redline | 8b4acf13ad30350adabed9aa814134fe1065aaffeb04b2403b400986859dc19d

Analysis

max time kernel
64s
max time network
66s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03/08/2024, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SynapseBootstrapper.exe
Size

70.0MB
MD5

235974b1df44f0484d8210536dab5d41
SHA1

de52848ea0fedf2f7491e81147139a2d80fe4a6c
SHA256

8b4acf13ad30350adabed9aa814134fe1065aaffeb04b2403b400986859dc19d
SHA512

65202c05e5dd1a04ecdf04b1ec5be0743d26d28a3aa2f376bab057a7b7a253e872d7417b592d525227dd937f1d7541f4a7a2b35654a7b8398065b91484acc9b7
SSDEEP

24576:z9JdpJxPSmAs5RAEZXA9f0dna+oF7uQajj5yr0E:Dd5NT1Q9Kazubj5y4E

Score

10^/10

redline @dxrkl0rd credential_access discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

@dxrkl0rd

185.196.9.26:6302

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/232-67-0x0000000001200000-0x0000000001252000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2792 created 3360	2792	Statistical.pif	53

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 2 IoCs

pid	Process
2792	Statistical.pif
232	RegAsm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2748	tasklist.exe
4400	tasklist.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\CapturedNotes	SynapseBootstrapper.exe
File opened for modification	C:\Windows\TransClips	SynapseBootstrapper.exe
File opened for modification	C:\Windows\ScreenIllness	SynapseBootstrapper.exe
File opened for modification	C:\Windows\AlteredCheque	SynapseBootstrapper.exe
File opened for modification	C:\Windows\ViiiTwiki	SynapseBootstrapper.exe
File opened for modification	C:\Windows\KidneyDietary	SynapseBootstrapper.exe
File opened for modification	C:\Windows\MilfhunterWent	SynapseBootstrapper.exe
File opened for modification	C:\Windows\TanksCreations	SynapseBootstrapper.exe
File opened for modification	C:\Windows\ManagementHumanitarian	SynapseBootstrapper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Statistical.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynapseBootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\Registry\User\S-1-5-21-242286936-336880687-2152680090-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39050000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e00718000000000000000000000e1a40ed25739d211a40b0c50205241530000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "287309825"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1700	explorer.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
232	RegAsm.exe
232	RegAsm.exe
232	RegAsm.exe
232	RegAsm.exe
4824	taskmgr.exe
232	RegAsm.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	explorer.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	tasklist.exe
Token: SeDebugPrivilege	4400	tasklist.exe
Token: SeShutdownPrivilege	2796	control.exe
Token: SeCreatePagefilePrivilege	2796	control.exe
Token: SeDebugPrivilege	4824	taskmgr.exe
Token: SeSystemProfilePrivilege	4824	taskmgr.exe
Token: SeCreateGlobalPrivilege	4824	taskmgr.exe
Token: SeDebugPrivilege	232	RegAsm.exe
Token: 33	4824	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4824	taskmgr.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
1700	explorer.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
2792	Statistical.pif
2792	Statistical.pif
2792	Statistical.pif
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 2788	340	SynapseBootstrapper.exe	81
PID 340 wrote to memory of 2788	340	SynapseBootstrapper.exe	81
PID 340 wrote to memory of 2788	340	SynapseBootstrapper.exe	81
PID 2788 wrote to memory of 2748	2788	cmd.exe	83
PID 2788 wrote to memory of 2748	2788	cmd.exe	83
PID 2788 wrote to memory of 2748	2788	cmd.exe	83
PID 2788 wrote to memory of 1140	2788	cmd.exe	84
PID 2788 wrote to memory of 1140	2788	cmd.exe	84
PID 2788 wrote to memory of 1140	2788	cmd.exe	84
PID 2788 wrote to memory of 4400	2788	cmd.exe	86
PID 2788 wrote to memory of 4400	2788	cmd.exe	86
PID 2788 wrote to memory of 4400	2788	cmd.exe	86
PID 2788 wrote to memory of 4676	2788	cmd.exe	87
PID 2788 wrote to memory of 4676	2788	cmd.exe	87
PID 2788 wrote to memory of 4676	2788	cmd.exe	87
PID 2788 wrote to memory of 3136	2788	cmd.exe	88
PID 2788 wrote to memory of 3136	2788	cmd.exe	88
PID 2788 wrote to memory of 3136	2788	cmd.exe	88
PID 2788 wrote to memory of 2800	2788	cmd.exe	89
PID 2788 wrote to memory of 2800	2788	cmd.exe	89
PID 2788 wrote to memory of 2800	2788	cmd.exe	89
PID 2788 wrote to memory of 4724	2788	cmd.exe	90
PID 2788 wrote to memory of 4724	2788	cmd.exe	90
PID 2788 wrote to memory of 4724	2788	cmd.exe	90
PID 2788 wrote to memory of 2792	2788	cmd.exe	91
PID 2788 wrote to memory of 2792	2788	cmd.exe	91
PID 2788 wrote to memory of 2792	2788	cmd.exe	91
PID 2788 wrote to memory of 1428	2788	cmd.exe	92
PID 2788 wrote to memory of 1428	2788	cmd.exe	92
PID 2788 wrote to memory of 1428	2788	cmd.exe	92
PID 2792 wrote to memory of 232	2792	Statistical.pif	93
PID 2792 wrote to memory of 232	2792	Statistical.pif	93
PID 2792 wrote to memory of 232	2792	Statistical.pif	93
PID 2792 wrote to memory of 232	2792	Statistical.pif	93
PID 2792 wrote to memory of 232	2792	Statistical.pif	93
PID 1700 wrote to memory of 4824	1700	explorer.exe	98
PID 1700 wrote to memory of 4824	1700	explorer.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\SynapseBootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\SynapseBootstrapper.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Sector Sector.cmd & Sector.cmd & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2748
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1140
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4400
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe ekrn.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4676
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 240488
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "DefiningUtilitySophisticatedPartition" Louis
      4⤵
      System Location Discovery: System Language Discovery
      PID:2800
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Author + Blvd + Principles + Des + Legendary + Occurrence 240488\F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\240488\Statistical.pif
      Statistical.pif F
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2792
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:1428
- C:\Users\Admin\AppData\Local\Temp\240488\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\240488\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:232
- C:\Windows\system32\control.exe
  "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2796

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
aaa6272746adea4abf5c64237a29d5c0

SHA1
710e4968e92b2c5172f356d17a10862b1ab58165

SHA256
b774bfd7a8002e5c31f44f7ebd7d7c4977f42873417bf5c9941bd62d8a1d5f7e

SHA512
16c2f4b76289a7621d5ab92c932102e31f609a5dd514f49b7c2c4aa9f8f27b660fc7f983c5eca54e674bb468e27a840e0adf2efa7cee0b82bef97026c7d545b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\240488\F

Filesize
426KB

MD5
8e70a1163fc7edafde0f50ea1c60a45e

SHA1
68dead126d953b638b2390e21b25c0c9447c1d42

SHA256
f31c892c9ce23090d8463a424bbc8196754e9a8232167461c81b0414401d3a50

SHA512
cf1f958c38f67b763cccc3fb23b6a9dcf8c48e90c5d3048ce075b9c3aaf7e1a038a0a6fa49506c3c04143defa412c1c9fa52b68a0ab2e9b57aa97170fc2688b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\240488\RegAsm.exe

Filesize
63KB

MD5
42ab6e035df99a43dbb879c86b620b91

SHA1
c6e116569d17d8142dbb217b1f8bfa95bc148c38

SHA256
53195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b

SHA512
2e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\240488\Statistical.pif

Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aquatic

Filesize
41KB

MD5
9bdb4bdb710497ddf28c97efa7c1b9b4

SHA1
d7b1a6b3f59d10fc9f919504aee587cd00478e2b

SHA256
4582148400bbceda2ede955687ef07d3753c8095a25a7b339556d250a5ef9ed7

SHA512
44f0507b84ae42e80d999c652defe9bf8fec5f14dff967633366c9a3fda0fc86b54519b136ce0fba5bc068b37d7c171f56b5e25857a210e1bf51e0d6d7433074

Download Submit
C:\Users\Admin\AppData\Local\Temp\Armenia

Filesize
36KB

MD5
dc9130cbb98162ea55ea36d42d821a72

SHA1
11e40db099053d6bbf15ba6cb83f9f1382698446

SHA256
bb378589551d6afa688b2806505a35f6410d5d7f7785482ceb683638b36768c8

SHA512
647ab30f6d6a3b1bf86e63e0d9c10c9b3c9f5ea00533fe43ed5444a2dcad7f2d75b5bf0ef364e854868aff5aae15e964c1fc49b1fc5d87b12fc046402ac4a962

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ask

Filesize
52KB

MD5
50798cbcbda0e7ed01a8cf9b0e8af37a

SHA1
460a0e0dba446329ea72cfd30a63a257c7b32fd6

SHA256
cd75f8fd52ba942212bf9dcec1cf98019d6866ab7cad420bcdcdfa3de3b45d5d

SHA512
a9e38d11db64b27b462643ba21569bb7e7c42c1aac4609c5491928b974b58dbbb6977b0e7e8abc9ab0d91eeb88485f10bf078531ce4ffe9de3bae362ec3057c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Authentic

Filesize
11KB

MD5
eef0671ed0945e7068eed3c51cf3faca

SHA1
188f2f34b87130bbd89c3d3bcb41e6d8f3e7650a

SHA256
00e508a0e3d151dcc6296bc965d0b98153c5e641eadb84fee604c052820f12bb

SHA512
49060d6d38c85e4ba2ad6eeba21797b3fb69ef2a911c8c307b72774f069e06def358e560f31c4515f436356499cbe4611ed3af46baac82e2f9e2a0e9fc8bbf50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Author

Filesize
86KB

MD5
0a271ad6cc43f71a1d757773d6ec2d74

SHA1
156c3d8c0cae288ccec9b8545dde638b255ce046

SHA256
dc25ebaa7d54fe866ceaf7e2eae423f02a8df97954ca616f679249702c1c5429

SHA512
630b48af2604c3364164ac3f5b6f3e88efa84d0bc6c1957576de500636161fe637848cdb3aefbfceaa1e6a72749fde215fb6f96a85837edfb981fc08781fa7df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Blvd

Filesize
59KB

MD5
8195d63cd3fed768ff372461cc9da1f3

SHA1
50e134873c2889370cf8942df9ecc633962ef5c8

SHA256
9a1880c8eba68acfee0ffea6ccc55cbd5a13411821c77f81ba310f685607ece0

SHA512
d90c727478daf302caaf8649c9df297ca005fae6ca6e78fe520b58bb6c5018dd031cfc8abd9b63128150c9d6a246ab99ed7ab2f8c4907f40d100014760043445

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bringing

Filesize
56KB

MD5
39968fe59450761e3aeab7601b84656c

SHA1
6066f051fdbd101cd1179ad5ad9adcf28dafb906

SHA256
40fddc8fd3cab3814075d1caac1e7dc1113f4589266e805ca67f56f017c6c44d

SHA512
e5dbb0a3c09dfcf3679cd056c549a10501dd7d1460359a976daf0dfdf486250955e8e3a1815ac9bcbb09847bacb876c8d0d255e5b6721c48af982faa16d4a344

Download Submit
C:\Users\Admin\AppData\Local\Temp\Des

Filesize
64KB

MD5
9b57890c7315c6e04b6831a2556d2efb

SHA1
21c2438673fcc754087cd685faf2f899656cd9da

SHA256
064395d569cb2362fee3f6ebad52c70f456f60e04251092b25bc1b3588f9014d

SHA512
8507f549e7dfc6536d221521b8c424f2e81265f68d2d3c13c32f683c60451e7dac69ba9e8c7eea288880ebd5a859fce15eaa1716000422be3f3f1584372ccbd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Diff

Filesize
48KB

MD5
7859c0ea5e65d1fc52fc64132c03848c

SHA1
db5b6dd868ed16082e5bf52395992836ee05fa75

SHA256
8015e3dbd9c39bf4b0f773c95844a77fb52213a06ec24996d45608bf3c268881

SHA512
086791e33b90e04591b5b41bcf1b5722d2f17be46cc2cd93c97ee0d333ddded8c97049365b99432a3f243a4048df3a510c39d4753f94431d3d5a57e364f4ba9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hydrogen

Filesize
51KB

MD5
513f1801c0b5455886191627bf6efcb1

SHA1
ed0f4e7a375b6b386d334e80584619de497e3d94

SHA256
bd074649a4183530f8a983bb76e7e21266760efc8416d97f4176ff9522f164d3

SHA512
3dabe8ebff8a586da909ddd242cf351af3146c6a5f7e74ccf36f131641f792fc78f92d437192b1c2d56c9ca147265f77597dc68747a8b26ebb7130c052a91bd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Knight

Filesize
60KB

MD5
3fdc50901bcccd3700dda57b4ddfd746

SHA1
242345fffb9a1fac7631abf55f01b011ec284f80

SHA256
95a082605f4e1df3e67f16333347cc465bf5343a8e5896050f571342aa68fd3a

SHA512
1beadd1f12255c05757b2058960a07be9cb79c20bea1771eca55d689cbc8b810fc6b49835d7c94124522684b7ee596af04e62765e5b746971a62b972c2900e7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Legendary

Filesize
35KB

MD5
1bb6c2f5030e3802a3311640f340cade

SHA1
c1fed462ff27fcbca7e0b153026c2329a81dbd41

SHA256
68b8ad29a8658f60c5e0bb18ac043bf2b66db74e65c84875a124b6e3fe50b784

SHA512
122ad6fe98ffc526d6eb10f134f3937586dda00a9a5917507c859c59124d1c13601118e0af76b6bbbba93fe6fbfe481e093e3348ccaeb741e3b66a10f7c10469

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log

Filesize
64KB

MD5
414933bbc2dd6023cb82262b72f8a893

SHA1
0c1e3caa54a21b455f4d975811e18698dd81d5fe

SHA256
d9a9327b6cb87e0c193c5182e4de8641b1740eb8bd6b43ae0ec249ead9de06a8

SHA512
d83de6b2a9aa8685dcc2e6ac0605734014537840856e7470b0cf769f2cc5ca79bbe8ae12e0fac1c649af6f028abaacc6024bf5e26a2dcca4223760adaa8a1ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Louis

Filesize
143B

MD5
7e92d90ef19287ce0fa9b4cd24d80e1a

SHA1
a0b1f0eef02adb320dad818b2e1e81052c18d54e

SHA256
9fe63f8d2eff5839798772aa042d6f8f4491fb5f1e7132dac9673a921f6026f9

SHA512
0026697805ea19daeecbf6acdfb11bd1bbb2c194e07dfa2ae8569fd73ad1ff8811e67645b27074f30b16910a52c2ee6347baeb90aa1b573a26b1767eec7ef816

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mph

Filesize
61KB

MD5
3647eca55027dce3c13acd875794d212

SHA1
83bc84cfe95a57025958d27e0adf2c19a0449e4f

SHA256
e3276b522631eb538d2d5f908877bb834ac98917e938921b4a01274230189ef6

SHA512
f2a7b5f249096f71761829161a6b142b9b0e0117b419bb2608ce9485b0972d5519b3e946161cf4d5bd6a9dba73029b675018ca82a6b130e9a3254c9662a22c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nearly

Filesize
40KB

MD5
90490d4a9edc29e26b0891a7ad0f532a

SHA1
90cf736c30db3e8e29aaefa36df1ab5a14acc5c7

SHA256
fe297b02d7c4b80ca2fd401843e51b029dbc6f6ec69c7ef109e3b27ffe3f26dc

SHA512
90c5e9b1c233d0258b02a42d0282c94bd894cdd9736be62ebb62fd78ba6c1490abc8b7c855903efb48496d3001ec246482091d837b8c40778d37f629db63c15f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Occurrence

Filesize
21KB

MD5
a38dba351df1bfe8c16f7347cca11a79

SHA1
d369c0071838144c0652237faabcc8f3432c4232

SHA256
dfda5fdd8e8fca6c3fbf8f7bc8267b0551d4c96e9ac7fc5c2d55f4590f4a4612

SHA512
26ebea91c890541e8fb079a0a52779c9fc9cb871413ca1f232349950a10b88200b6624ac524326b7a36938cdad42f1a5caa88b251d19739f85ca8ce9176dbd55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pen

Filesize
16KB

MD5
3f370b903fb5cf7dedc2fdd274bb443a

SHA1
d680e5738bd7b9fdea301eacb1ec07a76767ef54

SHA256
24ee59dc4afcdef1546a8c1149ffac9470c0257c9ec4b37e397fcf1742ce30a0

SHA512
efe65d64461e4c0ca4e121ca31b42a860eb96a08086e41e22245d399561781991eace17310f060e4624d76120813fca10980a9b6be7e64e02d131d249fedb36e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pentium

Filesize
57KB

MD5
904434c8a49d5ea8433ed106444500b7

SHA1
97e3bf376c460c03fbf955b2e122bcc598725b97

SHA256
67fed69d699c7413e676d2c723a97f3f1f5ccd4909958b0ff99edf66f100a93b

SHA512
6130ee7516247ace44315e0b3b0df9024596c88a961c56b7a3fcf792887a08b76295465d44639104571d1f08fb77a55fffb2998e748dc7f6833ddff83965146e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Principles

Filesize
161KB

MD5
c011c0cd74b074134e8ad50805d7871e

SHA1
2ead375cfb5ee8389bb93572a08872ce98122fb6

SHA256
25c693475d6d5a97f4892c79efdc6428ed0dc5c869cca55f5f90cb077f4ca2d3

SHA512
dacb201191252bfce6ca5a1a65100702a7825153d20e0c4050e841fe2273cf992aeaa0afe0569d9b9e8755343d4111805ea6ea267a78c7d95b0bbc78f1443254

Download Submit
C:\Users\Admin\AppData\Local\Temp\Request

Filesize
13KB

MD5
597cf040680813b179485de3430ebfc9

SHA1
502dc09f05f3b9dab861ebfa7a75ebf73708e7ff

SHA256
6afa8f1cd0ad8d45ea1d66d9cf6e852647280c66baedc684aed61968b4a5d342

SHA512
0418ed186a1a7a6ae273b0a7d615367bbada327dbb9b34fb7abc8549d30a5fa087510486e536f796db9f8ad0c1ec25196fde1e976634ceb922ba93a2b21889ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Riding

Filesize
66KB

MD5
1d01c1f95fa0db2f6d16c8ada4e4fc22

SHA1
902d31dbfe2379bca0e79a4ba5ed9e61050191e2

SHA256
29729eaed9895adc76c35a78337c75a6c0ba440bcd4a9277737c88baea46b224

SHA512
c9283611a9e02cf08b8ad8b7f1af260c65568d09af4e188d0a195ce88271a80668dd7cdba1828983eaca6b20dec058b4ed021b169dbff4200ccdfac1e9c0d2f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rule

Filesize
43KB

MD5
ef4035d77f95a98bcc1e3f2a6341b484

SHA1
55acfc3a3de83303eed5323636df0a6c80345ed0

SHA256
5ef9766349f6ac472319d3e86d24760e9cd2ceef00058daed785a680748e3488

SHA512
54f9a7183835e8e7096a09e70c123323b42ba75451566f00b979569a0c0ec15705973c05086de69412f20f72d22fae291b474ca68e517576e2cc6450b5a104af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Schedule

Filesize
36KB

MD5
2de350e814c65c7aa4637e6985bfd763

SHA1
2ca33a2f74f2ab1df5178048988734b322515ad7

SHA256
dc714aa3504b5a4c2aaedf3018f6e06ff8630fda214399a054a3dea9af810c18

SHA512
4a79110876bf91961e58f718cf06add9cefb22aa1ac2152b37e3b9549bdfbdf297fdf42fa2aa87176fcff61262339a84956fa37647511e57bfce3a24582f80fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sector

Filesize
11KB

MD5
ebd72dd73b8b2bdfdb42c9b126485f82

SHA1
75718ac05533de5b888f56fafa9afa4e5d421cee

SHA256
26cd65b6145e7aca6e0d7e20ea73a6546d99705c2e26a506f26d2b1ad4823a3d

SHA512
4b70abb8d627f4d0054f27d7b9cb3e597e9b4846dbd468f55e4633ef398fe5a4a2fa58718ef356458b22665a3f3eabe1c1c1d264ef410a8bdda82adf60d4054e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Suggests

Filesize
27KB

MD5
6b278302965ee1cb27def0d3ac03dbae

SHA1
c5e68a391b0480e658c782c80c1384f83ae887e5

SHA256
b48a989ec58f876c7253b5c529dd279588100fad25e9a684c819945fd75066fe

SHA512
e3aea3ce587c0edf27202e40c2c4e1b9cd50f724413699e55934f95d0e11b2cf251036fde4657a16a749ae4f22deb41aec8cd3a398fee77b5e0057b17a319409

Download Submit
C:\Users\Admin\AppData\Local\Temp\Team

Filesize
27KB

MD5
6f3e7db1436f260a77178b505295ce8c

SHA1
92e57c72dd912c8cf27f423669bb3551e51f983c

SHA256
f25b89d86677425469980e4d027418b9ff8377a5fdaebfa1849c962bd5c7d9e9

SHA512
3d31eca30e466f0eac133e014fa70a82e488e66376fcf713113c93253c22513162f205eef92953d9772aa58d994845162e357d268a01533be6e913a7ae21c1c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp319A.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tracks

Filesize
57KB

MD5
dcbc96a774aed26059d0d33a7bb52fa7

SHA1
374d7a91eb31d7192e3d0f20be59557aad0b792d

SHA256
de27aa5cd36f304345af1c380cf42f5f6c4e48af512853a0dc90edd213824bc4

SHA512
3a860cd15e690337f5136c65d4560c10dff97cc0190eaddb534dfc76ab6c401d2c7d614287effa4e4ffb1dc919f2e1d27ebd8188b856f4d573f595d31b08d9d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\William

Filesize
62KB

MD5
f91596d169fc88a8b99c0e0a972b721b

SHA1
f79f338c69c38a3efa2d7b96aad98a8fb12b0865

SHA256
5379bd041a0bd26be380a8222c1eab5423ae7ce11ca221eb17bb109f90e4e894

SHA512
4c3c6f28fcb9e486fd8d908b28a2e4888868757a1eaa9d5e62b7c8b3e9506db4193ae9dd6dbd23a10a13f75ecefcde6073316bd705b7dfc6e9738e01af9512b0

Download Submit
memory/232-94-0x0000000006C00000-0x0000000006C3C000-memory.dmp

Filesize
240KB

Download
memory/232-93-0x0000000006BA0000-0x0000000006BB2000-memory.dmp

Filesize
72KB

Download
memory/232-71-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/232-87-0x0000000005DE0000-0x0000000005E56000-memory.dmp

Filesize
472KB

Download
memory/232-88-0x00000000069D0000-0x00000000069EE000-memory.dmp

Filesize
120KB

Download
memory/232-91-0x0000000007110000-0x0000000007728000-memory.dmp

Filesize
6.1MB

Download
memory/232-92-0x0000000006C60000-0x0000000006D6A000-memory.dmp

Filesize
1.0MB

Download
memory/232-113-0x0000000007B00000-0x0000000007CC2000-memory.dmp

Filesize
1.8MB

Download
memory/232-70-0x0000000005E90000-0x0000000006436000-memory.dmp

Filesize
5.6MB

Download
memory/232-95-0x0000000006D70000-0x0000000006DBC000-memory.dmp

Filesize
304KB

Download
memory/232-96-0x0000000006EC0000-0x0000000006F26000-memory.dmp

Filesize
408KB

Download
memory/232-67-0x0000000001200000-0x0000000001252000-memory.dmp

Filesize
328KB

Download
memory/232-115-0x0000000007FD0000-0x0000000008020000-memory.dmp

Filesize
320KB

Download
memory/232-72-0x00000000057E0000-0x00000000057EA000-memory.dmp

Filesize
40KB

Download
memory/232-114-0x0000000008200000-0x000000000872C000-memory.dmp

Filesize
5.2MB

Download
memory/4824-101-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-108-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-112-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-111-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-110-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-109-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-107-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-106-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-100-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download
memory/4824-102-0x000001947E1A0000-0x000001947E1A1000-memory.dmp

Filesize
4KB

Download