Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/03/2023, 16:57

General

  • Target

    0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe

  • Size

    689KB

  • MD5

    850e2dc631f743a3b3bdd7839c3fcbaa

  • SHA1

    9db664268e7915253f1a654ed6e60ba29d5b337e

  • SHA256

    0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa

  • SHA512

    da6604dd6bd5b0bc2fb673fdaabd2c6e0697290f63fe063e5146dd1ff2f35e8d6f2445538f542233b1725fdb08dae2f22a7dc93ce22fc6ae9167f5fc969e66cf

  • SSDEEP

    12288:0Mriy90jLD8VFcvnVWsAegZz5JOPc1BBndkf1614zImIGunEZJhkQQAvnh52ZfjN:WysLIVQnHgPJ/Jdkf161481QJHLZ5MR

Malware Config

Extracted

Family

redline

Botnet

lint

C2

193.233.20.28:4125

Attributes
  • auth_value

    0e95262fb78243c67430f3148303e5b7

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes
  • api_key

    0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Extracted

Family

redline

Botnet

rockins

C2

46.3.197.223:44446

Attributes
  • auth_value

    e36e02733016977bec980781774c6ef4

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe
    "C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2648
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3100
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3644
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4816
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4888
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4900
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:760
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:392
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:3992
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3940
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:2736
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:4696
                    • C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:4456
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                        5⤵
                          PID:4200
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                          5⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5104
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 592
                          5⤵
                          • Program crash
                          PID:4988
                      • C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious use of WriteProcessMemory
                        PID:4324
                        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
                          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
                          5⤵
                          • Executes dropped EXE
                          PID:3340
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                        4⤵
                        • Loads dropped DLL
                        PID:4496
                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4832
                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  1⤵
                  • Executes dropped EXE
                  PID:504

                Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                        Filesize

                        1.3MB

                        MD5

                        57e3fc905b5cb1811f155ec4aef82795

                        SHA1

                        2ca77867f751067d96d1eb27828de238b403e414

                        SHA256

                        a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                        SHA512

                        f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                      • C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                        Filesize

                        1.3MB

                        MD5

                        57e3fc905b5cb1811f155ec4aef82795

                        SHA1

                        2ca77867f751067d96d1eb27828de238b403e414

                        SHA256

                        a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                        SHA512

                        f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                      • C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

                        Filesize

                        1.3MB

                        MD5

                        57e3fc905b5cb1811f155ec4aef82795

                        SHA1

                        2ca77867f751067d96d1eb27828de238b403e414

                        SHA256

                        a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d

                        SHA512

                        f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

                      • C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

                        Filesize

                        1.9MB

                        MD5

                        665c62d3bd6c21614fafb9a9b50bb574

                        SHA1

                        56322f2bb8a61954e6ec974612154402cdd98b29

                        SHA256

                        a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99

                        SHA512

                        07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

                      • C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

                        Filesize

                        1.9MB

                        MD5

                        665c62d3bd6c21614fafb9a9b50bb574

                        SHA1

                        56322f2bb8a61954e6ec974612154402cdd98b29

                        SHA256

                        a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99

                        SHA512

                        07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

                      • C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

                        Filesize

                        1.9MB

                        MD5

                        665c62d3bd6c21614fafb9a9b50bb574

                        SHA1

                        56322f2bb8a61954e6ec974612154402cdd98b29

                        SHA256

                        a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99

                        SHA512

                        07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe

                        Filesize

                        235KB

                        MD5

                        5086db99de54fca268169a1c6cf26122

                        SHA1

                        003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                        SHA256

                        42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                        SHA512

                        90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe

                        Filesize

                        235KB

                        MD5

                        5086db99de54fca268169a1c6cf26122

                        SHA1

                        003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                        SHA256

                        42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                        SHA512

                        90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe

                        Filesize

                        502KB

                        MD5

                        863439475ed8f4eebc7a8b971a21c71e

                        SHA1

                        8405433a643f07516761ebc44d4ab7f29d1b8fd9

                        SHA256

                        13748314d2c6157da220637a705f9e3e52f990c3b3aa5f9d31c9ed6af6a4be6e

                        SHA512

                        f76dbad5f30fe3607c363c8a8245ca12c8877e9d74133a4b4863ca8dbead614bf50e308bafa6dedf7c7262d3976bf65c93a299224f10a342da66fb682a857108

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe

                        Filesize

                        502KB

                        MD5

                        863439475ed8f4eebc7a8b971a21c71e

                        SHA1

                        8405433a643f07516761ebc44d4ab7f29d1b8fd9

                        SHA256

                        13748314d2c6157da220637a705f9e3e52f990c3b3aa5f9d31c9ed6af6a4be6e

                        SHA512

                        f76dbad5f30fe3607c363c8a8245ca12c8877e9d74133a4b4863ca8dbead614bf50e308bafa6dedf7c7262d3976bf65c93a299224f10a342da66fb682a857108

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe

                        Filesize

                        175KB

                        MD5

                        0ecc8ab62b7278cc6650517251f1543c

                        SHA1

                        b4273cda193a20d48e83241275ffc34ddad412f2

                        SHA256

                        b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                        SHA512

                        c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe

                        Filesize

                        175KB

                        MD5

                        0ecc8ab62b7278cc6650517251f1543c

                        SHA1

                        b4273cda193a20d48e83241275ffc34ddad412f2

                        SHA256

                        b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                        SHA512

                        c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe

                        Filesize

                        357KB

                        MD5

                        b303f5f90c2bc58850ce4468dae79581

                        SHA1

                        5b5efa929d32da4e390b1a5ec3087af310865235

                        SHA256

                        ebdb062fec1795dfd8fe9c04a9c5ca59368072629ecf536dde98e8032b97927c

                        SHA512

                        b52c48acef9b94ab27023eef4ffddee233f8e5d7a62ccf7159fc45f9f4d03e66d3a65f62d61760cb55e1c5d25ebfc5152413425812c094888416f75877dc6298

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe

                        Filesize

                        357KB

                        MD5

                        b303f5f90c2bc58850ce4468dae79581

                        SHA1

                        5b5efa929d32da4e390b1a5ec3087af310865235

                        SHA256

                        ebdb062fec1795dfd8fe9c04a9c5ca59368072629ecf536dde98e8032b97927c

                        SHA512

                        b52c48acef9b94ab27023eef4ffddee233f8e5d7a62ccf7159fc45f9f4d03e66d3a65f62d61760cb55e1c5d25ebfc5152413425812c094888416f75877dc6298

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe

                        Filesize

                        11KB

                        MD5

                        7e93bacbbc33e6652e147e7fe07572a0

                        SHA1

                        421a7167da01c8da4dc4d5234ca3dd84e319e762

                        SHA256

                        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                        SHA512

                        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe

                        Filesize

                        11KB

                        MD5

                        7e93bacbbc33e6652e147e7fe07572a0

                        SHA1

                        421a7167da01c8da4dc4d5234ca3dd84e319e762

                        SHA256

                        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                        SHA512

                        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe

                        Filesize

                        338KB

                        MD5

                        9de056f2ae02f1323646c3eb25daef01

                        SHA1

                        106ec87143b90ba439ab5be4af63f60adb6bf0c6

                        SHA256

                        e180d376c5fcb4b7fc7bca2e505fa351c7c84ff8e5b02d2ab96fd46d26232236

                        SHA512

                        a02107c94427747a68ec46170915a4441521da063403ed4925e9245073ad0e20c138199acf3251afa0306c16428e2d7c25a92779b41dd20424c9572ea4bdccfa

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe

                        Filesize

                        338KB

                        MD5

                        9de056f2ae02f1323646c3eb25daef01

                        SHA1

                        106ec87143b90ba439ab5be4af63f60adb6bf0c6

                        SHA256

                        e180d376c5fcb4b7fc7bca2e505fa351c7c84ff8e5b02d2ab96fd46d26232236

                        SHA512

                        a02107c94427747a68ec46170915a4441521da063403ed4925e9245073ad0e20c138199acf3251afa0306c16428e2d7c25a92779b41dd20424c9572ea4bdccfa

                      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                        Filesize

                        235KB

                        MD5

                        5086db99de54fca268169a1c6cf26122

                        SHA1

                        003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                        SHA256

                        42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                        SHA512

                        90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                        Filesize

                        235KB

                        MD5

                        5086db99de54fca268169a1c6cf26122

                        SHA1

                        003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                        SHA256

                        42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                        SHA512

                        90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                        Filesize

                        235KB

                        MD5

                        5086db99de54fca268169a1c6cf26122

                        SHA1

                        003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                        SHA256

                        42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                        SHA512

                        90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                        Filesize

                        235KB

                        MD5

                        5086db99de54fca268169a1c6cf26122

                        SHA1

                        003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                        SHA256

                        42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                        SHA512

                        90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

                        Filesize

                        235KB

                        MD5

                        5086db99de54fca268169a1c6cf26122

                        SHA1

                        003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                        SHA256

                        42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                        SHA512

                        90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                      • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

                        Filesize

                        508.8MB

                        MD5

                        913b08eca647f6d3d31bbadc1bb29829

                        SHA1

                        15ec5f650c4329b534ca0821eb1a9bc21986d094

                        SHA256

                        6bf575f20c8acc7fafcf339a50f2c9be88d26ca3ff701d2f831ab719ebc1f856

                        SHA512

                        851552f54250bc65e91468d20c740f54f9b76f73118e2cd6103ca77cd1cf69041280f4de00a419fefd4cc67427766ed88fbf8de56189c78a167ab52600ba17a2

                      • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

                        Filesize

                        452.6MB

                        MD5

                        5a75e9ef59e2201ef17f577a7ab7312a

                        SHA1

                        ff44831678142858151a497c52bad997593da410

                        SHA256

                        8b0e6875ddbc2153fa833cb31dc6f2c14e8f76b521add13e7ab3bc338ded48a7

                        SHA512

                        8df6d53945173d7525c1745e9043ab93c3e66dd8d146dd2f5ef1db68d1d2498bd1928b234dc23120625cb48491b2e4c9648c64850c680ea380ca6aef8ecf9714

                      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                        Filesize

                        89KB

                        MD5

                        16cf28ebb6d37dbaba93f18320c6086e

                        SHA1

                        eae7d4b7a9636329065877aabe8d4f721a26ab25

                        SHA256

                        c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                        SHA512

                        f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                        Filesize

                        89KB

                        MD5

                        16cf28ebb6d37dbaba93f18320c6086e

                        SHA1

                        eae7d4b7a9636329065877aabe8d4f721a26ab25

                        SHA256

                        c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                        SHA512

                        f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                        Filesize

                        223B

                        MD5

                        94cbeec5d4343918fd0e48760e40539c

                        SHA1

                        a049266c5c1131f692f306c8710d7e72586ae79d

                        SHA256

                        48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                        SHA512

                        4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

                      • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                        Filesize

                        89KB

                        MD5

                        16cf28ebb6d37dbaba93f18320c6086e

                        SHA1

                        eae7d4b7a9636329065877aabe8d4f721a26ab25

                        SHA256

                        c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                        SHA512

                        f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                      • memory/2648-142-0x0000000000420000-0x000000000042A000-memory.dmp

                        Filesize

                        40KB

                      • memory/3100-151-0x00000000001D0000-0x00000000001FD000-memory.dmp

                        Filesize

                        180KB

                      • memory/3100-155-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-178-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-180-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-182-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-183-0x0000000000400000-0x0000000002B05000-memory.dmp

                        Filesize

                        39.0MB

                      • memory/3100-184-0x00000000049D0000-0x00000000049E0000-memory.dmp

                        Filesize

                        64KB

                      • memory/3100-185-0x00000000049D0000-0x00000000049E0000-memory.dmp

                        Filesize

                        64KB

                      • memory/3100-187-0x0000000000400000-0x0000000002B05000-memory.dmp

                        Filesize

                        39.0MB

                      • memory/3100-148-0x00000000049B0000-0x00000000049CA000-memory.dmp

                        Filesize

                        104KB

                      • memory/3100-174-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-149-0x0000000007060000-0x000000000755E000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/3100-172-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-150-0x0000000004B50000-0x0000000004B68000-memory.dmp

                        Filesize

                        96KB

                      • memory/3100-152-0x00000000049D0000-0x00000000049E0000-memory.dmp

                        Filesize

                        64KB

                      • memory/3100-153-0x00000000049D0000-0x00000000049E0000-memory.dmp

                        Filesize

                        64KB

                      • memory/3100-154-0x00000000049D0000-0x00000000049E0000-memory.dmp

                        Filesize

                        64KB

                      • memory/3100-170-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-168-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-166-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-164-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-160-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-162-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-158-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-156-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3100-176-0x0000000004B50000-0x0000000004B62000-memory.dmp

                        Filesize

                        72KB

                      • memory/3340-259-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3340-279-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3340-280-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3340-281-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3340-257-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3340-282-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3340-255-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3340-252-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3340-284-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/3644-194-0x00000000052E0000-0x00000000052F2000-memory.dmp

                        Filesize

                        72KB

                      • memory/3644-198-0x0000000005670000-0x00000000056D6000-memory.dmp

                        Filesize

                        408KB

                      • memory/3644-191-0x0000000000A80000-0x0000000000AB2000-memory.dmp

                        Filesize

                        200KB

                      • memory/3644-192-0x0000000005820000-0x0000000005E26000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/3644-193-0x00000000053B0000-0x00000000054BA000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/3644-195-0x00000000055F0000-0x0000000005600000-memory.dmp

                        Filesize

                        64KB

                      • memory/3644-196-0x0000000005340000-0x000000000537E000-memory.dmp

                        Filesize

                        248KB

                      • memory/3644-204-0x00000000055F0000-0x0000000005600000-memory.dmp

                        Filesize

                        64KB

                      • memory/3644-203-0x0000000007330000-0x000000000785C000-memory.dmp

                        Filesize

                        5.2MB

                      • memory/3644-202-0x0000000006C30000-0x0000000006DF2000-memory.dmp

                        Filesize

                        1.8MB

                      • memory/3644-201-0x0000000006960000-0x00000000069B0000-memory.dmp

                        Filesize

                        320KB

                      • memory/3644-200-0x00000000069E0000-0x0000000006A56000-memory.dmp

                        Filesize

                        472KB

                      • memory/3644-199-0x0000000006220000-0x00000000062B2000-memory.dmp

                        Filesize

                        584KB

                      • memory/3644-197-0x00000000054C0000-0x000000000550B000-memory.dmp

                        Filesize

                        300KB

                      • memory/4324-242-0x00000000049A0000-0x0000000004D70000-memory.dmp

                        Filesize

                        3.8MB

                      • memory/4324-251-0x0000000000400000-0x0000000002C8E000-memory.dmp

                        Filesize

                        40.6MB

                      • memory/5104-245-0x0000000004C00000-0x0000000004C10000-memory.dmp

                        Filesize

                        64KB

                      • memory/5104-253-0x0000000004C00000-0x0000000004C10000-memory.dmp

                        Filesize

                        64KB

                      • memory/5104-243-0x0000000000400000-0x0000000000432000-memory.dmp

                        Filesize

                        200KB

                      • memory/5104-244-0x0000000004A80000-0x0000000004ACB000-memory.dmp

                        Filesize

                        300KB