3652
- C:\Windows\SYSTEM32\sc.exe
  "sc" create 3ClickAgent binPath= "C:\Program Files\3ClickAgent\3ClickAgent.exe" start= auto DisplayName= "3Click RMM Agent"
  2⤵
  - Launches sc.exe
  PID:4156
- C:\Windows\SYSTEM32\sc.exe
  "sc" description 3ClickAgent "3Click RMM monitoring agent"
  2⤵
  - Launches sc.exe
  PID:2084
- C:\Windows\SYSTEM32\sc.exe
  "sc" start 3ClickAgent
  2⤵
  - Launches sc.exe
  PID:768
- C:\Windows\SYSTEM32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms;$f=New-Object System.Windows.Forms.Form;$f.BackColor=[System.Drawing.Color]::Black;$f.FormBorderStyle='None';$f.TopMost=$true;$f.WindowState='Maximized';$f.ShowInTaskbar=$false;$f.Cursor=[System.Windows.Forms.Cursors]::Default;[void]$f.ShowDialog()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\SYSTEM32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2000
- C:\Windows\SYSTEM32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1144

C:\Program Files\3ClickAgent\3ClickAgent.exe
"C:\Program Files\3ClickAgent\3ClickAgent.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe
C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent
    3⤵
    - Modifies registry key
    PID:3804
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3140
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rundll32.exe user32.dll,LockWorkStation
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\rundll32.exe
    rundll32.exe user32.dll,LockWorkStation
    3⤵
    PID:2336
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ACME_Corp.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:720

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3961055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.id

Path C:\ProgramData\3ClickAgent\agent.id
Size 36B
SHA256 f4e03487a6bd548f45d7de4032f2fa2d91901957b282eb60cca32a8825722312
MD5 b712cdc42ee662063536acae2c142236
SHA1 9435e0d86146421350a129b207eaa22195d93f37
SHA512 7694492e11cf2cd562036bce529d47f265395af7da75817f73191f8c940c81fb3672a6f5f84bf2e9e522f7cd53640ec4984ce954269a27732084568d1fef7340
MD5 SHA1 SHA512

Submit Download

updating.lock

Path C:\Users\Admin\AppData\Local\Temp\3ClickUpdate\updating.lock
Size 28B
SHA256 291fe2808d9d19f706af5d45b8bd58897ae29a14a80cce84cfd22a70bafe525e
MD5 af5c756591ef4d41a2c7300809af5383
SHA1 d37f13f724ddced1684cb0d3b8c923029495ae90
SHA512 af2f59441e291a945924b981db5b53d4d2592843869a47b10463563c1430220ce37686d7fe0ea60de58be6cde4f7adf48685bb418e086a7a035c6072a5e8df25
MD5 SHA1 SHA512

Submit Download

updating.lock

Path C:\Users\Admin\AppData\Local\Temp\3ClickUpdate\updating.lock
Size 28B
SHA256 33733cf8dae4e65f0ab8264f312cb4c9cc1fff0cc48f2c8108a1b7b89a3822e2
MD5 31d0741585fb5023ab822781aa7f5c01
SHA1 4f92a4a9a17c6e918084a1e4d44d343f79889786
SHA512 8975e988a3408b1eae6aebf26a49cab425741963151a89d3f6a95e746693b7f6fc5edeca52057fca7f4600cf31f2725e78b0f87e9f66978fd3e42271e7ae8ceb
MD5 SHA1 SHA512

Submit Download

updating.lock

Path C:\Users\Admin\AppData\Local\Temp\3ClickUpdate\updating.lock
Size 28B
SHA256 199e38b26a3fe4b7e65870618b7218a8cdfcb53e735ea26cd0201fecde8d52ff
MD5 f1bcda67d048c93b70bb2efadcef955a
SHA1 cf548c74f8702e132bd24fa398089207d394d22c
SHA512 ca10d7fbf6ea9540f23eeeebdb405cd8798aaaa7e7965f20180071a18ba13f94f4725175430b37738c324f39ef13dfe640fe331e9dd25befa80ae8fa58360597
MD5 SHA1 SHA512

Submit Download

updating.lock

Path C:\Users\Admin\AppData\Local\Temp\3ClickUpdate\updating.lock
Size 28B
SHA256 3acad8b4c80f507419f74ad0da75005919ecc4f11901131de8ce6d88c874b789
MD5 0c2a1908f5e64567957dd972335ce035
SHA1 dedb99145612a431149634f9891c27691d7ccaf5
SHA512 75b334fc721d0ed1f72ad7063fecbdcec7bda624f105c47a6a87cec708153d924aa99ffcd395e8e7861ded2b92b1db102a3996782a3b5e61b7ed9c8073fd2298
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1hqlk4x0.mcr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1hqlk4x0.mcr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1976-19-0x00000272EBED0000-0x00000272EBF66000-memory.dmp

Download

memory/1976-20-0x00000272EBED0000-0x00000272EBF66000-memory.dmp

Download

memory/1976-24-0x00000272EBED0000-0x00000272EBF66000-memory.dmp

Download

memory/2608-15-0x0000028D5F5C0000-0x0000028D5F5E2000-memory.dmp

Download