File name:

32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c

Full analysis: https://app.any.run/tasks/c71bff73-d228-4bc8-a4f7-9f441eb70bc5
Verdict: Malicious activity
Threats:

RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 14:54:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
redline
confuser
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

129EB6C8D6FFDFF670AFDAFACA1215F9

SHA1:

09B08085F4895233DEB0BDBB4E38C6FDA9F1E428

SHA256:

32436C6D52AA87C7D7C11797F6439404EEEB9C7ED810F8BE9366D6C8441ED04C

SSDEEP:

24576:ZLnTKqndISzHdd5235eloeKTkfwiAX49n3OpIKhJk/:ZLnemISzHdd5235eloeKTSwiAI9n3Opu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been detected (YARA)

      • AppLaunch.exe (PID: 7184)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe (PID: 6048)
      • QD0yM60.exe (PID: 4880)

    • Starts a Microsoft application from unusual location

      • 32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe (PID: 6048)
      • QD0yM60.exe (PID: 4880)

    • Process drops legitimate windows executable

      • 32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe (PID: 6048)

    • Reads security settings of Internet Explorer

      • 5bt97Xp.exe (PID: 7204)

    • Starts CMD.EXE for commands execution

      • 5bt97Xp.exe (PID: 7204)

    • Connects to unusual port

      • AppLaunch.exe (PID: 7184)

    • There is functionality for taking screenshot (YARA)

      • AppLaunch.exe (PID: 7184)

    • Executing commands from a ".bat" file

      • 5bt97Xp.exe (PID: 7204)

  • INFO

    • The sample compiled with english language support

      • 32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe (PID: 6048)

    • Checks supported languages

      • 32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe (PID: 6048)
      • QD0yM60.exe (PID: 4880)
      • 3oq343Mi.exe (PID: 5576)
      • AppLaunch.exe (PID: 6728)
      • 4aY6NT8.exe (PID: 4652)
      • 5bt97Xp.exe (PID: 7204)
      • AppLaunch.exe (PID: 7184)

    • Create files in a temporary directory

      • 32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe (PID: 6048)
      • QD0yM60.exe (PID: 4880)
      • 5bt97Xp.exe (PID: 7204)

    • Reads the computer name

      • AppLaunch.exe (PID: 7184)
      • 5bt97Xp.exe (PID: 7204)

    • Process checks computer location settings

      • 5bt97Xp.exe (PID: 7204)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 7184)

    • Confuser has been detected (YARA)

      • AppLaunch.exe (PID: 7184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(7184) AppLaunch.exe
C2 (1)5.42.92.51:19057
Botnettaiga
Options
ErrorMessage
Keys
XorTickets
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 497152
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
14
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe qd0ym60.exe 3oq343mi.exe no specs conhost.exe no specs applaunch.exe no specs 4ay6nt8.exe no specs conhost.exe no specs applaunch.exe no specs #REDLINE applaunch.exe 5bt97xp.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2140"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—4aY6NT8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
5
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4220\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—4aY6NT8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4652C:\Users\admin\AppData\Local\Temp\IXP001.TMP\4aY6NT8.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\4aY6NT8.exe—QD0yM60.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\4ay6nt8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4880C:\Users\admin\AppData\Local\Temp\IXP000.TMP\QD0yM60.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\QD0yM60.exe
32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\qd0ym60.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5048\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—3oq343Mi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5576C:\Users\admin\AppData\Local\Temp\IXP001.TMP\3oq343Mi.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\3oq343Mi.exe—QD0yM60.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\3oq343mi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6048"C:\Users\admin\AppData\Local\Temp\32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe" C:\Users\admin\AppData\Local\Temp\32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6728"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—3oq343Mi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
1
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7184"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
4aY6NT8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
RedLine
(PID) Process(7184) AppLaunch.exe
C2 (1)5.42.92.51:19057
Botnettaiga
Options
ErrorMessage
Keys
XorTickets
7204C:\Users\admin\AppData\Local\Temp\IXP000.TMP\5bt97Xp.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\5bt97Xp.exe—32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\5bt97xp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
2 065
Read events
2 065
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
604832436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\5bt97Xp.exeexecutable
MD5:439A448C7355C564CE60113C44AA9679
SHA256:C7FC582E6E2E9C542B7E1C06B944B06CF71DD159B6C04D1B654D5D886345EEE8
7268cmd.exeC:\Users\admin\AppData\Local\Temp\is64.filtext
MD5:FBB567216D6FA2A929F4FE2389740816
SHA256:D10A6587021A36C1AF3B558DE7D5BDE0C047D0C494454C1ED08B6A19BBCF842A
72045bt97Xp.exeC:\Users\admin\AppData\Local\Temp\is64.txtbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
604832436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\QD0yM60.exeexecutable
MD5:9F068CECEAFCB0F3D9E517CF55057651
SHA256:427FC3CC9522F3A1ABE55DC235C987C56677F4D8204200F5D928915A950D84CC
4880QD0yM60.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\3oq343Mi.exeexecutable
MD5:784667BB96CCB30C4CF44F2C5F493769
SHA256:1025FB084BCA865DF30E69EEA7A9A4A3C852626E148B340DE661E6F5B63BC1C9
72045bt97Xp.exeC:\Users\admin\AppData\Local\Temp\is64.battext
MD5:3CCDA7F84CE40901DECC54FA4C378B65
SHA256:1414F69F5A7123543FFAA21CAB949B359DBA46741EAB3A5DCC9E57DA912B100E
4880QD0yM60.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\4aY6NT8.exeexecutable
MD5:14D9834611AD581AFCFEA061652FF6CB
SHA256:E6E9B3D830F2D7860A09D596576E8AB0131C527B47DDA73FE727B71B44C8CF60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7868
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7868
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7184
AppLaunch.exe
5.42.92.51:19057
—
CJSC Kolomna-Sviaz TV
RU
malicious
6544
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.73
  • 20.190.159.71
  • 40.126.31.2
  • 40.126.31.131
  • 20.190.159.131
  • 20.190.159.130
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
32436c6d52aa87c7d7c11797f6439404eeeb9c7ed810f8be9366d6c8441ed04c