redline | 1fa2d39e2196269e2482a1ce406daf535d71e9d453d537899c958467beebf453

Analysis

max time kernel
147s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-08-2022 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

928KB
MD5

415ad851f86423c3eb52d2bb157043b6
SHA1

be38eed93a6d8e7d65bc682dc9fca768724c0d4a
SHA256

1fa2d39e2196269e2482a1ce406daf535d71e9d453d537899c958467beebf453
SHA512

a0a8c73e8948d45df71467d74344730f01e8ec34440e01fdd4705314d16c6a982397b3d70381c20a7e1347a9b8a090e1822da05162523a7b48f8c9a0fa219132

Score

10^/10

redline 5 5076357887 nam3 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

176.113.115.146:9582

Attributes

auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 12 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
behavioral1/memory/2032-73-0x0000000000E40000-0x0000000000E60000-memory.dmp	family_redline
\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
behavioral1/memory/1236-78-0x0000000001170000-0x00000000011B4000-memory.dmp	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
behavioral1/memory/1180-89-0x0000000000270000-0x0000000000290000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.exejshainx.exeWW1.exeMinecraftForge.exe

pid process

1328 F0geI.exe
472 kukurzka9000.exe
2032 namdoitntn.exe
1552 real.exe
1236 safert44.exe
1180 jshainx.exe
1408 WW1.exe
2840 MinecraftForge.exe

pid	process
1328	F0geI.exe
472	kukurzka9000.exe
2032	namdoitntn.exe
1552	real.exe
1236	safert44.exe
1180	jshainx.exe
1408	WW1.exe
2840	MinecraftForge.exe

Loads dropped DLL 15 IoCs

Processes:

tmp.exeF0geI.exejshainx.exe

pid	process
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1092	tmp.exe
1328	F0geI.exe
1328	F0geI.exe
1328	F0geI.exe
1180	jshainx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 7 IoCs

Processes:

tmp.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	tmp.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\WW1.exe	tmp.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	tmp.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	tmp.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	tmp.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	tmp.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

real.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A40A21C1-1C8C-11ED-A1AC-52E8C5FCC7C7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4062A21-1C8C-11ED-A1AC-52E8C5FCC7C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A40518B1-1C8C-11ED-A1AC-52E8C5FCC7C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000418f79a32b896b4fb5b03d2c02db780b00000000020000000000106600000001000020000000f5195a1f9163df3dcaf6943c7bc2b1ac19f3dcfd9005d72c034be46d7b6b246c000000000e800000000200002000000014c1519e29e8b414063bc8c1219aa8e5c76fcdb3ad3f300216bad689ff9dbd339000000003c92fb27787ea59eba24fed2a3914038d62369eb6a69afb037fdc425cdc0f2947bc6f0da86d09ab813dc2c01aad5f31eae2e58e462dce1e9b374bc7e1dbdcb76f948cdd6b3b51fda5a1bddd13b194358881db2b4e05cc69bd98dbf72e7522f11f9e8dd4ab0d6f51dc5fbcf1f4c5a62e0ce09162ddbe9f5ce336da080280721da7d92597a1c8440d51104966ba176d8940000000db244ca6f7f2d0f12e2172eb6cefef58b460e9e24e79edf9092ba523be58b9d5f88e535da127bc0db57cb7db33c0de9bf12dd14e6f487f422ef7509954eb0cc7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "367327567"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f59e8299b0d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3FEB011-1C8C-11ED-A1AC-52E8C5FCC7C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

jshainx.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jshainx.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jshainx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	jshainx.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	jshainx.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

real.exejshainx.exesafert44.exenamdoitntn.exeMinecraftForge.exe

pid process

1552 real.exe
1180 jshainx.exe
1236 safert44.exe
2032 namdoitntn.exe
2840 MinecraftForge.exe

pid	process
1552	real.exe
1180	jshainx.exe
1236	safert44.exe
2032	namdoitntn.exe
2840	MinecraftForge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

jshainx.exesafert44.exenamdoitntn.exeMinecraftForge.exe

description	pid	process
Token: SeDebugPrivilege	1180	jshainx.exe
Token: SeDebugPrivilege	1236	safert44.exe
Token: SeDebugPrivilege	2032	namdoitntn.exe
Token: SeDebugPrivilege	2840	MinecraftForge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

1988 iexplore.exe
996 iexplore.exe
1400 iexplore.exe
956 iexplore.exe
2004 iexplore.exe

pid	process
1988	iexplore.exe
996	iexplore.exe
1400	iexplore.exe
956	iexplore.exe
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
996	iexplore.exe
996	iexplore.exe
1988	iexplore.exe
1988	iexplore.exe
956	iexplore.exe
956	iexplore.exe
1400	iexplore.exe
1400	iexplore.exe
2004	iexplore.exe
2004	iexplore.exe
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1092 wrote to memory of 2004	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 2004	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 2004	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 2004	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1988	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1988	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1988	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1988	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1400	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1400	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1400	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1400	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 996	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 996	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 996	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 996	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 956	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 956	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 956	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 956	1092	tmp.exe	iexplore.exe
PID 1092 wrote to memory of 1328	1092	tmp.exe	F0geI.exe
PID 1092 wrote to memory of 1328	1092	tmp.exe	F0geI.exe
PID 1092 wrote to memory of 1328	1092	tmp.exe	F0geI.exe
PID 1092 wrote to memory of 1328	1092	tmp.exe	F0geI.exe
PID 1092 wrote to memory of 472	1092	tmp.exe	kukurzka9000.exe
PID 1092 wrote to memory of 472	1092	tmp.exe	kukurzka9000.exe
PID 1092 wrote to memory of 472	1092	tmp.exe	kukurzka9000.exe
PID 1092 wrote to memory of 472	1092	tmp.exe	kukurzka9000.exe
PID 1092 wrote to memory of 2032	1092	tmp.exe	namdoitntn.exe
PID 1092 wrote to memory of 2032	1092	tmp.exe	namdoitntn.exe
PID 1092 wrote to memory of 2032	1092	tmp.exe	namdoitntn.exe
PID 1092 wrote to memory of 2032	1092	tmp.exe	namdoitntn.exe
PID 1092 wrote to memory of 1552	1092	tmp.exe	real.exe
PID 1092 wrote to memory of 1552	1092	tmp.exe	real.exe
PID 1092 wrote to memory of 1552	1092	tmp.exe	real.exe
PID 1092 wrote to memory of 1552	1092	tmp.exe	real.exe
PID 1092 wrote to memory of 1236	1092	tmp.exe	safert44.exe
PID 1092 wrote to memory of 1236	1092	tmp.exe	safert44.exe
PID 1092 wrote to memory of 1236	1092	tmp.exe	safert44.exe
PID 1092 wrote to memory of 1236	1092	tmp.exe	safert44.exe
PID 1092 wrote to memory of 1180	1092	tmp.exe	jshainx.exe
PID 1092 wrote to memory of 1180	1092	tmp.exe	jshainx.exe
PID 1092 wrote to memory of 1180	1092	tmp.exe	jshainx.exe
PID 1092 wrote to memory of 1180	1092	tmp.exe	jshainx.exe
PID 1092 wrote to memory of 1408	1092	tmp.exe	WW1.exe
PID 1092 wrote to memory of 1408	1092	tmp.exe	WW1.exe
PID 1092 wrote to memory of 1408	1092	tmp.exe	WW1.exe
PID 1092 wrote to memory of 1408	1092	tmp.exe	WW1.exe
PID 996 wrote to memory of 1648	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1648	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1648	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1648	996	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 1620	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 1620	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 1620	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 1620	1988	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 1744	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 1744	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 1744	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 1744	956	iexplore.exe	IEXPLORE.EXE
PID 1400 wrote to memory of 1640	1400	iexplore.exe	IEXPLORE.EXE
PID 1400 wrote to memory of 1640	1400	iexplore.exe	IEXPLORE.EXE
PID 1400 wrote to memory of 1640	1400	iexplore.exe	IEXPLORE.EXE
PID 1400 wrote to memory of 1640	1400	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1092

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RyjC4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2004

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1A4aK4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RLtX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1640

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1nN6Z4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:472

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1552

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Program Files (x86)\Company\NewProduct\jshainx.exe
"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
"C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Program Files (x86)\Company\NewProduct\WW1.exe
"C:\Program Files (x86)\Company\NewProduct\WW1.exe"
2⤵
- Executes dropped EXE
PID:1408

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\WW1.exe
Filesize
281KB

MD5
1885946b127569cff6c03bea7175c3a0

SHA1
9bde463fc59f36f7fca6ab4d5f31b52cf979fc22

SHA256
6e445a4ed5beff50cf4935e54d2c48e25bade941378fe8fe3f0914413e90e09b

SHA512
e954c609b998b01b85614d3bda84a410d48db0559d68a69d7b07cfbed9cf4311f7c0b60fcc060c874dd757e774112283ec7f22c32a6ecf268a775becfea72a0b

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
669KB

MD5
b5942a0be0b72e121dadb762044f38cc

SHA1
885909607a9747c11eac6cc47b775ad947980c5e

SHA256
c565dd409f6d17997285f6fcecf851c56ddc3129c2a777529e8470290565ace1

SHA512
d2a916738fca01b6b5a27639fbefcc7406e79f8493d8f69015c60d07d0341ab8aa8e4e3ab50208161b7398bef62b9837e11524ffefc502b9f09efc011974e3e7

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
282KB

MD5
474861050e6a7b65bc4521096cb05454

SHA1
4e1aabe27598171a89c219aab860b325a4358b22

SHA256
ccd962957659555af7c607deb20a4ec34a1578af037d5310ffd07bd092f0ebc7

SHA512
42afff00dd616fc73d1c338184149ddb66376e808cd2da39a94357c8d296a245ab0f1e474aac1789d613efef3c1867e0c3a2e41c07ac21bcc07e00ea08309a79

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
4fdcd30e940f8134fb37b054fdd214b5

SHA1
84c0a0a82ec9c2c2be1deb5f1559ddf2a515a459

SHA256
c985c51638df5985288d9c0d573db35278eafc84939d68c2d782e8b9d573aab0

SHA512
7436d7ac24aa2b7d0752701c1c3350d2b432b3f37b68443fff5ef0532014090a31be7883ccf438d69afb3b586c2f1f58d1465879c9a6494b9c016eb74d9d10ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A3FEB011-1C8C-11ED-A1AC-52E8C5FCC7C7}.dat
Filesize
5KB

MD5
de880d833a9ae1a9067006a62ad78911

SHA1
b9abb1828ece9d79da45a8117e1b48ed044da6f9

SHA256
b868f385e4eb209d334a4f214d0369ac46a556d947c1cd0d2dc2024f5c4ce238

SHA512
4f6c1caa2cd2837abd3b9e68592365a2d6e3ecd8506b37fb8ce16faaf072b8aa97c4431047085707194a5389f8f2d67c3f800a96c9cbac3f048aef9a3f0f8e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A40518B1-1C8C-11ED-A1AC-52E8C5FCC7C7}.dat
Filesize
5KB

MD5
d68c88a6cfb3daaccf6d0a0d4c1e9eb4

SHA1
f9218a15aeee12899bcab84a3f0c0e17ec0ce9e4

SHA256
38293e2acd4336d53eb576425997408abfdcc611c9ce2994832c177be9bcd0e3

SHA512
1f3d99e6ec868e066aea8fb4d77cbe1c8ab6f5fbdaf60b8cc6c336756dabb22a2643b7029625af17cbdc61fe9e3a846c7937e96c70250434fc166eff205cbac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A40518B1-1C8C-11ED-A1AC-52E8C5FCC7C7}.dat
Filesize
5KB

MD5
d68c88a6cfb3daaccf6d0a0d4c1e9eb4

SHA1
f9218a15aeee12899bcab84a3f0c0e17ec0ce9e4

SHA256
38293e2acd4336d53eb576425997408abfdcc611c9ce2994832c177be9bcd0e3

SHA512
1f3d99e6ec868e066aea8fb4d77cbe1c8ab6f5fbdaf60b8cc6c336756dabb22a2643b7029625af17cbdc61fe9e3a846c7937e96c70250434fc166eff205cbac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A4062A21-1C8C-11ED-A1AC-52E8C5FCC7C7}.dat
Filesize
5KB

MD5
e5f4d88a67036a568c37d721336b9408

SHA1
ea972416982825d4a60b4dbb08dfd34d806e6dc7

SHA256
8f83a4ae0c9e58711e68506920ee69192eb4dc52ef22d159b14a23134caab004

SHA512
1847c4931a13975318479c8c3f3ba3baedfb68894d0f73545c1102f3494ca89e609c669d65c06a9e17dbce63dc3f250fa16c124279294c3773e5f573b1705071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A4095E71-1C8C-11ED-A1AC-52E8C5FCC7C7}.dat
Filesize
5KB

MD5
6eec14f7f2f8e5cacb636a367569054c

SHA1
e72d84d5559b81f0e8f7757f8afc2afb0f1fd477

SHA256
b345ba692f515fa7de1d9256d4f77eb603114e9c972f518b581adde3fb8b4036

SHA512
20f3b0ac0cf89ab1bfafab3e0830e03c5806131ae875cd08821230b41cd21bfe799d6cf750458b50d2e58edf9ceea7922e8ff4618a21952f8169e19449b2b845

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
Filesize
71KB

MD5
f8370d132f334be6703ce54b08db1578

SHA1
55d98f702724f25535bfbeb7a46cee92d57a4421

SHA256
2b058754c1b4402ccc99db8e247f234593bb96015af801f2ee6880425b126fb6

SHA512
0eee39de1ffb965744c97a1c6918ccd755a4fae18d889893244e9d0e3760f28615e46cce524930f1d9f18540bbd6644cd45765c8f95f04c615a0ff682136b35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
Filesize
71KB

MD5
f8370d132f334be6703ce54b08db1578

SHA1
55d98f702724f25535bfbeb7a46cee92d57a4421

SHA256
2b058754c1b4402ccc99db8e247f234593bb96015af801f2ee6880425b126fb6

SHA512
0eee39de1ffb965744c97a1c6918ccd755a4fae18d889893244e9d0e3760f28615e46cce524930f1d9f18540bbd6644cd45765c8f95f04c615a0ff682136b35b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B7IM6A91.txt
Filesize
602B

MD5
369968204e88a1ac5a41039280cd9ec4

SHA1
5d6c91b84b331acac2a3390b1ed61b853e5e0865

SHA256
a6c2e0c3d4211fa87df428dc5cfcb975fc461ee9c1e381d259445cfba9d874de

SHA512
b91cd3108f887b297b75e34ac190b70c2fa9f574334eeb31428354202b376e895b40b8e4f7948724b42ebb356d27760a30163e9282ab3fada9b396869a857e92

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
\Program Files (x86)\Company\NewProduct\WW1.exe
Filesize
281KB

MD5
1885946b127569cff6c03bea7175c3a0

SHA1
9bde463fc59f36f7fca6ab4d5f31b52cf979fc22

SHA256
6e445a4ed5beff50cf4935e54d2c48e25bade941378fe8fe3f0914413e90e09b

SHA512
e954c609b998b01b85614d3bda84a410d48db0559d68a69d7b07cfbed9cf4311f7c0b60fcc060c874dd757e774112283ec7f22c32a6ecf268a775becfea72a0b

Download Submit
\Program Files (x86)\Company\NewProduct\WW1.exe
Filesize
281KB

MD5
1885946b127569cff6c03bea7175c3a0

SHA1
9bde463fc59f36f7fca6ab4d5f31b52cf979fc22

SHA256
6e445a4ed5beff50cf4935e54d2c48e25bade941378fe8fe3f0914413e90e09b

SHA512
e954c609b998b01b85614d3bda84a410d48db0559d68a69d7b07cfbed9cf4311f7c0b60fcc060c874dd757e774112283ec7f22c32a6ecf268a775becfea72a0b

Download Submit
\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
669KB

MD5
b5942a0be0b72e121dadb762044f38cc

SHA1
885909607a9747c11eac6cc47b775ad947980c5e

SHA256
c565dd409f6d17997285f6fcecf851c56ddc3129c2a777529e8470290565ace1

SHA512
d2a916738fca01b6b5a27639fbefcc7406e79f8493d8f69015c60d07d0341ab8aa8e4e3ab50208161b7398bef62b9837e11524ffefc502b9f09efc011974e3e7

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
669KB

MD5
b5942a0be0b72e121dadb762044f38cc

SHA1
885909607a9747c11eac6cc47b775ad947980c5e

SHA256
c565dd409f6d17997285f6fcecf851c56ddc3129c2a777529e8470290565ace1

SHA512
d2a916738fca01b6b5a27639fbefcc7406e79f8493d8f69015c60d07d0341ab8aa8e4e3ab50208161b7398bef62b9837e11524ffefc502b9f09efc011974e3e7

Download Submit
\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe
Filesize
282KB

MD5
474861050e6a7b65bc4521096cb05454

SHA1
4e1aabe27598171a89c219aab860b325a4358b22

SHA256
ccd962957659555af7c607deb20a4ec34a1578af037d5310ffd07bd092f0ebc7

SHA512
42afff00dd616fc73d1c338184149ddb66376e808cd2da39a94357c8d296a245ab0f1e474aac1789d613efef3c1867e0c3a2e41c07ac21bcc07e00ea08309a79

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe
Filesize
282KB

MD5
474861050e6a7b65bc4521096cb05454

SHA1
4e1aabe27598171a89c219aab860b325a4358b22

SHA256
ccd962957659555af7c607deb20a4ec34a1578af037d5310ffd07bd092f0ebc7

SHA512
42afff00dd616fc73d1c338184149ddb66376e808cd2da39a94357c8d296a245ab0f1e474aac1789d613efef3c1867e0c3a2e41c07ac21bcc07e00ea08309a79

Download Submit
\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
Filesize
71KB

MD5
f8370d132f334be6703ce54b08db1578

SHA1
55d98f702724f25535bfbeb7a46cee92d57a4421

SHA256
2b058754c1b4402ccc99db8e247f234593bb96015af801f2ee6880425b126fb6

SHA512
0eee39de1ffb965744c97a1c6918ccd755a4fae18d889893244e9d0e3760f28615e46cce524930f1d9f18540bbd6644cd45765c8f95f04c615a0ff682136b35b

Download Submit
memory/472-61-0x0000000000000000-mapping.dmp

Download
memory/472-127-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/472-126-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/1092-54-0x00000000768D1000-0x00000000768D3000-memory.dmp

Filesize
8KB

Download
memory/1180-89-0x0000000000270000-0x0000000000290000-memory.dmp

Filesize
128KB

Download
memory/1180-80-0x0000000000000000-mapping.dmp

Download
memory/1236-75-0x0000000000000000-mapping.dmp

Download
memory/1236-90-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/1236-78-0x0000000001170000-0x00000000011B4000-memory.dmp

Filesize
272KB

Download
memory/1328-93-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1328-135-0x000000000053B000-0x000000000054C000-memory.dmp

Filesize
68KB

Download
memory/1328-125-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1328-124-0x000000000053B000-0x000000000054C000-memory.dmp

Filesize
68KB

Download
memory/1328-57-0x0000000000000000-mapping.dmp

Download
memory/1328-92-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1328-91-0x000000000053B000-0x000000000054C000-memory.dmp

Filesize
68KB

Download
memory/1328-136-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1408-85-0x0000000000000000-mapping.dmp

Download
memory/1552-102-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/1552-70-0x0000000000000000-mapping.dmp

Download
memory/2032-73-0x0000000000E40000-0x0000000000E60000-memory.dmp

Filesize
128KB

Download
memory/2032-65-0x0000000000000000-mapping.dmp

Download
memory/2840-133-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2840-132-0x0000000000180000-0x0000000000198000-memory.dmp

Filesize
96KB

Download
memory/2840-129-0x0000000000000000-mapping.dmp

Download