File name:

016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda

Full analysis: https://app.any.run/tasks/ba40b981-54f3-422f-9852-7c10c2141d52
Verdict: Malicious activity
Threats:

RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 16:57:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
redline
confuser
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

55D3F5B28D5529172277422019DD5D12

SHA1:

09365561B4326F09712CCDDCD37657831A67C3C1

SHA256:

016BAD4B781A10F61E8A1AD24ECD6641089F12099046C97E2D8D624D30656CDA

SSDEEP:

24576:xLnTKqndIAmlEukHdbusxQholoeKtkfwiAX4TWdgpAf:xLnemIAmlEukHdbusxQholoeKtSwiAIG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been detected (YARA)

      • AppLaunch.exe (PID: 7600)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe (PID: 7384)

    • Starts a Microsoft application from unusual location

      • 016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe (PID: 7384)
      • My2kq93.exe (PID: 7404)

    • Reads security settings of Internet Explorer

      • 5KB39Jp.exe (PID: 7620)

    • Executable content was dropped or overwritten

      • 016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe (PID: 7384)
      • My2kq93.exe (PID: 7404)

    • Starts CMD.EXE for commands execution

      • 5KB39Jp.exe (PID: 7620)

    • Executing commands from a ".bat" file

      • 5KB39Jp.exe (PID: 7620)

    • Connects to unusual port

      • AppLaunch.exe (PID: 7600)

    • There is functionality for taking screenshot (YARA)

      • AppLaunch.exe (PID: 7600)

  • INFO

    • Checks supported languages

      • 5KB39Jp.exe (PID: 7620)
      • My2kq93.exe (PID: 7404)
      • 3Gs584tu.exe (PID: 7432)
      • 4wt2Fr8.exe (PID: 7528)
      • AppLaunch.exe (PID: 7516)
      • AppLaunch.exe (PID: 7600)
      • 016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe (PID: 7384)

    • Create files in a temporary directory

      • 016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe (PID: 7384)
      • My2kq93.exe (PID: 7404)
      • 5KB39Jp.exe (PID: 7620)

    • Process checks computer location settings

      • 5KB39Jp.exe (PID: 7620)

    • Reads the computer name

      • AppLaunch.exe (PID: 7600)
      • 5KB39Jp.exe (PID: 7620)

    • The sample compiled with english language support

      • 016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe (PID: 7384)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 7600)

    • Confuser has been detected (YARA)

      • AppLaunch.exe (PID: 7600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(7600) AppLaunch.exe
C2 (1)5.42.92.51:19057
Botnettaiga
Options
ErrorMessage
Keys
XorTickets
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 496640
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
14
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe my2kq93.exe 3gs584tu.exe no specs conhost.exe no specs applaunch.exe no specs 4wt2fr8.exe no specs conhost.exe no specs applaunch.exe no specs #REDLINE applaunch.exe 5kb39jp.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7384"C:\Users\admin\AppData\Local\Temp\016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe" C:\Users\admin\AppData\Local\Temp\016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7404C:\Users\admin\AppData\Local\Temp\IXP000.TMP\My2kq93.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\My2kq93.exe
016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\my2kq93.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7432C:\Users\admin\AppData\Local\Temp\IXP001.TMP\3Gs584tu.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\3Gs584tu.exe—My2kq93.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\3gs584tu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7452\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—3Gs584tu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7516"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—3Gs584tu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
1
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7528C:\Users\admin\AppData\Local\Temp\IXP001.TMP\4wt2Fr8.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\4wt2Fr8.exe—My2kq93.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\4wt2fr8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—4wt2Fr8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7592"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—4wt2Fr8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
5
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7600"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
4wt2Fr8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
RedLine
(PID) Process(7600) AppLaunch.exe
C2 (1)5.42.92.51:19057
Botnettaiga
Options
ErrorMessage
Keys
XorTickets
7620C:\Users\admin\AppData\Local\Temp\IXP000.TMP\5KB39Jp.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\5KB39Jp.exe—016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\5kb39jp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
2 068
Read events
2 068
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
76205KB39Jp.exeC:\Users\admin\AppData\Local\Temp\is64.txtbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
7404My2kq93.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\3Gs584tu.exeexecutable
MD5:784667BB96CCB30C4CF44F2C5F493769
SHA256:1025FB084BCA865DF30E69EEA7A9A4A3C852626E148B340DE661E6F5B63BC1C9
7384016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\5KB39Jp.exeexecutable
MD5:79926320DE53496B8835F1D601729D28
SHA256:B3DB9BE75345DEAF17F062A7F98A2D0516ECCCB9B7C0A08855EA63F4F206E7FA
7404My2kq93.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\4wt2Fr8.exeexecutable
MD5:14D9834611AD581AFCFEA061652FF6CB
SHA256:E6E9B3D830F2D7860A09D596576E8AB0131C527B47DDA73FE727B71B44C8CF60
7700cmd.exeC:\Users\admin\AppData\Local\Temp\is64.filtext
MD5:FBB567216D6FA2A929F4FE2389740816
SHA256:D10A6587021A36C1AF3B558DE7D5BDE0C047D0C494454C1ED08B6A19BBCF842A
7384016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\My2kq93.exeexecutable
MD5:B0D13F6ED9006FDD247897CB49036427
SHA256:22227096B2E59C9F68529CD55C613A7838348FBA12F93F4147BF1AD68C1AA756
76205KB39Jp.exeC:\Users\admin\AppData\Local\Temp\is64.battext
MD5:3CCDA7F84CE40901DECC54FA4C378B65
SHA256:1414F69F5A7123543FFAA21CAB949B359DBA46741EAB3A5DCC9E57DA912B100E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7316
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7316
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7600
AppLaunch.exe
5.42.92.51:19057
—
CJSC Kolomna-Sviaz TV
RU
malicious
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.35
  • 23.216.77.41
  • 23.216.77.30
  • 23.216.77.6
  • 23.216.77.38
  • 23.216.77.42
  • 23.216.77.36
  • 23.216.77.8
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.3
  • 20.190.159.129
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.4
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
016bad4b781a10f61e8a1ad24ecd6641089f12099046c97e2d8d624d30656cda