redline | 95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874

Analysis

max time kernel
145s
max time network
111s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15-08-2024 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe
Size

1.1MB
MD5

bbe6311c3e2fab459f729dc8cd6e3519
SHA1

b71993aafd6627e55657819826c67f64f764c77f
SHA256

95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874
SHA512

33fb4936db966d0f285a48b09700716eadcdc19212c3e234f34dc0e497e55f01f493956aa86de438a3c65ba8e112d6ee1f3cd0ff9aee3cda1f686cc68dc77a47
SSDEEP

24576:HzZyi0Kg1ySDKr8TP/4xDVMRy5MxcTCLA8dUtp+FPlDha1edx/M2:H0iTezbe9jp+FPlEoHR

Score

10^/10

redline 814fa credential_access discovery execution infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

814FA

88.99.151.68:7200

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/3052-35-0x0000000000930000-0x0000000000982000-memory.dmp	family_redline
behavioral2/memory/2436-72-0x0000000000F30000-0x0000000000F82000-memory.dmp	family_redline

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 5 IoCs

pid	Process
440	Legend.pif
3052	RegAsm.exe
552	RegAsm.exe
2436	RegAsm.exe
3076	ScanGuard.pif

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4948	tasklist.exe
1140	tasklist.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScanGuard.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Legend.pif

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2404	schtasks.exe
3480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
3052	RegAsm.exe
3052	RegAsm.exe
3052	RegAsm.exe
3052	RegAsm.exe
3052	RegAsm.exe
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
440	Legend.pif
2436	RegAsm.exe
2436	RegAsm.exe
2436	RegAsm.exe
2436	RegAsm.exe
2436	RegAsm.exe
3076	ScanGuard.pif
3076	ScanGuard.pif
3076	ScanGuard.pif
3076	ScanGuard.pif

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	tasklist.exe
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	3052	RegAsm.exe
Token: SeDebugPrivilege	2436	RegAsm.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
440	Legend.pif
440	Legend.pif
440	Legend.pif
3076	ScanGuard.pif
3076	ScanGuard.pif
3076	ScanGuard.pif

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
440	Legend.pif
440	Legend.pif
440	Legend.pif
3076	ScanGuard.pif
3076	ScanGuard.pif
3076	ScanGuard.pif

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1932	340	95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe	82
PID 340 wrote to memory of 1932	340	95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe	82
PID 340 wrote to memory of 1932	340	95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe	82
PID 1932 wrote to memory of 1140	1932	cmd.exe	84
PID 1932 wrote to memory of 1140	1932	cmd.exe	84
PID 1932 wrote to memory of 1140	1932	cmd.exe	84
PID 1932 wrote to memory of 4232	1932	cmd.exe	85
PID 1932 wrote to memory of 4232	1932	cmd.exe	85
PID 1932 wrote to memory of 4232	1932	cmd.exe	85
PID 1932 wrote to memory of 4948	1932	cmd.exe	87
PID 1932 wrote to memory of 4948	1932	cmd.exe	87
PID 1932 wrote to memory of 4948	1932	cmd.exe	87
PID 1932 wrote to memory of 256	1932	cmd.exe	88
PID 1932 wrote to memory of 256	1932	cmd.exe	88
PID 1932 wrote to memory of 256	1932	cmd.exe	88
PID 1932 wrote to memory of 2752	1932	cmd.exe	89
PID 1932 wrote to memory of 2752	1932	cmd.exe	89
PID 1932 wrote to memory of 2752	1932	cmd.exe	89
PID 1932 wrote to memory of 4992	1932	cmd.exe	90
PID 1932 wrote to memory of 4992	1932	cmd.exe	90
PID 1932 wrote to memory of 4992	1932	cmd.exe	90
PID 1932 wrote to memory of 3456	1932	cmd.exe	91
PID 1932 wrote to memory of 3456	1932	cmd.exe	91
PID 1932 wrote to memory of 3456	1932	cmd.exe	91
PID 1932 wrote to memory of 440	1932	cmd.exe	92
PID 1932 wrote to memory of 440	1932	cmd.exe	92
PID 1932 wrote to memory of 440	1932	cmd.exe	92
PID 1932 wrote to memory of 2168	1932	cmd.exe	93
PID 1932 wrote to memory of 2168	1932	cmd.exe	93
PID 1932 wrote to memory of 2168	1932	cmd.exe	93
PID 440 wrote to memory of 3068	440	Legend.pif	94
PID 440 wrote to memory of 3068	440	Legend.pif	94
PID 440 wrote to memory of 3068	440	Legend.pif	94
PID 440 wrote to memory of 2404	440	Legend.pif	96
PID 440 wrote to memory of 2404	440	Legend.pif	96
PID 440 wrote to memory of 2404	440	Legend.pif	96
PID 3068 wrote to memory of 3480	3068	cmd.exe	98
PID 3068 wrote to memory of 3480	3068	cmd.exe	98
PID 3068 wrote to memory of 3480	3068	cmd.exe	98
PID 440 wrote to memory of 3052	440	Legend.pif	99
PID 440 wrote to memory of 3052	440	Legend.pif	99
PID 440 wrote to memory of 3052	440	Legend.pif	99
PID 440 wrote to memory of 3052	440	Legend.pif	99
PID 440 wrote to memory of 3052	440	Legend.pif	99
PID 440 wrote to memory of 552	440	Legend.pif	101
PID 440 wrote to memory of 552	440	Legend.pif	101
PID 440 wrote to memory of 552	440	Legend.pif	101
PID 440 wrote to memory of 2436	440	Legend.pif	102
PID 440 wrote to memory of 2436	440	Legend.pif	102
PID 440 wrote to memory of 2436	440	Legend.pif	102
PID 440 wrote to memory of 2436	440	Legend.pif	102
PID 440 wrote to memory of 2436	440	Legend.pif	102
PID 468 wrote to memory of 3076	468	wscript.EXE	105
PID 468 wrote to memory of 3076	468	wscript.EXE	105
PID 468 wrote to memory of 3076	468	wscript.EXE	105

C:\Users\Admin\AppData\Local\Temp\95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe
"C:\Users\Admin\AppData\Local\Temp\95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Offensive Offensive.cmd & Offensive.cmd & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:256
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 543648
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2752
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "BiddingVeRoutinesFilms" Bowling
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Suzuki + ..\Major + ..\Tit + ..\Adjust + ..\Invest + ..\Severe + ..\Sony + ..\Prefers E
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\543648\Legend.pif
    Legend.pif E
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c schtasks.exe /create /tn "Keyboard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "Keyboard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3480
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /create /tn "ScanGuard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc onlogon /F /RL HIGHEST
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe
      4⤵
      Executes dropped EXE
      PID:552
  - - C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 15
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.pif
  "C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.pif" "C:\Users\Admin\AppData\Local\ThreatGuard Innovations\P"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Filesize
2KB

MD5
efda3630f946cbbf082e90258678f517

SHA1
892764ed662f696b5eff334a223c6a588ec3e317

SHA256
bf2b8b89f30a49928b1cfc780b0cf46053e4854902166f54bf5e50fe6902ee60

SHA512
7f1f6755892e5f73dd9dce7c1d12e664ee9fba3a910554049a14f29ca1a382849904854fb29fd9341400e0c40c7087c0f69d52a7aaf6b73d4f0297f430798dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\543648\E

Filesize
538KB

MD5
f8e0529fb48efca8c0eede34c01e0033

SHA1
85a42f025ae9a2227f2649df6652c929400a4aac

SHA256
68b1bbcf0f6f6270afb451b41f81f6f5691759493640f6e2735276877c024dcb

SHA512
b6192ad0efe9c04f803a5a14c09480d573ff94d6d50135ff85b2fa4e9ef52c4c04fcb99207be0e7fa4f3a2dba27b6d0b336e111cc3ae678a05761132dadf8f54

Download Submit
C:\Users\Admin\AppData\Local\Temp\543648\Legend.pif

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe

Filesize
63KB

MD5
42ab6e035df99a43dbb879c86b620b91

SHA1
c6e116569d17d8142dbb217b1f8bfa95bc148c38

SHA256
53195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b

SHA512
2e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Adjust

Filesize
50KB

MD5
35e5ab29f9dc36806b7db16d46ed7ede

SHA1
527d6aa79dca3a83dca41245240507996a1b0ae3

SHA256
c6ab18d27ef2d0e9b01a3502b9ef292ac9d5a4bd045db792d8d3b4188c30f8c1

SHA512
754c57e8fcd56f149dbfd6606c029071cae23bd9d658961b853c03830cb8150d444f1e365ed8651ab5accf4b6e5fc1184c42f5e1d1cead261eee04268152309b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bowling

Filesize
608B

MD5
1100e2dc0abbc946984508a57c2dcc6a

SHA1
a46249d3d6aebb480f6c948aff6f065ad3ce6721

SHA256
87cf4bc82402b0ee787dd23867496ee383cc24c397fe54372a0e2fcc1c6bf206

SHA512
c2c4cb619a76ee8f6ccefeb712b11a25c1c475db088aeab5dad6978536a2eca710f31a73d183062c83ce272cf0534b53c2d4f40db203a4b7a3b8bfa5e9390fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cafe

Filesize
872KB

MD5
be7ece0a176b5396ed2e80dfd1c7d424

SHA1
ea19b37edc7d7cef563094860af09900898fe467

SHA256
4d448ab30a84c345178b92911192046923db0badece1146f0adda3f0af1417d8

SHA512
ef006bad40449dca5569f113d8eebcef718f3754a5455b1bd31ef61ab59c5b096b24663da60173edb1741bd045f588823144e63b2e62b681abd7e5b95f2c906b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Invest

Filesize
90KB

MD5
2650bd0e98cced157856b15c55a48398

SHA1
b8b509ad22f350d600cd4ac612a5eb3d61db3f02

SHA256
f6b5de9758a1baa8f31e584bb5e5427365a7d08679931328d6ae9ddf1b6c99ec

SHA512
db3693cc106df3b097b8b3b97236819792bb04afead5e13679fdcc21765fd348502dae64eade646815fb7cd3745f190ed8d8a071f6d5f29cb36ffd08c9193e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Major

Filesize
97KB

MD5
5365ad26fbf55fbb238379160f3819ae

SHA1
6e33efe060d8fc424f5c850107ad4794c66daec1

SHA256
5749f6b429f9fbd508b810c6e99504e19036a93374d83eabd7171cb625627ae6

SHA512
861b76e0f60d055c7cf2b51d5a4aa21848664b57fa387d83e9c36c23dd0044bacb0bb8e5a8630062604871197b7050e82101c91dd2b809e8c5208eb86fa22e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Offensive

Filesize
10KB

MD5
ba741ea1fd350411ba286e3807deb915

SHA1
885f5b96f704a4e5fbefbb6c8b82274ead6ffeb0

SHA256
adcf5ed9c2a1ab99e0e91306fa3e2d828902c989046d7cff497a4b864ffac5f3

SHA512
e4f9ea218752cfe4f8a4241c7bfa8d87f2fb0fcc1c5ca679105f42a4c1bb9c692b70cea3e60cfb50cc24af2eefc2bfe80bfecd54cbcec51ef523199251efaf9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Prefers

Filesize
32KB

MD5
3800b719c54c939f9c41642d3f0c0dc9

SHA1
2f4e8b5ad282ff727f23ff8b98f82427bc88d263

SHA256
d2fafbf46e5741896ca37681386c1af4f847d2bae11592be569ed41d7e50702b

SHA512
b0f73c110f28091ae5c786ce9c5970ea2d4c728abfc4aacb926892712d04a0d5bb0d912ef5cf27a19b529cfcae2bf5f63ddaa77f4e39e49f7d67ce240d9f35e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Severe

Filesize
50KB

MD5
af2b7ee3e48e5404c5b8e4af9767ab3d

SHA1
18b0119b67a01719b7e968e2296676565a273264

SHA256
5748c19741e9877d8abeb2f593a158bd39195c9c1433129ebdb6858381283aee

SHA512
2472c62e1c65d3a03a293daae3eb162b42bdfc536907f4b1bb63d86315e3540cc8fd641d2b26183cc230884b6cc74cafb805c913c09b991ba3d4699ed8ed4129

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sony

Filesize
62KB

MD5
bbdea5ac69d32176c7cf0af7749cdf12

SHA1
39c66e4bcad18e9bb4400a579d44f177daf63ecc

SHA256
8d1c9abd9b4a2f0a19f9a003280e1ffaddfd4c55b3fbef43b4aa97c7d3d280e3

SHA512
e6021102ecba902d998601f4f857f973ff24edd7012fb1c3f9fef557f966a023ab241ac3f54aeaaf887e19560a805eaf77d593cfa7efd659a137faf4dbf53704

Download Submit
C:\Users\Admin\AppData\Local\Temp\Suzuki

Filesize
87KB

MD5
c4cf8fa43e79df7fa6259198175880f4

SHA1
e9097784729e777188629e9c7c59cb0a0c6c6cd8

SHA256
f40e0aa9ee1be08178cde5ff9c25253e70c4c08cd7311722a749be0ebfcb49eb

SHA512
786cf3a41fa4d55999fd15ce6b1f89c1189f3212b181e2e0f2b3262e24669453cc99d587b3c70ddbf098117d5b5d3e4b7bf034e288bec61672bcdc29a131642e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tit

Filesize
70KB

MD5
9ff7f4f0f216def9dd325d9b667be06e

SHA1
f2cc8a82c99dc8bc38624e7aaa31fd29047f19dd

SHA256
7639decc3f03f22ed96230e5bfb619419d2523a56cb0b6cccf6ad6c66d5219e8

SHA512
83984918784fb08d6392d5a565578d9caa60218aba2ecfe255e3d809e0f7a48f36da68aea87fbca19a12d6bd83cbcc9aa24f021b14bafda68a2b90fb58ac4b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp48CC.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js

Filesize
189B

MD5
b0f3418f04bad46c03cdc1522c968ed5

SHA1
424eb403adc2749036bdcfda21c3b657ffc1d732

SHA256
f3cc421915b471f5c1af6551a45a59e1c12bf2910f081db72b5a0bd06ca0647e

SHA512
f98033bde6431b4f020ac2cfae8539465952b4f421dd780bdb6b9e4a768b723393343268a73311f8cf41289a13d0088b4c3ec58e4827d0af8240c35350ad0225

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
a70236f5981e9c125f6bd37be4db3531

SHA1
db87df3c0197a2aa2572810c71667440f96ae499

SHA256
1a1199a8c11c5e6f151ecb3b1582d02781679104f6a6ee24864bb1c99079288c

SHA512
2fed4a5bd8ca0411265a797b3b6a05f2ea7d640f30bc67e32b77925b8394b8fb966ae824cb381a0e94fced4a132369b29ec5621b7fd4593755d580dbcc4a11e5

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
aa36b9219256e4e064d57fa978ef6706

SHA1
31251aeecebc5db81e93ebaccf44dacb56286881

SHA256
9142bd5c6e74c5e668325b443df2e3709309fb81a317ebc8743b76a7c7abcdf8

SHA512
c5d09d03c7d551ae9cb878b6b4851b7e6c126eaf66698409384b46adaf3fbd74cae12e37c8cc9c5ae8d0e8f55d7bcd019b791dd7bcd5293de2a35af2cbd6691f

Download Submit
memory/2436-72-0x0000000000F30000-0x0000000000F82000-memory.dmp

Filesize
328KB

Download
memory/3052-39-0x00000000050C0000-0x0000000005152000-memory.dmp

Filesize
584KB

Download
memory/3052-59-0x00000000069B0000-0x0000000006FC8000-memory.dmp

Filesize
6.1MB

Download
memory/3052-60-0x0000000006500000-0x000000000660A000-memory.dmp

Filesize
1.0MB

Download
memory/3052-61-0x0000000006440000-0x0000000006452000-memory.dmp

Filesize
72KB

Download
memory/3052-62-0x00000000064A0000-0x00000000064DC000-memory.dmp

Filesize
240KB

Download
memory/3052-63-0x0000000006610000-0x000000000665C000-memory.dmp

Filesize
304KB

Download
memory/3052-64-0x0000000006760000-0x00000000067C6000-memory.dmp

Filesize
408KB

Download
memory/3052-67-0x00000000070D0000-0x0000000007120000-memory.dmp

Filesize
320KB

Download
memory/3052-68-0x00000000072F0000-0x00000000074B2000-memory.dmp

Filesize
1.8MB

Download
memory/3052-69-0x00000000079F0000-0x0000000007F1C000-memory.dmp

Filesize
5.2MB

Download
memory/3052-56-0x0000000006270000-0x000000000628E000-memory.dmp

Filesize
120KB

Download
memory/3052-55-0x0000000005C00000-0x0000000005C76000-memory.dmp

Filesize
472KB

Download
memory/3052-40-0x0000000005090000-0x000000000509A000-memory.dmp

Filesize
40KB

Download
memory/3052-38-0x00000000055D0000-0x0000000005B76000-memory.dmp

Filesize
5.6MB

Download
memory/3052-35-0x0000000000930000-0x0000000000982000-memory.dmp

Filesize
328KB

Download