Malware Analysis Report

2025-06-16 04:57

Sample ID 230317-t9dxasbb81
Target 66982a9b92e51b0fa37953e61e12c221.exe
SHA256 528b3cff028baa3990a895589ed4933cb9ca0f5451f6635329cfc46f6e9655f8
Tags
amadey laplas redline lint rockins clipper discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

528b3cff028baa3990a895589ed4933cb9ca0f5451f6635329cfc46f6e9655f8

Threat Level: Known bad

The file 66982a9b92e51b0fa37953e61e12c221.exe was found to be: Known bad.

Malicious Activity Summary

amadey laplas redline lint rockins clipper discovery evasion infostealer persistence spyware stealer trojan

Laplas Clipper

RedLine

Amadey

Modifies Windows Defender Real-time Protection settings

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Checks computer location settings

Checks installed software on the system

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Creates scheduled task(s)

GoLang User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-17 16:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-17 16:45

Reported

2023-03-17 16:47

Platform

win7-20230220-en

Max time kernel

136s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe"

Signatures

Amadey

trojan amadey

Laplas Clipper

stealer clipper laplas

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A

RedLine

infostealer redline

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 824 set thread context of 1708 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1392 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 1392 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 1392 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 1392 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 1392 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 1392 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 1392 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 1324 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1324 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1324 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1324 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1324 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1324 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1324 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1220 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 1220 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 1220 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 1220 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 1220 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 1220 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 1220 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 1220 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 1220 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 1220 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 1220 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 1220 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 1220 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 1220 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 1324 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1324 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1324 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1324 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1324 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1324 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1324 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1392 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 1392 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 1392 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 1392 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 1392 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 1392 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 1392 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 1712 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1712 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1712 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1712 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1712 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1712 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1712 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1948 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1948 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1948 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1948 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1948 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1948 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1948 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1948 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 268 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe

"C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Windows\system32\taskeng.exe

taskeng.exe {D12F88E6-7FD3-4784-ADA2-711A884A0752} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

"C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 272

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Network

Country Destination Domain Proto
DE 193.233.20.28:4125 tcp
RU 62.204.41.87:80 62.204.41.87 tcp
RU 62.204.41.88:80 62.204.41.88 tcp
RU 46.3.197.223:44446 tcp
NL 45.159.189.105:80 45.159.189.105 tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

MD5 96fd4324cf1b42cb2a2ab2f0ecfdc556
SHA1 cdc9b5998214a27d36592a12e31d6bef1f1a6ea0
SHA256 c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3
SHA512 01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

MD5 96fd4324cf1b42cb2a2ab2f0ecfdc556
SHA1 cdc9b5998214a27d36592a12e31d6bef1f1a6ea0
SHA256 c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3
SHA512 01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

MD5 96fd4324cf1b42cb2a2ab2f0ecfdc556
SHA1 cdc9b5998214a27d36592a12e31d6bef1f1a6ea0
SHA256 c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3
SHA512 01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

MD5 96fd4324cf1b42cb2a2ab2f0ecfdc556
SHA1 cdc9b5998214a27d36592a12e31d6bef1f1a6ea0
SHA256 c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3
SHA512 01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

MD5 e20361ff126992cdcdb205184622a9d5
SHA1 8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd
SHA256 b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811
SHA512 23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

MD5 e20361ff126992cdcdb205184622a9d5
SHA1 8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd
SHA256 b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811
SHA512 23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

MD5 e20361ff126992cdcdb205184622a9d5
SHA1 8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd
SHA256 b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811
SHA512 23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

MD5 e20361ff126992cdcdb205184622a9d5
SHA1 8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd
SHA256 b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811
SHA512 23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/672-82-0x0000000000900000-0x000000000090A000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

MD5 0cae30de372cd7136ebb67ceed17ba77
SHA1 1f6c6aa533567560208d22a9d42893329be60343
SHA256 419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e
SHA512 06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

MD5 0cae30de372cd7136ebb67ceed17ba77
SHA1 1f6c6aa533567560208d22a9d42893329be60343
SHA256 419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e
SHA512 06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

MD5 0cae30de372cd7136ebb67ceed17ba77
SHA1 1f6c6aa533567560208d22a9d42893329be60343
SHA256 419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e
SHA512 06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

MD5 0cae30de372cd7136ebb67ceed17ba77
SHA1 1f6c6aa533567560208d22a9d42893329be60343
SHA256 419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e
SHA512 06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

MD5 0cae30de372cd7136ebb67ceed17ba77
SHA1 1f6c6aa533567560208d22a9d42893329be60343
SHA256 419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e
SHA512 06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

MD5 0cae30de372cd7136ebb67ceed17ba77
SHA1 1f6c6aa533567560208d22a9d42893329be60343
SHA256 419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e
SHA512 06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

memory/592-93-0x00000000003D0000-0x00000000003EA000-memory.dmp

memory/592-94-0x00000000030F0000-0x0000000003108000-memory.dmp

memory/592-95-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-96-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-98-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-100-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-102-0x0000000000280000-0x00000000002AD000-memory.dmp

memory/592-103-0x00000000071A0000-0x00000000071E0000-memory.dmp

memory/592-106-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-114-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-122-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-124-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-120-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-118-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-116-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-112-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-110-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-108-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-104-0x00000000030F0000-0x0000000003102000-memory.dmp

memory/592-125-0x0000000000400000-0x0000000002B05000-memory.dmp

memory/592-126-0x0000000000400000-0x0000000002B05000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

MD5 0ecc8ab62b7278cc6650517251f1543c
SHA1 b4273cda193a20d48e83241275ffc34ddad412f2
SHA256 b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a
SHA512 c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

MD5 0ecc8ab62b7278cc6650517251f1543c
SHA1 b4273cda193a20d48e83241275ffc34ddad412f2
SHA256 b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a
SHA512 c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

MD5 0ecc8ab62b7278cc6650517251f1543c
SHA1 b4273cda193a20d48e83241275ffc34ddad412f2
SHA256 b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a
SHA512 c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

MD5 0ecc8ab62b7278cc6650517251f1543c
SHA1 b4273cda193a20d48e83241275ffc34ddad412f2
SHA256 b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a
SHA512 c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

memory/844-133-0x0000000000280000-0x00000000002B2000-memory.dmp

memory/844-134-0x0000000000A10000-0x0000000000A50000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

MD5 665c62d3bd6c21614fafb9a9b50bb574
SHA1 56322f2bb8a61954e6ec974612154402cdd98b29
SHA256 a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99
SHA512 07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

MD5 665c62d3bd6c21614fafb9a9b50bb574
SHA1 56322f2bb8a61954e6ec974612154402cdd98b29
SHA256 a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99
SHA512 07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

MD5 665c62d3bd6c21614fafb9a9b50bb574
SHA1 56322f2bb8a61954e6ec974612154402cdd98b29
SHA256 a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99
SHA512 07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

MD5 665c62d3bd6c21614fafb9a9b50bb574
SHA1 56322f2bb8a61954e6ec974612154402cdd98b29
SHA256 a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99
SHA512 07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

MD5 665c62d3bd6c21614fafb9a9b50bb574
SHA1 56322f2bb8a61954e6ec974612154402cdd98b29
SHA256 a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99
SHA512 07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

memory/1708-188-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1708-190-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1708-192-0x0000000000400000-0x0000000000432000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

memory/1708-195-0x0000000000E30000-0x0000000000E70000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

memory/588-198-0x00000000049E0000-0x0000000004B8A000-memory.dmp

memory/1080-197-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/588-207-0x0000000004B90000-0x0000000004F60000-memory.dmp

memory/588-208-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/588-209-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/588-210-0x0000000000400000-0x0000000002C8E000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

memory/588-235-0x0000000000400000-0x0000000002C8E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

memory/588-237-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/588-238-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/588-239-0x0000000000400000-0x0000000002C8E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-17 16:45

Reported

2023-03-17 16:47

Platform

win10v2004-20230220-en

Max time kernel

143s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe"

Signatures

Amadey

trojan amadey

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A

RedLine

infostealer redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3036 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 3036 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 3036 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe
PID 1312 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1312 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 1312 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe
PID 4360 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 4360 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe
PID 4360 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 4360 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 4360 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe
PID 1312 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1312 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 1312 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe
PID 3036 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 3036 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 3036 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe
PID 2148 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 2148 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 2148 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 3008 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 3008 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 3008 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 3008 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 4652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 4652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 4652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3008 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\rundll32.exe
PID 3008 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\rundll32.exe
PID 3008 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe

"C:\Users\Admin\AppData\Local\Temp\66982a9b92e51b0fa37953e61e12c221.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1100 -ip 1100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1080

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
DE 193.233.20.28:4125 tcp
US 8.8.8.8:53 28.20.233.193.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
RU 62.204.41.87:80 62.204.41.87 tcp
US 8.8.8.8:53 87.41.204.62.in-addr.arpa udp
US 8.8.8.8:53 73.254.224.20.in-addr.arpa udp
NL 87.248.202.1:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 97.238.32.23.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

MD5 96fd4324cf1b42cb2a2ab2f0ecfdc556
SHA1 cdc9b5998214a27d36592a12e31d6bef1f1a6ea0
SHA256 c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3
SHA512 01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will4997.exe

MD5 96fd4324cf1b42cb2a2ab2f0ecfdc556
SHA1 cdc9b5998214a27d36592a12e31d6bef1f1a6ea0
SHA256 c83317168639fb2c23b8e480fae02b6bd9167a92bc72a78f99819f1db55211d3
SHA512 01bc1085db337bc2812b1b6a2883358ca0ced3250cfdf3e8ae54ebda82e3364d76c4c3e8100b714d50e4d17450d3c43a9914865c06e304acbf35deebdfc9bce5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

MD5 e20361ff126992cdcdb205184622a9d5
SHA1 8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd
SHA256 b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811
SHA512 23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4556.exe

MD5 e20361ff126992cdcdb205184622a9d5
SHA1 8a9679f6b3d34ecf3a63d85e06cbd2087d3c27bd
SHA256 b340de0cf60989a58d1a641af2044f9571af9bafa701f21fa383d18bb2dc1811
SHA512 23bf3823da51e49b99c31239e67de62ba7e124451386e509197b571788d618cf1cde966f891bf60212fd364347fbb79f8ffc4266bdce57c87bce754975e8747c

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4979hT.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4240-154-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

MD5 0cae30de372cd7136ebb67ceed17ba77
SHA1 1f6c6aa533567560208d22a9d42893329be60343
SHA256 419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e
SHA512 06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py94KY26.exe

MD5 0cae30de372cd7136ebb67ceed17ba77
SHA1 1f6c6aa533567560208d22a9d42893329be60343
SHA256 419c1b70246eeaa20cfa705918a33fc0db2680eca5da8dae620d018e9c02992e
SHA512 06f56020e912fc22d7a0d6aef788fa8ec0f00a507589e6cfafdf3e3f8c413afe48038296eb26b70b85ac6a958d9458742cbc1cbd86ab62b123487ebddbc51732

memory/1100-160-0x0000000002BE0000-0x0000000002C0D000-memory.dmp

memory/1100-161-0x0000000007150000-0x0000000007160000-memory.dmp

memory/1100-162-0x0000000007160000-0x0000000007704000-memory.dmp

memory/1100-163-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-166-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-164-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-168-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-170-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-172-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-174-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-176-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-178-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-180-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-182-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-184-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-186-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-188-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-190-0x0000000007770000-0x0000000007782000-memory.dmp

memory/1100-191-0x0000000007150000-0x0000000007160000-memory.dmp

memory/1100-192-0x0000000007150000-0x0000000007160000-memory.dmp

memory/1100-193-0x0000000000400000-0x0000000002B05000-memory.dmp

memory/1100-194-0x0000000007150000-0x0000000007160000-memory.dmp

memory/1100-196-0x0000000007150000-0x0000000007160000-memory.dmp

memory/1100-197-0x0000000007150000-0x0000000007160000-memory.dmp

memory/1100-198-0x0000000000400000-0x0000000002B05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

MD5 0ecc8ab62b7278cc6650517251f1543c
SHA1 b4273cda193a20d48e83241275ffc34ddad412f2
SHA256 b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a
SHA512 c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3373EV.exe

MD5 0ecc8ab62b7278cc6650517251f1543c
SHA1 b4273cda193a20d48e83241275ffc34ddad412f2
SHA256 b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a
SHA512 c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

memory/3472-202-0x00000000000C0000-0x00000000000F2000-memory.dmp

memory/3472-203-0x0000000005000000-0x0000000005618000-memory.dmp

memory/3472-204-0x0000000004B70000-0x0000000004C7A000-memory.dmp

memory/3472-205-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

memory/3472-206-0x0000000004C80000-0x0000000004CBC000-memory.dmp

memory/3472-207-0x0000000004B30000-0x0000000004B40000-memory.dmp

memory/3472-208-0x0000000004E40000-0x0000000004ED2000-memory.dmp

memory/3472-209-0x0000000005620000-0x0000000005686000-memory.dmp

memory/3472-210-0x0000000008720000-0x0000000008796000-memory.dmp

memory/3472-211-0x00000000087A0000-0x00000000087F0000-memory.dmp

memory/3472-212-0x0000000004B30000-0x0000000004B40000-memory.dmp

memory/3472-213-0x00000000089C0000-0x0000000008B82000-memory.dmp

memory/3472-214-0x00000000090C0000-0x00000000095EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry48cF37.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5