Analysis
-
max time kernel
181s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 22:51
Static task
static1
Behavioral task
behavioral1
Sample
a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exe
Resource
win7-20230831-en
General
-
Target
a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exe
-
Size
1.1MB
-
MD5
0ba9be99249c799edc960efa09a3f9c4
-
SHA1
ececc3558bf66123ddbb2a1d377d0c124b94437f
-
SHA256
a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254
-
SHA512
cd66124722f2cd080dff54dd09ce16e0aac1dbf9cb98a3c24e66b80093bfb5a15488826647149287a2ac3ade0e6e597f7a262ba0d28be8e0fba08b223909b176
-
SSDEEP
24576:Py3EN1pH+jhKB2/ZJd8sHey3hDaru6iL8oIM36cYN:aC1pH/B2xJeiWru6iQo96c
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3940-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3940-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3940-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3940-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2556-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t9217484.exeexplothe.exeu6527525.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation t9217484.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation u6527525.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 14 IoCs
Processes:
z4714489.exez2781294.exez4011834.exez3308160.exeq3496603.exer0909073.exes8938050.exet9217484.exeexplothe.exeu6527525.exelegota.exew9113176.exelegota.exeexplothe.exepid process 1108 z4714489.exe 4152 z2781294.exe 4784 z4011834.exe 4480 z3308160.exe 896 q3496603.exe 1716 r0909073.exe 4972 s8938050.exe 3456 t9217484.exe 4536 explothe.exe 2984 u6527525.exe 408 legota.exe 4364 w9113176.exe 5028 legota.exe 552 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2784 rundll32.exe 1880 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exez4714489.exez2781294.exez4011834.exez3308160.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4714489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z2781294.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z4011834.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z3308160.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q3496603.exer0909073.exes8938050.exedescription pid process target process PID 896 set thread context of 2556 896 q3496603.exe AppLaunch.exe PID 1716 set thread context of 3940 1716 r0909073.exe AppLaunch.exe PID 4972 set thread context of 1272 4972 s8938050.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4852 896 WerFault.exe q3496603.exe 3916 1716 WerFault.exe r0909073.exe 2960 3940 WerFault.exe AppLaunch.exe 2232 4972 WerFault.exe s8938050.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2632 schtasks.exe 3484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2556 AppLaunch.exe 2556 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2556 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exez4714489.exez2781294.exez4011834.exez3308160.exeq3496603.exer0909073.exes8938050.exet9217484.exeexplothe.exeu6527525.exedescription pid process target process PID 1768 wrote to memory of 1108 1768 a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exe z4714489.exe PID 1768 wrote to memory of 1108 1768 a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exe z4714489.exe PID 1768 wrote to memory of 1108 1768 a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exe z4714489.exe PID 1108 wrote to memory of 4152 1108 z4714489.exe z2781294.exe PID 1108 wrote to memory of 4152 1108 z4714489.exe z2781294.exe PID 1108 wrote to memory of 4152 1108 z4714489.exe z2781294.exe PID 4152 wrote to memory of 4784 4152 z2781294.exe z4011834.exe PID 4152 wrote to memory of 4784 4152 z2781294.exe z4011834.exe PID 4152 wrote to memory of 4784 4152 z2781294.exe z4011834.exe PID 4784 wrote to memory of 4480 4784 z4011834.exe z3308160.exe PID 4784 wrote to memory of 4480 4784 z4011834.exe z3308160.exe PID 4784 wrote to memory of 4480 4784 z4011834.exe z3308160.exe PID 4480 wrote to memory of 896 4480 z3308160.exe q3496603.exe PID 4480 wrote to memory of 896 4480 z3308160.exe q3496603.exe PID 4480 wrote to memory of 896 4480 z3308160.exe q3496603.exe PID 896 wrote to memory of 2556 896 q3496603.exe AppLaunch.exe PID 896 wrote to memory of 2556 896 q3496603.exe AppLaunch.exe PID 896 wrote to memory of 2556 896 q3496603.exe AppLaunch.exe PID 896 wrote to memory of 2556 896 q3496603.exe AppLaunch.exe PID 896 wrote to memory of 2556 896 q3496603.exe AppLaunch.exe PID 896 wrote to memory of 2556 896 q3496603.exe AppLaunch.exe PID 896 wrote to memory of 2556 896 q3496603.exe AppLaunch.exe PID 896 wrote to memory of 2556 896 q3496603.exe AppLaunch.exe PID 4480 wrote to memory of 1716 4480 z3308160.exe r0909073.exe PID 4480 wrote to memory of 1716 4480 z3308160.exe r0909073.exe PID 4480 wrote to memory of 1716 4480 z3308160.exe r0909073.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 1716 wrote to memory of 3940 1716 r0909073.exe AppLaunch.exe PID 4784 wrote to memory of 4972 4784 z4011834.exe s8938050.exe PID 4784 wrote to memory of 4972 4784 z4011834.exe s8938050.exe PID 4784 wrote to memory of 4972 4784 z4011834.exe s8938050.exe PID 4972 wrote to memory of 1272 4972 s8938050.exe AppLaunch.exe PID 4972 wrote to memory of 1272 4972 s8938050.exe AppLaunch.exe PID 4972 wrote to memory of 1272 4972 s8938050.exe AppLaunch.exe PID 4972 wrote to memory of 1272 4972 s8938050.exe AppLaunch.exe PID 4972 wrote to memory of 1272 4972 s8938050.exe AppLaunch.exe PID 4972 wrote to memory of 1272 4972 s8938050.exe AppLaunch.exe PID 4972 wrote to memory of 1272 4972 s8938050.exe AppLaunch.exe PID 4972 wrote to memory of 1272 4972 s8938050.exe AppLaunch.exe PID 4152 wrote to memory of 3456 4152 z2781294.exe t9217484.exe PID 4152 wrote to memory of 3456 4152 z2781294.exe t9217484.exe PID 4152 wrote to memory of 3456 4152 z2781294.exe t9217484.exe PID 3456 wrote to memory of 4536 3456 t9217484.exe explothe.exe PID 3456 wrote to memory of 4536 3456 t9217484.exe explothe.exe PID 3456 wrote to memory of 4536 3456 t9217484.exe explothe.exe PID 1108 wrote to memory of 2984 1108 z4714489.exe u6527525.exe PID 1108 wrote to memory of 2984 1108 z4714489.exe u6527525.exe PID 1108 wrote to memory of 2984 1108 z4714489.exe u6527525.exe PID 4536 wrote to memory of 2632 4536 explothe.exe schtasks.exe PID 4536 wrote to memory of 2632 4536 explothe.exe schtasks.exe PID 4536 wrote to memory of 2632 4536 explothe.exe schtasks.exe PID 4536 wrote to memory of 4380 4536 explothe.exe cmd.exe PID 4536 wrote to memory of 4380 4536 explothe.exe cmd.exe PID 4536 wrote to memory of 4380 4536 explothe.exe cmd.exe PID 2984 wrote to memory of 408 2984 u6527525.exe legota.exe PID 2984 wrote to memory of 408 2984 u6527525.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exe"C:\Users\Admin\AppData\Local\Temp\a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4714489.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4714489.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2781294.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2781294.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4011834.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4011834.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3308160.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3308160.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3496603.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3496603.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 5887⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0909073.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0909073.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8938050.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8938050.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 5846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9217484.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9217484.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6527525.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6527525.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9113176.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9113176.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 896 -ip 8961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1716 -ip 17161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3940 -ip 39401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4972 -ip 49721⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9113176.exeFilesize
23KB
MD570b80c357f0629d81e42366d7e856680
SHA100402285b24c558a2ff2741ca60fa9546e0ded48
SHA256007b4315503d2d0a0a2fc55bb6bab90172070fc9be09e849ab774996547cf33e
SHA51219596554b6312a51b98235b111b3c8cc23cc1522971109c8c7f58ca8493d6a112ad327bea7e73364a20ff73d60a9c03512eaec3e731073cf4e2913f06ee1f4fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9113176.exeFilesize
23KB
MD570b80c357f0629d81e42366d7e856680
SHA100402285b24c558a2ff2741ca60fa9546e0ded48
SHA256007b4315503d2d0a0a2fc55bb6bab90172070fc9be09e849ab774996547cf33e
SHA51219596554b6312a51b98235b111b3c8cc23cc1522971109c8c7f58ca8493d6a112ad327bea7e73364a20ff73d60a9c03512eaec3e731073cf4e2913f06ee1f4fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4714489.exeFilesize
981KB
MD5afc997bfe75cc1dce365498ff2a2594b
SHA14629b5d66f9114f5e0b1f0f01890ab3336af333c
SHA2569acb855a37d331bdb3c8e35dfa006e462b100fa848c86038746c6277b3f8aa03
SHA5125f32e2056cda727798be26f69c259f28191e6820156302a8e902f43b35eb7572aa56769a4d678f719c961dccf34936d89109575bccb2304579b91ae4d9ef9d8c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4714489.exeFilesize
981KB
MD5afc997bfe75cc1dce365498ff2a2594b
SHA14629b5d66f9114f5e0b1f0f01890ab3336af333c
SHA2569acb855a37d331bdb3c8e35dfa006e462b100fa848c86038746c6277b3f8aa03
SHA5125f32e2056cda727798be26f69c259f28191e6820156302a8e902f43b35eb7572aa56769a4d678f719c961dccf34936d89109575bccb2304579b91ae4d9ef9d8c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6527525.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6527525.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2781294.exeFilesize
799KB
MD5feed44f231e72ff5750598a3fb6e7e9a
SHA18d8fb2ee5a040c934ee5744f7f2d37ceb1c98797
SHA256a652d0c8623a4b4156aa21085cf157645cf5473076c41350f72b51b158563318
SHA51286b96d38979670895955d8e4017c6a999daf85216043fd252a4cac4c614fde48b5be8aecc11bf6ba9382b33ffb7ef1c7564989c25c8dcd563395864afc72d45c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2781294.exeFilesize
799KB
MD5feed44f231e72ff5750598a3fb6e7e9a
SHA18d8fb2ee5a040c934ee5744f7f2d37ceb1c98797
SHA256a652d0c8623a4b4156aa21085cf157645cf5473076c41350f72b51b158563318
SHA51286b96d38979670895955d8e4017c6a999daf85216043fd252a4cac4c614fde48b5be8aecc11bf6ba9382b33ffb7ef1c7564989c25c8dcd563395864afc72d45c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9217484.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9217484.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4011834.exeFilesize
616KB
MD5abfbaeeadb491074a90038079980501b
SHA149e80a5cf119cb0838d9b3c10f5d410da60bce96
SHA2565e150e6c9697f5f5de983373a9e005bf2a11c36849a634808aa14f8580c66bfe
SHA51297c010a82dd79c064c346f947f616c78552a4b00e38c0ff27fa67e078beaea26e6e3b1a57f5acb9d89335282ad29f20afa2897226e154927b3883fa2182736c5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4011834.exeFilesize
616KB
MD5abfbaeeadb491074a90038079980501b
SHA149e80a5cf119cb0838d9b3c10f5d410da60bce96
SHA2565e150e6c9697f5f5de983373a9e005bf2a11c36849a634808aa14f8580c66bfe
SHA51297c010a82dd79c064c346f947f616c78552a4b00e38c0ff27fa67e078beaea26e6e3b1a57f5acb9d89335282ad29f20afa2897226e154927b3883fa2182736c5
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8938050.exeFilesize
390KB
MD5d2d99b316450e9b24b62246901d563b7
SHA1f3f435c4174b56b2667adb33ea121c2211d9381f
SHA2569ea9881d4c9f56f710dd86a768bb4f6388e796667199b66bb84c8eff5d6b34f9
SHA51295d89253fb2a58d037ae55295e85b684dd464abdaf67fdb7d6a67c90b36a1d8fd70e680f7b091bb48bd93dc977e01176f3764226762c6db49e07be2f993de4d3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8938050.exeFilesize
390KB
MD5d2d99b316450e9b24b62246901d563b7
SHA1f3f435c4174b56b2667adb33ea121c2211d9381f
SHA2569ea9881d4c9f56f710dd86a768bb4f6388e796667199b66bb84c8eff5d6b34f9
SHA51295d89253fb2a58d037ae55295e85b684dd464abdaf67fdb7d6a67c90b36a1d8fd70e680f7b091bb48bd93dc977e01176f3764226762c6db49e07be2f993de4d3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3308160.exeFilesize
346KB
MD576464782b738bb7335d6554274001773
SHA193e12538295b6a77631155869f7b6b551f52a837
SHA256147709c30311bf60c9708c1791056a2edd258586a8b6913ae0d12284a74873bd
SHA512f9ae9381c9320b1434ff890344cf05f165969a94f7bf749dfcb90ceef3c4f3bcfcf62ee2dec2b17c65c571e938e13986622d565973326f4e4dbccfd4bc3574e4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3308160.exeFilesize
346KB
MD576464782b738bb7335d6554274001773
SHA193e12538295b6a77631155869f7b6b551f52a837
SHA256147709c30311bf60c9708c1791056a2edd258586a8b6913ae0d12284a74873bd
SHA512f9ae9381c9320b1434ff890344cf05f165969a94f7bf749dfcb90ceef3c4f3bcfcf62ee2dec2b17c65c571e938e13986622d565973326f4e4dbccfd4bc3574e4
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3496603.exeFilesize
227KB
MD54dc642e2f4161d8fe10fbe1b194f1084
SHA18f1e40f5c53646f417a9a7ecdbe2a6806b210ca7
SHA256cecb11e49258ab33656d4b2f2e135ecc24f60fd3ed675e449c599e1eb4e48de2
SHA512d3b0d2ea00f3fc90f61385d675de7a50df73762c10466e4d715e7a5a7edc4ff36ae41717af36f01d74705ff6e423054bb74ff2386948fabf6354a8769cd0d5e0
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3496603.exeFilesize
227KB
MD54dc642e2f4161d8fe10fbe1b194f1084
SHA18f1e40f5c53646f417a9a7ecdbe2a6806b210ca7
SHA256cecb11e49258ab33656d4b2f2e135ecc24f60fd3ed675e449c599e1eb4e48de2
SHA512d3b0d2ea00f3fc90f61385d675de7a50df73762c10466e4d715e7a5a7edc4ff36ae41717af36f01d74705ff6e423054bb74ff2386948fabf6354a8769cd0d5e0
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0909073.exeFilesize
356KB
MD5fb89d73529578428e162d7a9741e69a2
SHA15f5e237b0e4a4ea4c63736c5666e7026ffbbbe75
SHA256b51c34d894ef2481037aea5f0e88a3362fdda0f7bcdf275f0db2695d14b1b459
SHA5120e2eef63da86079f47cb02ca2bb8c8f3744cecce721b5f6c71973c173bf87f4cff837fd545337a04fe8a49c2a791f2ba8e6b2c98df2aebe0f14467558691849b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0909073.exeFilesize
356KB
MD5fb89d73529578428e162d7a9741e69a2
SHA15f5e237b0e4a4ea4c63736c5666e7026ffbbbe75
SHA256b51c34d894ef2481037aea5f0e88a3362fdda0f7bcdf275f0db2695d14b1b459
SHA5120e2eef63da86079f47cb02ca2bb8c8f3744cecce721b5f6c71973c173bf87f4cff837fd545337a04fe8a49c2a791f2ba8e6b2c98df2aebe0f14467558691849b
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1272-89-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/1272-59-0x000000000A900000-0x000000000AA0A000-memory.dmpFilesize
1.0MB
-
memory/1272-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1272-65-0x000000000AA10000-0x000000000AA5C000-memory.dmpFilesize
304KB
-
memory/1272-64-0x000000000A890000-0x000000000A8CC000-memory.dmpFilesize
240KB
-
memory/1272-53-0x00000000738E0000-0x0000000074090000-memory.dmpFilesize
7.7MB
-
memory/1272-54-0x00000000011B0000-0x00000000011B6000-memory.dmpFilesize
24KB
-
memory/1272-88-0x00000000738E0000-0x0000000074090000-memory.dmpFilesize
7.7MB
-
memory/1272-58-0x000000000AE10000-0x000000000B428000-memory.dmpFilesize
6.1MB
-
memory/1272-62-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/1272-63-0x000000000A830000-0x000000000A842000-memory.dmpFilesize
72KB
-
memory/2556-36-0x0000000074110000-0x00000000748C0000-memory.dmpFilesize
7.7MB
-
memory/2556-47-0x0000000074110000-0x00000000748C0000-memory.dmpFilesize
7.7MB
-
memory/2556-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2556-37-0x0000000074110000-0x00000000748C0000-memory.dmpFilesize
7.7MB
-
memory/3940-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3940-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3940-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3940-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB