Analysis
-
max time kernel
159s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 14:07
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.482da641359af077479123af93754850.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.482da641359af077479123af93754850.exe
-
Size
1.4MB
-
MD5
482da641359af077479123af93754850
-
SHA1
af534f2c1685869238d3444e6c0fff6943d8bc2a
-
SHA256
1503e9597a80622b86ccce610b7ca8644c3b5e82bc54e5f76257914981f29580
-
SHA512
2c13e661ddea09e5df56c49c54c38441086cc01d362a8b7e30d22c81f5a05a6d091b8c556ed57b112ec43b2eeb2f897e18f2f2abda052584f629f0becb08620e
-
SSDEEP
24576:7y92BHY0ZhJRNAp4nNKQPonYlkprR+b3XRyAerZy4hx+ulpzxAhm4C3+V3G7PZnZ:usB/3PNAp4NKlY+rwHbEyCx+ulpz2mpt
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3556-59-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explothe.exe5LH9EB9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation 5LH9EB9.exe -
Executes dropped EXE 13 IoCs
Processes:
lZ8PF13.exeTa5ey69.exeTx2bQ56.exelR4ot45.exe1Ar71Op1.exe2fG0407.exe3II19Jv.exe4cL131ol.exe5LH9EB9.exeexplothe.exe6Jj5Vf8.exeexplothe.exeexplothe.exepid process 4204 lZ8PF13.exe 672 Ta5ey69.exe 1496 Tx2bQ56.exe 3860 lR4ot45.exe 4216 1Ar71Op1.exe 4552 2fG0407.exe 2604 3II19Jv.exe 4804 4cL131ol.exe 3132 5LH9EB9.exe 4032 explothe.exe 716 6Jj5Vf8.exe 5068 explothe.exe 3336 explothe.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3004 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
lZ8PF13.exeTa5ey69.exeTx2bQ56.exelR4ot45.exeNEAS.482da641359af077479123af93754850.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" lZ8PF13.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Ta5ey69.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" Tx2bQ56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" lR4ot45.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.482da641359af077479123af93754850.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1Ar71Op1.exe2fG0407.exe4cL131ol.exedescription pid process target process PID 4216 set thread context of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 4552 set thread context of 2600 4552 2fG0407.exe AppLaunch.exe PID 4804 set thread context of 3556 4804 4cL131ol.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2452 4216 WerFault.exe 1Ar71Op1.exe 1752 4552 WerFault.exe 2fG0407.exe 5012 2600 WerFault.exe AppLaunch.exe 4364 4804 WerFault.exe 4cL131ol.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3II19Jv.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3II19Jv.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3II19Jv.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3II19Jv.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AppLaunch.exe3II19Jv.exepid process 2352 AppLaunch.exe 2352 AppLaunch.exe 2604 3II19Jv.exe 2604 3II19Jv.exe 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 3296 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3296 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3II19Jv.exepid process 2604 3II19Jv.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2352 AppLaunch.exe Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 Token: SeShutdownPrivilege 3296 Token: SeCreatePagefilePrivilege 3296 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 3296 3296 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
NEAS.482da641359af077479123af93754850.exelZ8PF13.exeTa5ey69.exeTx2bQ56.exelR4ot45.exe1Ar71Op1.exe2fG0407.exe4cL131ol.exe5LH9EB9.exeexplothe.exedescription pid process target process PID 2564 wrote to memory of 4204 2564 NEAS.482da641359af077479123af93754850.exe lZ8PF13.exe PID 2564 wrote to memory of 4204 2564 NEAS.482da641359af077479123af93754850.exe lZ8PF13.exe PID 2564 wrote to memory of 4204 2564 NEAS.482da641359af077479123af93754850.exe lZ8PF13.exe PID 4204 wrote to memory of 672 4204 lZ8PF13.exe Ta5ey69.exe PID 4204 wrote to memory of 672 4204 lZ8PF13.exe Ta5ey69.exe PID 4204 wrote to memory of 672 4204 lZ8PF13.exe Ta5ey69.exe PID 672 wrote to memory of 1496 672 Ta5ey69.exe Tx2bQ56.exe PID 672 wrote to memory of 1496 672 Ta5ey69.exe Tx2bQ56.exe PID 672 wrote to memory of 1496 672 Ta5ey69.exe Tx2bQ56.exe PID 1496 wrote to memory of 3860 1496 Tx2bQ56.exe lR4ot45.exe PID 1496 wrote to memory of 3860 1496 Tx2bQ56.exe lR4ot45.exe PID 1496 wrote to memory of 3860 1496 Tx2bQ56.exe lR4ot45.exe PID 3860 wrote to memory of 4216 3860 lR4ot45.exe 1Ar71Op1.exe PID 3860 wrote to memory of 4216 3860 lR4ot45.exe 1Ar71Op1.exe PID 3860 wrote to memory of 4216 3860 lR4ot45.exe 1Ar71Op1.exe PID 4216 wrote to memory of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 4216 wrote to memory of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 4216 wrote to memory of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 4216 wrote to memory of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 4216 wrote to memory of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 4216 wrote to memory of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 4216 wrote to memory of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 4216 wrote to memory of 2352 4216 1Ar71Op1.exe AppLaunch.exe PID 3860 wrote to memory of 4552 3860 lR4ot45.exe 2fG0407.exe PID 3860 wrote to memory of 4552 3860 lR4ot45.exe 2fG0407.exe PID 3860 wrote to memory of 4552 3860 lR4ot45.exe 2fG0407.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 4552 wrote to memory of 2600 4552 2fG0407.exe AppLaunch.exe PID 1496 wrote to memory of 2604 1496 Tx2bQ56.exe 3II19Jv.exe PID 1496 wrote to memory of 2604 1496 Tx2bQ56.exe 3II19Jv.exe PID 1496 wrote to memory of 2604 1496 Tx2bQ56.exe 3II19Jv.exe PID 672 wrote to memory of 4804 672 Ta5ey69.exe 4cL131ol.exe PID 672 wrote to memory of 4804 672 Ta5ey69.exe 4cL131ol.exe PID 672 wrote to memory of 4804 672 Ta5ey69.exe 4cL131ol.exe PID 4804 wrote to memory of 3556 4804 4cL131ol.exe AppLaunch.exe PID 4804 wrote to memory of 3556 4804 4cL131ol.exe AppLaunch.exe PID 4804 wrote to memory of 3556 4804 4cL131ol.exe AppLaunch.exe PID 4804 wrote to memory of 3556 4804 4cL131ol.exe AppLaunch.exe PID 4804 wrote to memory of 3556 4804 4cL131ol.exe AppLaunch.exe PID 4804 wrote to memory of 3556 4804 4cL131ol.exe AppLaunch.exe PID 4804 wrote to memory of 3556 4804 4cL131ol.exe AppLaunch.exe PID 4804 wrote to memory of 3556 4804 4cL131ol.exe AppLaunch.exe PID 4204 wrote to memory of 3132 4204 lZ8PF13.exe 5LH9EB9.exe PID 4204 wrote to memory of 3132 4204 lZ8PF13.exe 5LH9EB9.exe PID 4204 wrote to memory of 3132 4204 lZ8PF13.exe 5LH9EB9.exe PID 3132 wrote to memory of 4032 3132 5LH9EB9.exe explothe.exe PID 3132 wrote to memory of 4032 3132 5LH9EB9.exe explothe.exe PID 3132 wrote to memory of 4032 3132 5LH9EB9.exe explothe.exe PID 2564 wrote to memory of 716 2564 NEAS.482da641359af077479123af93754850.exe 6Jj5Vf8.exe PID 2564 wrote to memory of 716 2564 NEAS.482da641359af077479123af93754850.exe 6Jj5Vf8.exe PID 2564 wrote to memory of 716 2564 NEAS.482da641359af077479123af93754850.exe 6Jj5Vf8.exe PID 4032 wrote to memory of 2420 4032 explothe.exe schtasks.exe PID 4032 wrote to memory of 2420 4032 explothe.exe schtasks.exe PID 4032 wrote to memory of 2420 4032 explothe.exe schtasks.exe PID 4032 wrote to memory of 1508 4032 explothe.exe cmd.exe PID 4032 wrote to memory of 1508 4032 explothe.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.482da641359af077479123af93754850.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.482da641359af077479123af93754850.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lZ8PF13.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lZ8PF13.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ta5ey69.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ta5ey69.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tx2bQ56.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tx2bQ56.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\lR4ot45.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\lR4ot45.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ar71Op1.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ar71Op1.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 5847⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2fG0407.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2fG0407.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 5847⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3II19Jv.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3II19Jv.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4cL131ol.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4cL131ol.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 5845⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5LH9EB9.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5LH9EB9.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Jj5Vf8.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Jj5Vf8.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4216 -ip 42161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4552 -ip 45521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2600 -ip 26001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4804 -ip 48041⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Jj5Vf8.exeFilesize
183KB
MD5100bbeece8bed03c8514a4a41f6589c4
SHA1d0697d85a56a2ce02b0456c68ea322bfcd55faa0
SHA256bf88288c23cf003f3fd095c0c5c3aa4b1b8486f50205b6e6d1fb84364f4b6a83
SHA512de9d7063e71a3602e7bc09bd7d9aba7e49d0b38b1038b193ffaa2bd1b5b21a76017a00460234c535793b7fddb435dd582e8a7447f66e15d1b64da2ccd266d979
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Jj5Vf8.exeFilesize
183KB
MD5100bbeece8bed03c8514a4a41f6589c4
SHA1d0697d85a56a2ce02b0456c68ea322bfcd55faa0
SHA256bf88288c23cf003f3fd095c0c5c3aa4b1b8486f50205b6e6d1fb84364f4b6a83
SHA512de9d7063e71a3602e7bc09bd7d9aba7e49d0b38b1038b193ffaa2bd1b5b21a76017a00460234c535793b7fddb435dd582e8a7447f66e15d1b64da2ccd266d979
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lZ8PF13.exeFilesize
1.2MB
MD55c79ad521a07514d014a6bd1470c2339
SHA12a54df7133f8ce67284de47cf63ca6c8e3fa863a
SHA2566bdad0c7a2ec39214ec867558f515d300b9e3bdebc27a9bb6aae7a213232e8a1
SHA512d907c65729814318bc265054a828b54ea47564e064086e234eb84ebc1edbdca0f7d3ea4d81c68c3ca508ba4252a5ed105ac5934f372368585d3d11bf627be657
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lZ8PF13.exeFilesize
1.2MB
MD55c79ad521a07514d014a6bd1470c2339
SHA12a54df7133f8ce67284de47cf63ca6c8e3fa863a
SHA2566bdad0c7a2ec39214ec867558f515d300b9e3bdebc27a9bb6aae7a213232e8a1
SHA512d907c65729814318bc265054a828b54ea47564e064086e234eb84ebc1edbdca0f7d3ea4d81c68c3ca508ba4252a5ed105ac5934f372368585d3d11bf627be657
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5LH9EB9.exeFilesize
220KB
MD5d1da33a6a99a032867e126ca5c4718b0
SHA1acee381622c6d2c01138a71fede00998f1eed42f
SHA256c539225455967e4148ec73f2b4fb66bef081f12523861e81763287b946d4113a
SHA512cf9abf424ebf59ee2166bd38e415f7cc8503e5102cd32fdb5d763aa02ce79913fde6d879663ba0d6651ebe7f417f0b02929807dbc0148f1002fb1bae14d69e3c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5LH9EB9.exeFilesize
220KB
MD5d1da33a6a99a032867e126ca5c4718b0
SHA1acee381622c6d2c01138a71fede00998f1eed42f
SHA256c539225455967e4148ec73f2b4fb66bef081f12523861e81763287b946d4113a
SHA512cf9abf424ebf59ee2166bd38e415f7cc8503e5102cd32fdb5d763aa02ce79913fde6d879663ba0d6651ebe7f417f0b02929807dbc0148f1002fb1bae14d69e3c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ta5ey69.exeFilesize
1.0MB
MD5eb6b40f6ee48c01382869863d6984da3
SHA112de373570d4c22e817826f74f5e97cb62238e1a
SHA256323d651f340d2f266b0cd754d35e51d7ae1f3d4bcc145b5610c8cfceaddda96a
SHA512842a7dc1705a2f4420d8dadd7456c7afdad8eadd1697f5a571724a6a7d61db4e54031e064ceab7609861aa2c8806a571452096fd62b6939edd26f7627d019a9b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ta5ey69.exeFilesize
1.0MB
MD5eb6b40f6ee48c01382869863d6984da3
SHA112de373570d4c22e817826f74f5e97cb62238e1a
SHA256323d651f340d2f266b0cd754d35e51d7ae1f3d4bcc145b5610c8cfceaddda96a
SHA512842a7dc1705a2f4420d8dadd7456c7afdad8eadd1697f5a571724a6a7d61db4e54031e064ceab7609861aa2c8806a571452096fd62b6939edd26f7627d019a9b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4cL131ol.exeFilesize
1.1MB
MD570b22743f8d88b3830ac5d844d71342a
SHA197efb5c093de5d460b2e5c88c6788f68b114a25a
SHA25648cb75631ae8e99b1fa08d60ae879217c0a1b9b8d3d6b9c063b9faf267284fee
SHA51294c9938e53bc2d5a42469fac8965ba394c80246bd38ba40ec4eea1b910ccbd11a12e513af882cf0168da5f617b4a122913b99715cfc4601086e576a5f5861fc6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4cL131ol.exeFilesize
1.1MB
MD570b22743f8d88b3830ac5d844d71342a
SHA197efb5c093de5d460b2e5c88c6788f68b114a25a
SHA25648cb75631ae8e99b1fa08d60ae879217c0a1b9b8d3d6b9c063b9faf267284fee
SHA51294c9938e53bc2d5a42469fac8965ba394c80246bd38ba40ec4eea1b910ccbd11a12e513af882cf0168da5f617b4a122913b99715cfc4601086e576a5f5861fc6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tx2bQ56.exeFilesize
650KB
MD53fbc26ae843f868dbcb26958fc73df69
SHA19a1868360b6af2a5180efc90fb3197571584aef4
SHA2568c931bf8931b23c7721ef00c0a5764fd6dd0cb80a8190d0e0d42106c5ec75b8f
SHA512ce1c0c9512776aea7eb94f22f9ce3eee7e4894f7e36349a966c15aef0545cfa002d5b49dfa79345c6effd3085ef7aa39db6a6b602c42ce9c33660fec643b5859
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tx2bQ56.exeFilesize
650KB
MD53fbc26ae843f868dbcb26958fc73df69
SHA19a1868360b6af2a5180efc90fb3197571584aef4
SHA2568c931bf8931b23c7721ef00c0a5764fd6dd0cb80a8190d0e0d42106c5ec75b8f
SHA512ce1c0c9512776aea7eb94f22f9ce3eee7e4894f7e36349a966c15aef0545cfa002d5b49dfa79345c6effd3085ef7aa39db6a6b602c42ce9c33660fec643b5859
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3II19Jv.exeFilesize
30KB
MD55f64a59ecdfe3bd21b4f3fc023f849e0
SHA1d07d2fc8fd0feb24ac4b7d0ea632c3536dcf55bb
SHA25622fc6e694e7ee52e07377232b1315f439767ef45acd7a174f75485901825c34e
SHA512758c0485fac2912bfa0abf3e4213c6450ce22af53cb5e94b62ea02feda45b651d3b8978f619c58054292bd5a1b31847466577b5fb1d01212a3ef6405c4db277e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3II19Jv.exeFilesize
30KB
MD55f64a59ecdfe3bd21b4f3fc023f849e0
SHA1d07d2fc8fd0feb24ac4b7d0ea632c3536dcf55bb
SHA25622fc6e694e7ee52e07377232b1315f439767ef45acd7a174f75485901825c34e
SHA512758c0485fac2912bfa0abf3e4213c6450ce22af53cb5e94b62ea02feda45b651d3b8978f619c58054292bd5a1b31847466577b5fb1d01212a3ef6405c4db277e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\lR4ot45.exeFilesize
526KB
MD5374179bb3f7800974d43ea7f0174db4d
SHA16c4359f2c9a88912c00ed9485a64dd66f8845283
SHA2565b4134a775a6c3ae5f7d1bd06de263f2bb138f767eee882092a4c365bf7465f4
SHA5127207a6d34fcc6aa667b75124870a8a6a513c818367f946d3d2d7e02e940a9bea092b12642eb2bf4458076a3db08b8200fb4092aa7aa44353001cd9199f084178
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\lR4ot45.exeFilesize
526KB
MD5374179bb3f7800974d43ea7f0174db4d
SHA16c4359f2c9a88912c00ed9485a64dd66f8845283
SHA2565b4134a775a6c3ae5f7d1bd06de263f2bb138f767eee882092a4c365bf7465f4
SHA5127207a6d34fcc6aa667b75124870a8a6a513c818367f946d3d2d7e02e940a9bea092b12642eb2bf4458076a3db08b8200fb4092aa7aa44353001cd9199f084178
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ar71Op1.exeFilesize
890KB
MD567c15a718a3baf99e7df6971b1839983
SHA1b1d0f80bc3e8574abe90b8438ebafc43641675e5
SHA256ea8ab5bcb03300684d1704345b4aabd0e40cd726e2b9a6803eda878c44c1a3f9
SHA5126e73540a6a1c561fd0b57f8c360876bb10bc41671a3a7240d8fc207582ee2f85319a917097ae83207714f6d202e096aad16cecd7095ec098a0ab8e4a54d83760
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ar71Op1.exeFilesize
890KB
MD567c15a718a3baf99e7df6971b1839983
SHA1b1d0f80bc3e8574abe90b8438ebafc43641675e5
SHA256ea8ab5bcb03300684d1704345b4aabd0e40cd726e2b9a6803eda878c44c1a3f9
SHA5126e73540a6a1c561fd0b57f8c360876bb10bc41671a3a7240d8fc207582ee2f85319a917097ae83207714f6d202e096aad16cecd7095ec098a0ab8e4a54d83760
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2fG0407.exeFilesize
1.1MB
MD54ddfa486d37c166d7f8028d716e183a1
SHA10483954e904196b29207bad18bfcfc600d010131
SHA256f3f79ebd412f4e7e5d854c17f4180c6245ae051bc04501473e631d31fbbbfa2f
SHA51242ede28d0211888ae336ef18f09cb506afd3b7d5f5669f8693100aa0cfbca5a30374ae2a8289ab42b2fadbd5630a9d25117dfaf3e900548b270da634bf7fa31e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2fG0407.exeFilesize
1.1MB
MD54ddfa486d37c166d7f8028d716e183a1
SHA10483954e904196b29207bad18bfcfc600d010131
SHA256f3f79ebd412f4e7e5d854c17f4180c6245ae051bc04501473e631d31fbbbfa2f
SHA51242ede28d0211888ae336ef18f09cb506afd3b7d5f5669f8693100aa0cfbca5a30374ae2a8289ab42b2fadbd5630a9d25117dfaf3e900548b270da634bf7fa31e
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
220KB
MD5d1da33a6a99a032867e126ca5c4718b0
SHA1acee381622c6d2c01138a71fede00998f1eed42f
SHA256c539225455967e4148ec73f2b4fb66bef081f12523861e81763287b946d4113a
SHA512cf9abf424ebf59ee2166bd38e415f7cc8503e5102cd32fdb5d763aa02ce79913fde6d879663ba0d6651ebe7f417f0b02929807dbc0148f1002fb1bae14d69e3c
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
220KB
MD5d1da33a6a99a032867e126ca5c4718b0
SHA1acee381622c6d2c01138a71fede00998f1eed42f
SHA256c539225455967e4148ec73f2b4fb66bef081f12523861e81763287b946d4113a
SHA512cf9abf424ebf59ee2166bd38e415f7cc8503e5102cd32fdb5d763aa02ce79913fde6d879663ba0d6651ebe7f417f0b02929807dbc0148f1002fb1bae14d69e3c
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
220KB
MD5d1da33a6a99a032867e126ca5c4718b0
SHA1acee381622c6d2c01138a71fede00998f1eed42f
SHA256c539225455967e4148ec73f2b4fb66bef081f12523861e81763287b946d4113a
SHA512cf9abf424ebf59ee2166bd38e415f7cc8503e5102cd32fdb5d763aa02ce79913fde6d879663ba0d6651ebe7f417f0b02929807dbc0148f1002fb1bae14d69e3c
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
220KB
MD5d1da33a6a99a032867e126ca5c4718b0
SHA1acee381622c6d2c01138a71fede00998f1eed42f
SHA256c539225455967e4148ec73f2b4fb66bef081f12523861e81763287b946d4113a
SHA512cf9abf424ebf59ee2166bd38e415f7cc8503e5102cd32fdb5d763aa02ce79913fde6d879663ba0d6651ebe7f417f0b02929807dbc0148f1002fb1bae14d69e3c
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
220KB
MD5d1da33a6a99a032867e126ca5c4718b0
SHA1acee381622c6d2c01138a71fede00998f1eed42f
SHA256c539225455967e4148ec73f2b4fb66bef081f12523861e81763287b946d4113a
SHA512cf9abf424ebf59ee2166bd38e415f7cc8503e5102cd32fdb5d763aa02ce79913fde6d879663ba0d6651ebe7f417f0b02929807dbc0148f1002fb1bae14d69e3c
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
memory/2352-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2352-58-0x00000000746D0000-0x0000000074E80000-memory.dmpFilesize
7.7MB
-
memory/2352-49-0x00000000746D0000-0x0000000074E80000-memory.dmpFilesize
7.7MB
-
memory/2352-36-0x00000000746D0000-0x0000000074E80000-memory.dmpFilesize
7.7MB
-
memory/2600-44-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2600-42-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2600-41-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2600-40-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2604-52-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2604-47-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3296-104-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-108-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-50-0x0000000002DB0000-0x0000000002DC6000-memory.dmpFilesize
88KB
-
memory/3296-103-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-122-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-123-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-124-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-119-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-121-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-89-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-90-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-91-0x0000000002D90000-0x0000000002DA0000-memory.dmpFilesize
64KB
-
memory/3296-92-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-93-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-94-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-96-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-98-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-95-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-101-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-100-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-102-0x0000000002F00000-0x0000000002F10000-memory.dmpFilesize
64KB
-
memory/3296-120-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-106-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-118-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-110-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-112-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-114-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-115-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3296-116-0x0000000002F00000-0x0000000002F10000-memory.dmpFilesize
64KB
-
memory/3296-105-0x0000000002F00000-0x0000000002F10000-memory.dmpFilesize
64KB
-
memory/3296-117-0x0000000002F70000-0x0000000002F80000-memory.dmpFilesize
64KB
-
memory/3556-84-0x0000000008520000-0x000000000862A000-memory.dmpFilesize
1.0MB
-
memory/3556-75-0x00000000746D0000-0x0000000074E80000-memory.dmpFilesize
7.7MB
-
memory/3556-88-0x0000000007E30000-0x0000000007E7C000-memory.dmpFilesize
304KB
-
memory/3556-87-0x0000000007DF0000-0x0000000007E2C000-memory.dmpFilesize
240KB
-
memory/3556-74-0x0000000007C90000-0x0000000007C9A000-memory.dmpFilesize
40KB
-
memory/3556-85-0x0000000007D60000-0x0000000007D72000-memory.dmpFilesize
72KB
-
memory/3556-69-0x0000000007C40000-0x0000000007C50000-memory.dmpFilesize
64KB
-
memory/3556-83-0x0000000007C40000-0x0000000007C50000-memory.dmpFilesize
64KB
-
memory/3556-66-0x0000000007AA0000-0x0000000007B32000-memory.dmpFilesize
584KB
-
memory/3556-62-0x0000000007F70000-0x0000000008514000-memory.dmpFilesize
5.6MB
-
memory/3556-61-0x00000000746D0000-0x0000000074E80000-memory.dmpFilesize
7.7MB
-
memory/3556-59-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3556-82-0x0000000008B40000-0x0000000009158000-memory.dmpFilesize
6.1MB