Analysis
-
max time kernel
155s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 08:16
Static task
static1
Behavioral task
behavioral1
Sample
fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exe
Resource
win7-20230831-en
General
-
Target
fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exe
-
Size
1.3MB
-
MD5
8e58a7a85a22d9e7958b4b23615fb98a
-
SHA1
faf329cd4fbb163c083467183d23f66d52b81d08
-
SHA256
fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72
-
SHA512
e7f6660c429f676b76411dca31e557c1d25391daf2449a334feaf55765a0646ba7605505b938619ddf512d8d011a640b1a56fc7f4baa43bdbdbb9ec86ea94b7d
-
SSDEEP
24576:ByRjGe/nLdqo7JoCt/pAWzTFIMqex60f3Y+vTlJjswIrWjwv:04ejdqo7B5qEM6/sajw
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3224-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3224-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3224-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3224-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explonde.exeu6171869.exelegota.exet1872019.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation u6171869.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation t1872019.exe -
Executes dropped EXE 14 IoCs
Processes:
z0151629.exez9854440.exez0408266.exez2319760.exeq8758463.exer6186932.exes8039931.exet1872019.exeexplonde.exeu6171869.exelegota.exew8721110.exelegota.exeexplonde.exepid process 548 z0151629.exe 4180 z9854440.exe 868 z0408266.exe 380 z2319760.exe 4308 q8758463.exe 4392 r6186932.exe 5004 s8039931.exe 1064 t1872019.exe 2336 explonde.exe 436 u6171869.exe 3768 legota.exe 932 w8721110.exe 4760 legota.exe 4252 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 5048 rundll32.exe 1284 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exez0151629.exez9854440.exez0408266.exez2319760.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z0151629.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z9854440.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z0408266.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z2319760.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q8758463.exer6186932.exes8039931.exedescription pid process target process PID 4308 set thread context of 5028 4308 q8758463.exe AppLaunch.exe PID 4392 set thread context of 3224 4392 r6186932.exe AppLaunch.exe PID 5004 set thread context of 2240 5004 s8039931.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1568 4308 WerFault.exe q8758463.exe 3232 4392 WerFault.exe r6186932.exe 1284 3224 WerFault.exe AppLaunch.exe 3640 5004 WerFault.exe s8039931.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2928 schtasks.exe 1824 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 5028 AppLaunch.exe 5028 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 5028 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exez0151629.exez9854440.exez0408266.exez2319760.exeq8758463.exer6186932.exes8039931.exet1872019.exeexplonde.exedescription pid process target process PID 1864 wrote to memory of 548 1864 fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exe z0151629.exe PID 1864 wrote to memory of 548 1864 fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exe z0151629.exe PID 1864 wrote to memory of 548 1864 fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exe z0151629.exe PID 548 wrote to memory of 4180 548 z0151629.exe z9854440.exe PID 548 wrote to memory of 4180 548 z0151629.exe z9854440.exe PID 548 wrote to memory of 4180 548 z0151629.exe z9854440.exe PID 4180 wrote to memory of 868 4180 z9854440.exe z0408266.exe PID 4180 wrote to memory of 868 4180 z9854440.exe z0408266.exe PID 4180 wrote to memory of 868 4180 z9854440.exe z0408266.exe PID 868 wrote to memory of 380 868 z0408266.exe z2319760.exe PID 868 wrote to memory of 380 868 z0408266.exe z2319760.exe PID 868 wrote to memory of 380 868 z0408266.exe z2319760.exe PID 380 wrote to memory of 4308 380 z2319760.exe q8758463.exe PID 380 wrote to memory of 4308 380 z2319760.exe q8758463.exe PID 380 wrote to memory of 4308 380 z2319760.exe q8758463.exe PID 4308 wrote to memory of 5028 4308 q8758463.exe AppLaunch.exe PID 4308 wrote to memory of 5028 4308 q8758463.exe AppLaunch.exe PID 4308 wrote to memory of 5028 4308 q8758463.exe AppLaunch.exe PID 4308 wrote to memory of 5028 4308 q8758463.exe AppLaunch.exe PID 4308 wrote to memory of 5028 4308 q8758463.exe AppLaunch.exe PID 4308 wrote to memory of 5028 4308 q8758463.exe AppLaunch.exe PID 4308 wrote to memory of 5028 4308 q8758463.exe AppLaunch.exe PID 4308 wrote to memory of 5028 4308 q8758463.exe AppLaunch.exe PID 380 wrote to memory of 4392 380 z2319760.exe r6186932.exe PID 380 wrote to memory of 4392 380 z2319760.exe r6186932.exe PID 380 wrote to memory of 4392 380 z2319760.exe r6186932.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 4392 wrote to memory of 3224 4392 r6186932.exe AppLaunch.exe PID 868 wrote to memory of 5004 868 z0408266.exe s8039931.exe PID 868 wrote to memory of 5004 868 z0408266.exe s8039931.exe PID 868 wrote to memory of 5004 868 z0408266.exe s8039931.exe PID 5004 wrote to memory of 2412 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2412 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2412 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2240 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2240 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2240 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2240 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2240 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2240 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2240 5004 s8039931.exe AppLaunch.exe PID 5004 wrote to memory of 2240 5004 s8039931.exe AppLaunch.exe PID 4180 wrote to memory of 1064 4180 z9854440.exe t1872019.exe PID 4180 wrote to memory of 1064 4180 z9854440.exe t1872019.exe PID 4180 wrote to memory of 1064 4180 z9854440.exe t1872019.exe PID 1064 wrote to memory of 2336 1064 t1872019.exe explonde.exe PID 1064 wrote to memory of 2336 1064 t1872019.exe explonde.exe PID 1064 wrote to memory of 2336 1064 t1872019.exe explonde.exe PID 548 wrote to memory of 436 548 z0151629.exe u6171869.exe PID 548 wrote to memory of 436 548 z0151629.exe u6171869.exe PID 548 wrote to memory of 436 548 z0151629.exe u6171869.exe PID 2336 wrote to memory of 2928 2336 explonde.exe schtasks.exe PID 2336 wrote to memory of 2928 2336 explonde.exe schtasks.exe PID 2336 wrote to memory of 2928 2336 explonde.exe schtasks.exe PID 2336 wrote to memory of 3348 2336 explonde.exe cmd.exe PID 2336 wrote to memory of 3348 2336 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exe"C:\Users\Admin\AppData\Local\Temp\fea97a9632b2fb05752c95380528115488913e215910ca357455d06dc22edd72.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0151629.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0151629.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9854440.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9854440.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0408266.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0408266.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2319760.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2319760.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8758463.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8758463.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 5887⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6186932.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6186932.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8039931.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8039931.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 5846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1872019.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1872019.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6171869.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6171869.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8721110.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8721110.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4308 -ip 43081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4392 -ip 43921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3224 -ip 32241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5004 -ip 50041⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8721110.exeFilesize
22KB
MD536bd9afb2013f552cf6aa5808da58320
SHA1945513132b7c21f9dfb80f4bce9c7a1b1d9eea5e
SHA256accc1e5ee78a2bb7e00c50e83705e2fa861bf69c16bc8876038a853db5e0b696
SHA5125f386ef23c4d7b445158e6f6e413493c90792894a8cac163e09e7c265236636695e821bec0808a372a6de129d41d02341560bc479c689eada50f031e86cdfcef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8721110.exeFilesize
22KB
MD536bd9afb2013f552cf6aa5808da58320
SHA1945513132b7c21f9dfb80f4bce9c7a1b1d9eea5e
SHA256accc1e5ee78a2bb7e00c50e83705e2fa861bf69c16bc8876038a853db5e0b696
SHA5125f386ef23c4d7b445158e6f6e413493c90792894a8cac163e09e7c265236636695e821bec0808a372a6de129d41d02341560bc479c689eada50f031e86cdfcef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0151629.exeFilesize
1.2MB
MD561554609e33308770e23bdf3f91487ae
SHA190ed81605c0f1a627249c2e0c1b6f210a30c4c67
SHA256bb2e09c221facf5dea4e4801aa9ec762e434445223d20a972c237e95ad5e653b
SHA51227d3121c6cac8ba8beadcd0a662b5a660b5abc648cbfba02a5bf2f9c5b8fab1921c4b25be567b1aa6b3ef0d5411257b6c7473541a3ccd6d3313a179e56573ea3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0151629.exeFilesize
1.2MB
MD561554609e33308770e23bdf3f91487ae
SHA190ed81605c0f1a627249c2e0c1b6f210a30c4c67
SHA256bb2e09c221facf5dea4e4801aa9ec762e434445223d20a972c237e95ad5e653b
SHA51227d3121c6cac8ba8beadcd0a662b5a660b5abc648cbfba02a5bf2f9c5b8fab1921c4b25be567b1aa6b3ef0d5411257b6c7473541a3ccd6d3313a179e56573ea3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6171869.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6171869.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9854440.exeFilesize
1.0MB
MD53e65d4f8745f621af1f72000a88a145e
SHA11df35037cc0aa26cf53161be844b153f433b11e9
SHA256483f5228655da1edf2ab78e9cf8d9abac1b873286ca696d5ae941a48ded7c974
SHA512406cd41e3eff25003d76052a41000b7776f2fcd7f379ede39d579ff8acfa2a162d0fd336f0c5cda03644d5e41cfb857500564294befe00fcae8347f165e9c5ee
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9854440.exeFilesize
1.0MB
MD53e65d4f8745f621af1f72000a88a145e
SHA11df35037cc0aa26cf53161be844b153f433b11e9
SHA256483f5228655da1edf2ab78e9cf8d9abac1b873286ca696d5ae941a48ded7c974
SHA512406cd41e3eff25003d76052a41000b7776f2fcd7f379ede39d579ff8acfa2a162d0fd336f0c5cda03644d5e41cfb857500564294befe00fcae8347f165e9c5ee
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1872019.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1872019.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0408266.exeFilesize
883KB
MD52f59ffc6c2d1c31a7d85ae0e153e5103
SHA1ac0008723742731d9276c402fadf2a31858d2509
SHA2567a8ae9ab54a926a52ca80d3c12a236d5105a824aaca0da52842f521110f07933
SHA5125d549a9249d900541f15e6f3302bbe10a9020871be464087c105ef75612cf4a758b9043b15322d6020517e13ed3d32898e73a3c7668209614a7ac014b7c649e9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0408266.exeFilesize
883KB
MD52f59ffc6c2d1c31a7d85ae0e153e5103
SHA1ac0008723742731d9276c402fadf2a31858d2509
SHA2567a8ae9ab54a926a52ca80d3c12a236d5105a824aaca0da52842f521110f07933
SHA5125d549a9249d900541f15e6f3302bbe10a9020871be464087c105ef75612cf4a758b9043b15322d6020517e13ed3d32898e73a3c7668209614a7ac014b7c649e9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8039931.exeFilesize
1.0MB
MD5a143c2172a93b7fb9bfcf173c6f38b9b
SHA1bcb17bf54648674303e9c24bb133202fa7ac9a3d
SHA256ebe2df008128f713a776b6116df6c651053832fb2cf3e92f554db3bd4320a7d3
SHA512781e5bfbdd7f266559333b7cd5fa815d122db8b3061b9f69b67cf0108d66d276b631cbc28f6f944bdefbed2f831b3c30efecb732ab7c84272a4e2834bcb0f611
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8039931.exeFilesize
1.0MB
MD5a143c2172a93b7fb9bfcf173c6f38b9b
SHA1bcb17bf54648674303e9c24bb133202fa7ac9a3d
SHA256ebe2df008128f713a776b6116df6c651053832fb2cf3e92f554db3bd4320a7d3
SHA512781e5bfbdd7f266559333b7cd5fa815d122db8b3061b9f69b67cf0108d66d276b631cbc28f6f944bdefbed2f831b3c30efecb732ab7c84272a4e2834bcb0f611
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2319760.exeFilesize
492KB
MD57ac9eb865a8f3042896ba1cc34a18e44
SHA1da1903998ce7fac24b7ae2805c6861fd684dabfb
SHA25688a089b4c0203da6a14ebe82c1652d64706dbd9124c8a877ebe5d50655dab372
SHA512636a83d9e60ac66c1ccfba86ff20b69920179758bb0588b0a3b00f1b5efa75a485e78af8172471b833a840409fbe8c39e9e484c4221718348ad06553fdcf732a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2319760.exeFilesize
492KB
MD57ac9eb865a8f3042896ba1cc34a18e44
SHA1da1903998ce7fac24b7ae2805c6861fd684dabfb
SHA25688a089b4c0203da6a14ebe82c1652d64706dbd9124c8a877ebe5d50655dab372
SHA512636a83d9e60ac66c1ccfba86ff20b69920179758bb0588b0a3b00f1b5efa75a485e78af8172471b833a840409fbe8c39e9e484c4221718348ad06553fdcf732a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8758463.exeFilesize
860KB
MD52f12aa2dacf1d5570aaec93ce6160a90
SHA12534c3b4d6777485013be9d4f58d43b1827f0911
SHA25664e01b4fd85e17f80ae6ec8621e8587b3d447043b4ec7f4ff3a029743c820cd6
SHA5120f53dec3fe34ac6007310a2f3033b3734e0c2820bdef39973f1159fffc63383447061f84df55a393c9a1a528169b90fcf69a18c065a458d9c2e18df2dbf93e84
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8758463.exeFilesize
860KB
MD52f12aa2dacf1d5570aaec93ce6160a90
SHA12534c3b4d6777485013be9d4f58d43b1827f0911
SHA25664e01b4fd85e17f80ae6ec8621e8587b3d447043b4ec7f4ff3a029743c820cd6
SHA5120f53dec3fe34ac6007310a2f3033b3734e0c2820bdef39973f1159fffc63383447061f84df55a393c9a1a528169b90fcf69a18c065a458d9c2e18df2dbf93e84
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6186932.exeFilesize
1016KB
MD5bc43b0a75173a5b55b39b1aed1acd762
SHA16ff37495854041929497d1dc9f4b604183d57b40
SHA2569168ac458771146afee4160f08b240080677104ebb32fcabf8900223d79103c5
SHA512ed969fdadafebeed6545b6a6febc6074983c820fbd391811172026667fcde13bd0dfadb805142eb5bee07ae3c6fa86d9de2ac632d5ed6d931f4ff0121f0d2f56
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6186932.exeFilesize
1016KB
MD5bc43b0a75173a5b55b39b1aed1acd762
SHA16ff37495854041929497d1dc9f4b604183d57b40
SHA2569168ac458771146afee4160f08b240080677104ebb32fcabf8900223d79103c5
SHA512ed969fdadafebeed6545b6a6febc6074983c820fbd391811172026667fcde13bd0dfadb805142eb5bee07ae3c6fa86d9de2ac632d5ed6d931f4ff0121f0d2f56
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2240-62-0x0000000004F00000-0x000000000500A000-memory.dmpFilesize
1.0MB
-
memory/2240-66-0x0000000004E30000-0x0000000004E6C000-memory.dmpFilesize
240KB
-
memory/2240-53-0x00000000736A0000-0x0000000073E50000-memory.dmpFilesize
7.7MB
-
memory/2240-54-0x00000000027A0000-0x00000000027A6000-memory.dmpFilesize
24KB
-
memory/2240-55-0x00000000736A0000-0x0000000073E50000-memory.dmpFilesize
7.7MB
-
memory/2240-73-0x0000000004E80000-0x0000000004ECC000-memory.dmpFilesize
304KB
-
memory/2240-61-0x0000000005410000-0x0000000005A28000-memory.dmpFilesize
6.1MB
-
memory/2240-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2240-89-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/2240-64-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/2240-63-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/3224-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3224-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3224-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3224-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/5028-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/5028-36-0x0000000074310000-0x0000000074AC0000-memory.dmpFilesize
7.7MB
-
memory/5028-45-0x0000000074310000-0x0000000074AC0000-memory.dmpFilesize
7.7MB
-
memory/5028-47-0x0000000074310000-0x0000000074AC0000-memory.dmpFilesize
7.7MB