Analysis

  • max time kernel
    136s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    17/03/2023, 16:45

General

  • Target

    66982a9b92e51b0fa37953e61e12c221.exe

  • Size

    690KB

  • MD5

    66982a9b92e51b0fa37953e61e12c221

  • SHA1

    be7f1f5b5716f4e627d8dc6452ca5d3f208b91f6

  • SHA256

    528b3cff028baa3990a895589ed4933cb9ca0f5451f6635329cfc46f6e9655f8

  • SHA512

    558227508106fd47f647f870ae9be713e90fd153a8c931273d455fa347bff43f986425033d021f2e70650b4b07b4c3a4ce649a9554c14b28eeef4e8f9564abff

  • SSDEEP

    12288:RMr4y90Xw+GVYUfjbccDQDbMRAP88Zah8nXK18ZbwUnrdlWjP8gC39hnUXybr5v2:tyXNVYUncPlZaEaKEmWT8gCXUXwr1pA

Malware Config

Extracted

Family

redline

Botnet

lint

C2

193.233.20.28:4125

Attributes
  • auth_value

    0e95262fb78243c67430f3148303e5b7

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Extracted

Family

redline

Botnet

rockins

C2

46.3.197.223:44446

Attributes
  • auth_value

    e36e02733016977bec980781774c6ef4

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes
  • api_key

    0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 27 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe
    "C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1324
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:672
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:592
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:844
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:916
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:268
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:696
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:672
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:1508
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1348
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:308
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:552
                    • C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      PID:824
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1708
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 272
                        5⤵
                        • Loads dropped DLL
                        • Program crash
                        PID:1192
                    • C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      PID:1080
                      • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
                        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
                        5⤵
                          PID:588
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                        4⤵
                        • Loads dropped DLL
                        PID:1952
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {D12F88E6-7FD3-4784-ADA2-711A884A0752} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]
                  1⤵
                    PID:1668
                    • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                      C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                      2⤵
                      • Executes dropped EXE
                      PID:1872
                    • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                      C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                      2⤵
                      • Executes dropped EXE
                      PID:896

                  Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

                          Filesize

                          1.9MB

                          MD5

                          665c62d3bd6c21614fafb9a9b50bb574

                          SHA1

                          56322f2bb8a61954e6ec974612154402cdd98b29

                          SHA256

                          a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99

                          SHA512

                          07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

                        • C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

                          Filesize

                          1.9MB

                          MD5

                          665c62d3bd6c21614fafb9a9b50bb574

                          SHA1

                          56322f2bb8a61954e6ec974612154402cdd98b29

                          SHA256

                          a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99

                          SHA512

                          07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

                          Filesize

                          503KB

                          MD5

                          96fd4324cf1b42cb2a2ab2f0ecfdc556

                          SHA1

                          cdc9b5998214a27d36592a12e31d6bef1f1a6ea0

                          SHA256

                          c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3

                          SHA512

                          01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

                          Filesize

                          503KB

                          MD5

                          96fd4324cf1b42cb2a2ab2f0ecfdc556

                          SHA1

                          cdc9b5998214a27d36592a12e31d6bef1f1a6ea0

                          SHA256

                          c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3

                          SHA512

                          01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

                          Filesize

                          175KB

                          MD5

                          0ecc8ab62b7278cc6650517251f1543c

                          SHA1

                          b4273cda193a20d48e83241275ffc34ddad412f2

                          SHA256

                          b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                          SHA512

                          c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

                          Filesize

                          175KB

                          MD5

                          0ecc8ab62b7278cc6650517251f1543c

                          SHA1

                          b4273cda193a20d48e83241275ffc34ddad412f2

                          SHA256

                          b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                          SHA512

                          c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

                          Filesize

                          358KB

                          MD5

                          e20361ff126992cdcdb205184622a9d5

                          SHA1

                          8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd

                          SHA256

                          b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811

                          SHA512

                          23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

                          Filesize

                          358KB

                          MD5

                          e20361ff126992cdcdb205184622a9d5

                          SHA1

                          8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd

                          SHA256

                          b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811

                          SHA512

                          23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

                          Filesize

                          11KB

                          MD5

                          7e93bacbbc33e6652e147e7fe07572a0

                          SHA1

                          421a7167da01c8da4dc4d5234ca3dd84e319e762

                          SHA256

                          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                          SHA512

                          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

                          Filesize

                          11KB

                          MD5

                          7e93bacbbc33e6652e147e7fe07572a0

                          SHA1

                          421a7167da01c8da4dc4d5234ca3dd84e319e762

                          SHA256

                          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                          SHA512

                          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

                          Filesize

                          342KB

                          MD5

                          0cae30de372cd7136ebb67ceed17ba77

                          SHA1

                          1f6c6aa533567560208d22a9d42893329be60343

                          SHA256

                          419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e

                          SHA512

                          06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

                          Filesize

                          342KB

                          MD5

                          0cae30de372cd7136ebb67ceed17ba77

                          SHA1

                          1f6c6aa533567560208d22a9d42893329be60343

                          SHA256

                          419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e

                          SHA512

                          06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

                          Filesize

                          342KB

                          MD5

                          0cae30de372cd7136ebb67ceed17ba77

                          SHA1

                          1f6c6aa533567560208d22a9d42893329be60343

                          SHA256

                          419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e

                          SHA512

                          06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                          Filesize

                          223B

                          MD5

                          94cbeec5d4343918fd0e48760e40539c

                          SHA1

                          a049266c5c1131f692f306c8710d7e72586ae79d

                          SHA256

                          48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                          SHA512

                          4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

                        • \Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • \Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • \Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • \Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • \Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • \Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                          Filesize

                          1.3MB

                          MD5

                          57e3fc905b5cb1811f155ec4aef82795

                          SHA1

                          2ca77867f751067d96d1eb27828de238b403e414

                          SHA256

                          a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                          SHA512

                          f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                        • \Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

                          Filesize

                          1.9MB

                          MD5

                          665c62d3bd6c21614fafb9a9b50bb574

                          SHA1

                          56322f2bb8a61954e6ec974612154402cdd98b29

                          SHA256

                          a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99

                          SHA512

                          07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

                        • \Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

                          Filesize

                          1.9MB

                          MD5

                          665c62d3bd6c21614fafb9a9b50bb574

                          SHA1

                          56322f2bb8a61954e6ec974612154402cdd98b29

                          SHA256

                          a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99

                          SHA512

                          07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

                        • \Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

                          Filesize

                          1.9MB

                          MD5

                          665c62d3bd6c21614fafb9a9b50bb574

                          SHA1

                          56322f2bb8a61954e6ec974612154402cdd98b29

                          SHA256

                          a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99

                          SHA512

                          07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

                        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

                          Filesize

                          503KB

                          MD5

                          96fd4324cf1b42cb2a2ab2f0ecfdc556

                          SHA1

                          cdc9b5998214a27d36592a12e31d6bef1f1a6ea0

                          SHA256

                          c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3

                          SHA512

                          01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

                        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

                          Filesize

                          503KB

                          MD5

                          96fd4324cf1b42cb2a2ab2f0ecfdc556

                          SHA1

                          cdc9b5998214a27d36592a12e31d6bef1f1a6ea0

                          SHA256

                          c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3

                          SHA512

                          01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

                        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

                          Filesize

                          175KB

                          MD5

                          0ecc8ab62b7278cc6650517251f1543c

                          SHA1

                          b4273cda193a20d48e83241275ffc34ddad412f2

                          SHA256

                          b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                          SHA512

                          c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

                          Filesize

                          175KB

                          MD5

                          0ecc8ab62b7278cc6650517251f1543c

                          SHA1

                          b4273cda193a20d48e83241275ffc34ddad412f2

                          SHA256

                          b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                          SHA512

                          c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

                          Filesize

                          358KB

                          MD5

                          e20361ff126992cdcdb205184622a9d5

                          SHA1

                          8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd

                          SHA256

                          b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811

                          SHA512

                          23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

                        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

                          Filesize

                          358KB

                          MD5

                          e20361ff126992cdcdb205184622a9d5

                          SHA1

                          8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd

                          SHA256

                          b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811

                          SHA512

                          23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

                        • \Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

                          Filesize

                          11KB

                          MD5

                          7e93bacbbc33e6652e147e7fe07572a0

                          SHA1

                          421a7167da01c8da4dc4d5234ca3dd84e319e762

                          SHA256

                          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                          SHA512

                          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                        • \Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

                          Filesize

                          342KB

                          MD5

                          0cae30de372cd7136ebb67ceed17ba77

                          SHA1

                          1f6c6aa533567560208d22a9d42893329be60343

                          SHA256

                          419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e

                          SHA512

                          06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

                        • \Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

                          Filesize

                          342KB

                          MD5

                          0cae30de372cd7136ebb67ceed17ba77

                          SHA1

                          1f6c6aa533567560208d22a9d42893329be60343

                          SHA256

                          419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e

                          SHA512

                          06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

                        • \Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

                          Filesize

                          342KB

                          MD5

                          0cae30de372cd7136ebb67ceed17ba77

                          SHA1

                          1f6c6aa533567560208d22a9d42893329be60343

                          SHA256

                          419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e

                          SHA512

                          06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

                        • \Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • \Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • memory/588-207-0x0000000004B90000-0x0000000004F60000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/588-238-0x0000000000400000-0x0000000002C8E000-memory.dmp

                          Filesize

                          40.6MB

                        • memory/588-210-0x0000000000400000-0x0000000002C8E000-memory.dmp

                          Filesize

                          40.6MB

                        • memory/588-209-0x0000000000400000-0x0000000002C8E000-memory.dmp

                          Filesize

                          40.6MB

                        • memory/588-208-0x0000000000400000-0x0000000002C8E000-memory.dmp

                          Filesize

                          40.6MB

                        • memory/588-239-0x0000000000400000-0x0000000002C8E000-memory.dmp

                          Filesize

                          40.6MB

                        • memory/588-198-0x00000000049E0000-0x0000000004B8A000-memory.dmp

                          Filesize

                          1.7MB

                        • memory/588-235-0x0000000000400000-0x0000000002C8E000-memory.dmp

                          Filesize

                          40.6MB

                        • memory/588-237-0x0000000000400000-0x0000000002C8E000-memory.dmp

                          Filesize

                          40.6MB

                        • memory/592-124-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-118-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-106-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-103-0x00000000071A0000-0x00000000071E0000-memory.dmp

                          Filesize

                          256KB

                        • memory/592-122-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-125-0x0000000000400000-0x0000000002B05000-memory.dmp

                          Filesize

                          39.0MB

                        • memory/592-100-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-120-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-98-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-102-0x0000000000280000-0x00000000002AD000-memory.dmp

                          Filesize

                          180KB

                        • memory/592-96-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-114-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-95-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-112-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-110-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-108-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-104-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-94-0x00000000030F0000-0x0000000003108000-memory.dmp

                          Filesize

                          96KB

                        • memory/592-93-0x00000000003D0000-0x00000000003EA000-memory.dmp

                          Filesize

                          104KB

                        • memory/592-116-0x00000000030F0000-0x0000000003102000-memory.dmp

                          Filesize

                          72KB

                        • memory/592-126-0x0000000000400000-0x0000000002B05000-memory.dmp

                          Filesize

                          39.0MB

                        • memory/672-82-0x0000000000900000-0x000000000090A000-memory.dmp

                          Filesize

                          40KB

                        • memory/844-133-0x0000000000280000-0x00000000002B2000-memory.dmp

                          Filesize

                          200KB

                        • memory/844-134-0x0000000000A10000-0x0000000000A50000-memory.dmp

                          Filesize

                          256KB

                        • memory/1080-197-0x0000000000400000-0x0000000002C8E000-memory.dmp

                          Filesize

                          40.6MB

                        • memory/1708-195-0x0000000000E30000-0x0000000000E70000-memory.dmp

                          Filesize

                          256KB

                        • memory/1708-192-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                        • memory/1708-190-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                        • memory/1708-188-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB