Analysis
-
max time kernel
171s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:46
Static task
static1
Behavioral task
behavioral1
Sample
0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe
Resource
win7-20230831-en
General
-
Target
0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe
-
Size
1.1MB
-
MD5
5ffc2197da8da12de83042da7c5477b4
-
SHA1
162de1e6de75afed5ced327c6c86c9ba640e2a8d
-
SHA256
0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22
-
SHA512
6fe53bd403e14fb53127e41577c0f0b06be55630428ad04be69ddab521cc819c02cd439b8e18f53d792a37eba81ba3f2150588c9b5ba0c09ed77f8be0d7fc0a0
-
SSDEEP
24576:Vyb0ONzjX2rVTJvuN3dAgeH8sVWALK5JsY7CjoMi3L/bYE:wxtT2rV1u1ducYWKKiPsL/
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/460-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/460-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/460-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/460-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3988-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t8498459.exeexplothe.exeu9069034.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation t8498459.exe Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation u9069034.exe Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 14 IoCs
Processes:
z1074499.exez5267362.exez9721426.exez9865906.exeq4925196.exer2276574.exes8303142.exet8498459.exeexplothe.exeu9069034.exelegota.exew9886464.exeexplothe.exelegota.exepid process 4352 z1074499.exe 2664 z5267362.exe 3568 z9721426.exe 736 z9865906.exe 4732 q4925196.exe 4408 r2276574.exe 1536 s8303142.exe 4840 t8498459.exe 4920 explothe.exe 3904 u9069034.exe 2244 legota.exe 1516 w9886464.exe 1160 explothe.exe 4968 legota.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exez1074499.exez5267362.exez9721426.exez9865906.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1074499.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z5267362.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z9721426.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z9865906.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
q4925196.exer2276574.exedescription pid process target process PID 4732 set thread context of 3988 4732 q4925196.exe AppLaunch.exe PID 4408 set thread context of 460 4408 r2276574.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4372 4732 WerFault.exe q4925196.exe 2404 4408 WerFault.exe r2276574.exe 2260 460 WerFault.exe AppLaunch.exe 3008 1536 WerFault.exe s8303142.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4492 schtasks.exe 1984 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3988 AppLaunch.exe 3988 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3988 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exez1074499.exez5267362.exez9721426.exez9865906.exeq4925196.exer2276574.exet8498459.exeexplothe.exeu9069034.exelegota.exedescription pid process target process PID 4852 wrote to memory of 4352 4852 0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe z1074499.exe PID 4852 wrote to memory of 4352 4852 0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe z1074499.exe PID 4852 wrote to memory of 4352 4852 0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe z1074499.exe PID 4352 wrote to memory of 2664 4352 z1074499.exe z5267362.exe PID 4352 wrote to memory of 2664 4352 z1074499.exe z5267362.exe PID 4352 wrote to memory of 2664 4352 z1074499.exe z5267362.exe PID 2664 wrote to memory of 3568 2664 z5267362.exe z9721426.exe PID 2664 wrote to memory of 3568 2664 z5267362.exe z9721426.exe PID 2664 wrote to memory of 3568 2664 z5267362.exe z9721426.exe PID 3568 wrote to memory of 736 3568 z9721426.exe z9865906.exe PID 3568 wrote to memory of 736 3568 z9721426.exe z9865906.exe PID 3568 wrote to memory of 736 3568 z9721426.exe z9865906.exe PID 736 wrote to memory of 4732 736 z9865906.exe q4925196.exe PID 736 wrote to memory of 4732 736 z9865906.exe q4925196.exe PID 736 wrote to memory of 4732 736 z9865906.exe q4925196.exe PID 4732 wrote to memory of 3988 4732 q4925196.exe AppLaunch.exe PID 4732 wrote to memory of 3988 4732 q4925196.exe AppLaunch.exe PID 4732 wrote to memory of 3988 4732 q4925196.exe AppLaunch.exe PID 4732 wrote to memory of 3988 4732 q4925196.exe AppLaunch.exe PID 4732 wrote to memory of 3988 4732 q4925196.exe AppLaunch.exe PID 4732 wrote to memory of 3988 4732 q4925196.exe AppLaunch.exe PID 4732 wrote to memory of 3988 4732 q4925196.exe AppLaunch.exe PID 4732 wrote to memory of 3988 4732 q4925196.exe AppLaunch.exe PID 736 wrote to memory of 4408 736 z9865906.exe r2276574.exe PID 736 wrote to memory of 4408 736 z9865906.exe r2276574.exe PID 736 wrote to memory of 4408 736 z9865906.exe r2276574.exe PID 4408 wrote to memory of 1876 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 1876 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 1876 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 4408 wrote to memory of 460 4408 r2276574.exe AppLaunch.exe PID 3568 wrote to memory of 1536 3568 z9721426.exe s8303142.exe PID 3568 wrote to memory of 1536 3568 z9721426.exe s8303142.exe PID 3568 wrote to memory of 1536 3568 z9721426.exe s8303142.exe PID 2664 wrote to memory of 4840 2664 z5267362.exe t8498459.exe PID 2664 wrote to memory of 4840 2664 z5267362.exe t8498459.exe PID 2664 wrote to memory of 4840 2664 z5267362.exe t8498459.exe PID 4840 wrote to memory of 4920 4840 t8498459.exe explothe.exe PID 4840 wrote to memory of 4920 4840 t8498459.exe explothe.exe PID 4840 wrote to memory of 4920 4840 t8498459.exe explothe.exe PID 4352 wrote to memory of 3904 4352 z1074499.exe u9069034.exe PID 4352 wrote to memory of 3904 4352 z1074499.exe u9069034.exe PID 4352 wrote to memory of 3904 4352 z1074499.exe u9069034.exe PID 4920 wrote to memory of 4492 4920 explothe.exe schtasks.exe PID 4920 wrote to memory of 4492 4920 explothe.exe schtasks.exe PID 4920 wrote to memory of 4492 4920 explothe.exe schtasks.exe PID 3904 wrote to memory of 2244 3904 u9069034.exe legota.exe PID 3904 wrote to memory of 2244 3904 u9069034.exe legota.exe PID 3904 wrote to memory of 2244 3904 u9069034.exe legota.exe PID 4852 wrote to memory of 1516 4852 0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe w9886464.exe PID 4852 wrote to memory of 1516 4852 0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe w9886464.exe PID 4852 wrote to memory of 1516 4852 0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe w9886464.exe PID 2244 wrote to memory of 1984 2244 legota.exe schtasks.exe PID 2244 wrote to memory of 1984 2244 legota.exe schtasks.exe PID 2244 wrote to memory of 1984 2244 legota.exe schtasks.exe PID 4920 wrote to memory of 3428 4920 explothe.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe"C:\Users\Admin\AppData\Local\Temp\0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1074499.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1074499.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5267362.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5267362.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9721426.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9721426.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9865906.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9865906.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4925196.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4925196.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2276574.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2276574.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 1968⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1367⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8303142.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8303142.exe5⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 5846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8498459.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8498459.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9069034.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9069034.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9886464.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9886464.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4732 -ip 47321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4408 -ip 44081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 460 -ip 4601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1536 -ip 15361⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\1000112101\H2dtdK79emqeJYW.exeFilesize
10B
MD5ef81e41d11c9e7193ddd3d470dbb3eda
SHA10c15d12755a0be84e6403445c427231c274919c6
SHA2567515bf959b73b956ceb967351c7e299cbb3668a53d35f9c770eb72e00d93ced6
SHA512bf69c60fbb6d5ff50d81cd093cbabe59cd4eed439822e9ed02472245c3dae033cec143f1c4bbe6f702b7530f87c020442217ca1859da8f4b0f578a93b46cbdfa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9886464.exeFilesize
23KB
MD55238faea8be38d0de683d6e62d81af56
SHA19ac53e0d86da418a89b4d65476c77640d057fb36
SHA256b4d182d8d18b4d3eeeeaf29584687c9bd783c0b0037ae6ac079f6984b3d90956
SHA51262b5d2f31857e9a980b43208acc96e2c0001fa93a1ba5bbd3bbff629538f54b2685af8a617549d0616ec60c38b85ce73288b87de7c4cef17722fe681a485a85d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9886464.exeFilesize
23KB
MD55238faea8be38d0de683d6e62d81af56
SHA19ac53e0d86da418a89b4d65476c77640d057fb36
SHA256b4d182d8d18b4d3eeeeaf29584687c9bd783c0b0037ae6ac079f6984b3d90956
SHA51262b5d2f31857e9a980b43208acc96e2c0001fa93a1ba5bbd3bbff629538f54b2685af8a617549d0616ec60c38b85ce73288b87de7c4cef17722fe681a485a85d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1074499.exeFilesize
983KB
MD52984fa4b51196eb85094c1ea8bc7745f
SHA1f472b357718354ba3285e057967320615016f4e8
SHA256381f98bd325155a586fcd33b38105a7243bd7f77fa4865710077c948c41c16bf
SHA512f3022d43edeca771dbd2a879cd3db6b53632d84092c48e4496c429a3645cc236cdfe28f78337896a73afd8c923de3c9f9b3bd33175b6d81d8cd5b36e4b4adb57
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1074499.exeFilesize
983KB
MD52984fa4b51196eb85094c1ea8bc7745f
SHA1f472b357718354ba3285e057967320615016f4e8
SHA256381f98bd325155a586fcd33b38105a7243bd7f77fa4865710077c948c41c16bf
SHA512f3022d43edeca771dbd2a879cd3db6b53632d84092c48e4496c429a3645cc236cdfe28f78337896a73afd8c923de3c9f9b3bd33175b6d81d8cd5b36e4b4adb57
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9069034.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9069034.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5267362.exeFilesize
800KB
MD5630afe798eefe322ff3b935b2396ca05
SHA16ecbe2fcd193629b484e9423b49941715ae39dbb
SHA2569ef144b82707e364751eef87fae30ca172919a73f91c0163abd78ab590f0e378
SHA51276f80fb19d9a50cfc2a9c58b790c8b8d3680a6183a5d99543368580735dee7eb6e554d3d30a0d624706e9257d9e5c9dfba8e2799296ef10504606e15264a3d24
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5267362.exeFilesize
800KB
MD5630afe798eefe322ff3b935b2396ca05
SHA16ecbe2fcd193629b484e9423b49941715ae39dbb
SHA2569ef144b82707e364751eef87fae30ca172919a73f91c0163abd78ab590f0e378
SHA51276f80fb19d9a50cfc2a9c58b790c8b8d3680a6183a5d99543368580735dee7eb6e554d3d30a0d624706e9257d9e5c9dfba8e2799296ef10504606e15264a3d24
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8498459.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8498459.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9721426.exeFilesize
617KB
MD5adbb1d7f82d527887208ad91f7c05cb8
SHA17597ac6216311675c836376bd7f26f6ba5611c9c
SHA256a3ed101b13dafdcab7f173f08db808eced1ce07522968fc7afaa290302c31408
SHA512f2f108fa568ae47b3f05a19eb11243f38a9b78dfac36a469803e5b825c50291f068830df9088827cd0c51826988d484312b3508fb76d985f19da2cb057f0d33a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9721426.exeFilesize
617KB
MD5adbb1d7f82d527887208ad91f7c05cb8
SHA17597ac6216311675c836376bd7f26f6ba5611c9c
SHA256a3ed101b13dafdcab7f173f08db808eced1ce07522968fc7afaa290302c31408
SHA512f2f108fa568ae47b3f05a19eb11243f38a9b78dfac36a469803e5b825c50291f068830df9088827cd0c51826988d484312b3508fb76d985f19da2cb057f0d33a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8303142.exeFilesize
390KB
MD5917a092ad987565a5dc7994215a7bc4c
SHA1ab1ded1f85f73d5d4213c63d75690be715365e3a
SHA256b9db7b13ef839cf02efebdee5b78555f202c21d69380e3486b182a7399c02f22
SHA512cea17eec1063bef6f683bee8d6f544ee46ab1ae5b8cb366a901f74cd31aa015574903d339cea3283957250710e6cfca8e31432e4b403d5460645a47d8e9184e2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9865906.exeFilesize
346KB
MD5810826cddc3a43e65d8e49755c22ee11
SHA13ff6929a54754a8104a5a8fe166412d9c78f2569
SHA256a478a1e40cfe1bba5055ef2d3491d9f13b7795ce3fb413ec8dadc4272148bdb3
SHA512344b32816fb5ec6a1355c92cc8557302691cad304ecde080ab6dfa2f66d13b038d906f116f6499a47be019a21cd09d120bc8b208b292c44383003b238571a69b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9865906.exeFilesize
346KB
MD5810826cddc3a43e65d8e49755c22ee11
SHA13ff6929a54754a8104a5a8fe166412d9c78f2569
SHA256a478a1e40cfe1bba5055ef2d3491d9f13b7795ce3fb413ec8dadc4272148bdb3
SHA512344b32816fb5ec6a1355c92cc8557302691cad304ecde080ab6dfa2f66d13b038d906f116f6499a47be019a21cd09d120bc8b208b292c44383003b238571a69b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4925196.exeFilesize
227KB
MD54903d0f23691cf5cc2798d02a4965ff0
SHA1b2beda43b036a9ee9861bd2ff321695d1953cf52
SHA25653246d09ff548bcf5b04ef135170934be2df38cfe8bfef98b3c6e98cdbee4f34
SHA5127675590901acfccdfbc31925074cc645da04871a3a079a2f88df023441f1aadfc96f2735f638e950a115f55967b59fe2f5c7afe4b6dca4190e374e56a4800dd7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4925196.exeFilesize
227KB
MD54903d0f23691cf5cc2798d02a4965ff0
SHA1b2beda43b036a9ee9861bd2ff321695d1953cf52
SHA25653246d09ff548bcf5b04ef135170934be2df38cfe8bfef98b3c6e98cdbee4f34
SHA5127675590901acfccdfbc31925074cc645da04871a3a079a2f88df023441f1aadfc96f2735f638e950a115f55967b59fe2f5c7afe4b6dca4190e374e56a4800dd7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2276574.exeFilesize
356KB
MD540a553810d7b000a4499d6c06871f399
SHA11bc6cd10ad85e59cecd82d2711d0c585787d1e2b
SHA256e16b92deccaeddbade8747eadcd51ec820658c4c92b859190d75281c9d84dab3
SHA51214cede07c2782ebc859861597db56ac059bc4e008eda5d856a146b20f8ebd7e3237264242255d29b849aa5c400ef07767c66e41c5c4c96d60f618401b22655e4
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2276574.exeFilesize
356KB
MD540a553810d7b000a4499d6c06871f399
SHA11bc6cd10ad85e59cecd82d2711d0c585787d1e2b
SHA256e16b92deccaeddbade8747eadcd51ec820658c4c92b859190d75281c9d84dab3
SHA51214cede07c2782ebc859861597db56ac059bc4e008eda5d856a146b20f8ebd7e3237264242255d29b849aa5c400ef07767c66e41c5c4c96d60f618401b22655e4
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
memory/460-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/460-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/460-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/460-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3988-37-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/3988-39-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/3988-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3988-36-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/4360-54-0x000000000AD80000-0x000000000B398000-memory.dmpFilesize
6.1MB
-
memory/4360-56-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/4360-55-0x000000000A8C0000-0x000000000A9CA000-memory.dmpFilesize
1.0MB
-
memory/4360-67-0x000000000A9D0000-0x000000000AA1C000-memory.dmpFilesize
304KB
-
memory/4360-53-0x0000000002A70000-0x0000000002A76000-memory.dmpFilesize
24KB
-
memory/4360-52-0x00000000738E0000-0x0000000074090000-memory.dmpFilesize
7.7MB
-
memory/4360-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4360-90-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/4360-57-0x000000000A7F0000-0x000000000A802000-memory.dmpFilesize
72KB
-
memory/4360-58-0x000000000A850000-0x000000000A88C000-memory.dmpFilesize
240KB
-
memory/4360-59-0x00000000738E0000-0x0000000074090000-memory.dmpFilesize
7.7MB