Malware Analysis Report

2024-11-15 09:17

Sample ID 230318-3k618agc2s
Target 934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92
SHA256 934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92
Tags
amadey aurora redline rhadamanthys build_main gena vint discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92

Threat Level: Known bad

The file 934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92 was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline rhadamanthys build_main gena vint discovery evasion infostealer persistence spyware stealer trojan

Rhadamanthys

Modifies Windows Defender Real-time Protection settings

RedLine payload

RedLine

Aurora

Detect rhadamanthys stealer shellcode

Amadey

Suspicious use of NtCreateUserProcessOtherParentProcess

Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Windows security modification

Reads user/profile data of web browsers

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-18 23:35

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-18 23:35

Reported

2023-03-18 23:37

Platform

win10-20230220-en

Max time kernel

113s

Max time network

144s

Command Line

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 612 created 2940 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe c:\windows\system32\taskhostw.exe

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe N/A

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 612 set thread context of 1780 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4188 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe
PID 4188 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe
PID 4188 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe
PID 8 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe
PID 8 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe
PID 8 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe
PID 4720 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe
PID 4720 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe
PID 4720 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe
PID 4796 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe
PID 4796 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe
PID 4796 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe
PID 4796 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe
PID 4796 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe
PID 4720 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe
PID 4720 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe
PID 4720 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe
PID 8 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe
PID 8 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe
PID 8 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe
PID 4188 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe
PID 4188 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe
PID 4188 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe
PID 3484 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 3484 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 3484 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 4204 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4204 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4204 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4204 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4204 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4204 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3500 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4204 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe
PID 4204 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe
PID 4204 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe
PID 4204 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe
PID 4204 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe
PID 4204 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe
PID 4204 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe
PID 4204 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe
PID 4204 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe
PID 612 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 612 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 612 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 612 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 612 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Processes

c:\windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe

"C:\Users\Admin\AppData\Local\Temp\934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe

"C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

"C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

C:\Windows\SYSWOW64\fontview.exe

"C:\Windows\SYSWOW64\fontview.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 456

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

Network

Country Destination Domain Proto
DE 193.233.20.30:4125 tcp
US 8.8.8.8:53 30.20.233.193.in-addr.arpa udp
US 52.182.143.210:443 tcp
DE 193.233.20.30:4125 tcp
RU 62.204.41.87:80 62.204.41.87 tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 87.41.204.62.in-addr.arpa udp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
US 8.8.8.8:53 240.232.18.117.in-addr.arpa udp
US 8.8.8.8:53 234.95.206.23.in-addr.arpa udp
US 8.8.8.8:53 176.25.221.88.in-addr.arpa udp
NL 185.246.221.126:80 185.246.221.126 tcp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 fvflet2jcfcpacdzgqqforuvnzciwmz.2qjasnqlru9tyjcnp0t0lxh udp
US 8.8.8.8:53 126.221.246.185.in-addr.arpa udp
US 8.8.8.8:53 ebfertility.com udp
US 89.190.157.61:80 ebfertility.com tcp
NL 212.87.204.93:8081 tcp
US 8.8.8.8:53 61.157.190.89.in-addr.arpa udp
US 8.8.8.8:53 93.204.87.212.in-addr.arpa udp
RU 80.85.156.168:20189 tcp
US 8.8.8.8:53 168.156.85.80.in-addr.arpa udp
US 13.107.42.16:443 tcp
US 8.8.8.8:53 52.4.107.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe

MD5 67418af679c043f15394e34329756ef7
SHA1 57620d8d460cb9314ff2a497154db21daee9aa45
SHA256 2f4102e1bc257b6ef263a6c98dfdbf30d8f291f1a632203398003c2a64e424a1
SHA512 e8797ff85d2b077e96669fe0115af9a7a6d60bc12e8bfff6d75aec37ac1c7447fad27d3ab20dbec19a6c1c19c6391e3c9c3e26cba216c865679782b11b7c0972

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8838.exe

MD5 67418af679c043f15394e34329756ef7
SHA1 57620d8d460cb9314ff2a497154db21daee9aa45
SHA256 2f4102e1bc257b6ef263a6c98dfdbf30d8f291f1a632203398003c2a64e424a1
SHA512 e8797ff85d2b077e96669fe0115af9a7a6d60bc12e8bfff6d75aec37ac1c7447fad27d3ab20dbec19a6c1c19c6391e3c9c3e26cba216c865679782b11b7c0972

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe

MD5 4d6df52585f7bc274e578381bfa19db2
SHA1 a25d40442a1006eb81788d09f9b416e78b41cf74
SHA256 8d4a81759f8d55131a253952f2545a8da845338645630274a7b64d12203de13d
SHA512 7da767722e0f89d3d0fc28499d2a05d8b1a2e78c10205ef41c8b3b6dc2fffe5b62042f7a1347db4b550a647ff47eee7b6b096fa71cb66bd3b2fb2f0cbac138b6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2733.exe

MD5 4d6df52585f7bc274e578381bfa19db2
SHA1 a25d40442a1006eb81788d09f9b416e78b41cf74
SHA256 8d4a81759f8d55131a253952f2545a8da845338645630274a7b64d12203de13d
SHA512 7da767722e0f89d3d0fc28499d2a05d8b1a2e78c10205ef41c8b3b6dc2fffe5b62042f7a1347db4b550a647ff47eee7b6b096fa71cb66bd3b2fb2f0cbac138b6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe

MD5 f0188c4c0ffac7c027e1f6be35979758
SHA1 c5116b1d95fac06d7c0f26f37be54f6b4782280a
SHA256 29271fc75c22b8eb9e93c9dfd6dfb49af16bfb30b396c20c8d4875366bc49de2
SHA512 1618f050896b330bd7152b72238d4aea3cc17fa0cfe02e0a36ae0839a78f232e7cbd04aeaf1241e0f4600a9c657dc46387ccaf130828d9db0a7e6371fd8fe18a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3776.exe

MD5 f0188c4c0ffac7c027e1f6be35979758
SHA1 c5116b1d95fac06d7c0f26f37be54f6b4782280a
SHA256 29271fc75c22b8eb9e93c9dfd6dfb49af16bfb30b396c20c8d4875366bc49de2
SHA512 1618f050896b330bd7152b72238d4aea3cc17fa0cfe02e0a36ae0839a78f232e7cbd04aeaf1241e0f4600a9c657dc46387ccaf130828d9db0a7e6371fd8fe18a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx6821ff.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4908-148-0x0000000000680000-0x000000000068A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe

MD5 c91d09456a386f6de0979906b0e43f8e
SHA1 5453ac12f9e2c58f03612d006e06114b615d3cba
SHA256 fa0f3aa364e56c2eb93d361f962d2cac1991ba91e4f5e647e19baaf31c3d4fc6
SHA512 7331d36575e58304623a8e71949b27c3b1e6b1b68cfffc801abeeca23b98e1b630abb70618b7c8086ef9608c6e030fba05b615d0acf52cf88b5d9df4ea49d6af

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns3060an.exe

MD5 c91d09456a386f6de0979906b0e43f8e
SHA1 5453ac12f9e2c58f03612d006e06114b615d3cba
SHA256 fa0f3aa364e56c2eb93d361f962d2cac1991ba91e4f5e647e19baaf31c3d4fc6
SHA512 7331d36575e58304623a8e71949b27c3b1e6b1b68cfffc801abeeca23b98e1b630abb70618b7c8086ef9608c6e030fba05b615d0acf52cf88b5d9df4ea49d6af

memory/4940-154-0x0000000004910000-0x000000000492A000-memory.dmp

memory/4940-155-0x0000000007030000-0x000000000752E000-memory.dmp

memory/4940-156-0x0000000007540000-0x0000000007558000-memory.dmp

memory/4940-157-0x00000000001D0000-0x00000000001FD000-memory.dmp

memory/4940-158-0x0000000007020000-0x0000000007030000-memory.dmp

memory/4940-159-0x0000000007020000-0x0000000007030000-memory.dmp

memory/4940-160-0x0000000007020000-0x0000000007030000-memory.dmp

memory/4940-161-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-162-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-164-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-166-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-168-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-170-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-172-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-174-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-176-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-178-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-180-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-182-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-184-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-186-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-188-0x0000000007540000-0x0000000007552000-memory.dmp

memory/4940-189-0x0000000000400000-0x0000000002B03000-memory.dmp

memory/4940-191-0x0000000007020000-0x0000000007030000-memory.dmp

memory/4940-190-0x0000000007020000-0x0000000007030000-memory.dmp

memory/4940-192-0x0000000007020000-0x0000000007030000-memory.dmp

memory/4940-194-0x0000000000400000-0x0000000002B03000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe

MD5 772fe45b4250e8e599b867c3c9b2b6f5
SHA1 92418dcd90485683cb0be1d131b3652bc25850ae
SHA256 68fabfc6b53c088e452cdcd04299487619f7d64930973fa8e7b5a8a3e66b0c52
SHA512 9dbfe68fe7d4e21a86ef069f84f814f7e5be427b807479e5159851dd52fd0ba56a31150559f9f747df62478b08242537f0887ade9ddbf0b686c8c2926a612142

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py47XW79.exe

MD5 772fe45b4250e8e599b867c3c9b2b6f5
SHA1 92418dcd90485683cb0be1d131b3652bc25850ae
SHA256 68fabfc6b53c088e452cdcd04299487619f7d64930973fa8e7b5a8a3e66b0c52
SHA512 9dbfe68fe7d4e21a86ef069f84f814f7e5be427b807479e5159851dd52fd0ba56a31150559f9f747df62478b08242537f0887ade9ddbf0b686c8c2926a612142

memory/3648-201-0x0000000004850000-0x0000000004860000-memory.dmp

memory/3648-200-0x00000000044F0000-0x000000000453B000-memory.dmp

memory/3648-199-0x0000000004970000-0x00000000049B6000-memory.dmp

memory/3648-203-0x0000000004850000-0x0000000004860000-memory.dmp

memory/3648-202-0x00000000075F0000-0x0000000007634000-memory.dmp

memory/3648-204-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-205-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-207-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-209-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-213-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-215-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-211-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-217-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-219-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-221-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-223-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-225-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-227-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-229-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-231-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-233-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-235-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-237-0x00000000075F0000-0x000000000762E000-memory.dmp

memory/3648-252-0x0000000004850000-0x0000000004860000-memory.dmp

memory/3648-1111-0x0000000007630000-0x0000000007C36000-memory.dmp

memory/3648-1112-0x0000000007CC0000-0x0000000007DCA000-memory.dmp

memory/3648-1113-0x0000000007E00000-0x0000000007E12000-memory.dmp

memory/3648-1114-0x0000000007E20000-0x0000000007E5E000-memory.dmp

memory/3648-1115-0x0000000007F70000-0x0000000007FBB000-memory.dmp

memory/3648-1116-0x0000000004850000-0x0000000004860000-memory.dmp

memory/3648-1118-0x0000000004850000-0x0000000004860000-memory.dmp

memory/3648-1119-0x0000000008100000-0x0000000008166000-memory.dmp

memory/3648-1120-0x0000000004850000-0x0000000004860000-memory.dmp

memory/3648-1121-0x00000000087F0000-0x0000000008882000-memory.dmp

memory/3648-1122-0x0000000008890000-0x0000000008906000-memory.dmp

memory/3648-1123-0x0000000008910000-0x0000000008960000-memory.dmp

memory/3648-1124-0x0000000004850000-0x0000000004860000-memory.dmp

memory/3648-1125-0x00000000089A0000-0x0000000008B62000-memory.dmp

memory/3648-1126-0x0000000008B70000-0x000000000909C000-memory.dmp

memory/3648-1127-0x0000000004850000-0x0000000004860000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9159Xc.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

memory/2596-1133-0x0000000000E90000-0x0000000000EC2000-memory.dmp

memory/2596-1134-0x00000000057A0000-0x00000000057EB000-memory.dmp

memory/2596-1135-0x0000000005750000-0x0000000005760000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry01KF72.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe

MD5 103f1dc5270469cf9414ee95dee9561f
SHA1 f44b74ac4e35943c1b9f85ca560595bb64a8c918
SHA256 5d8fcce25d88b4e04ddda7cc22108623d6ca4dc9f7a6a671d57e9230fd6a95ac
SHA512 a9909671d9b628e34add9aeff9e06d85f505229505732609d32e7db74b887e404712b8ab92d40c12e553adfad0e4eb1225d03655b107462cf316328e5bf90e88

C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe

MD5 103f1dc5270469cf9414ee95dee9561f
SHA1 f44b74ac4e35943c1b9f85ca560595bb64a8c918
SHA256 5d8fcce25d88b4e04ddda7cc22108623d6ca4dc9f7a6a671d57e9230fd6a95ac
SHA512 a9909671d9b628e34add9aeff9e06d85f505229505732609d32e7db74b887e404712b8ab92d40c12e553adfad0e4eb1225d03655b107462cf316328e5bf90e88

C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe

MD5 103f1dc5270469cf9414ee95dee9561f
SHA1 f44b74ac4e35943c1b9f85ca560595bb64a8c918
SHA256 5d8fcce25d88b4e04ddda7cc22108623d6ca4dc9f7a6a671d57e9230fd6a95ac
SHA512 a9909671d9b628e34add9aeff9e06d85f505229505732609d32e7db74b887e404712b8ab92d40c12e553adfad0e4eb1225d03655b107462cf316328e5bf90e88

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 6d81d19b6e02e1dc86b1bd2eb40e1507
SHA1 645e362eb27610601c57b9ca78d80ee84a5c0640
SHA256 178f26c99326101da77ce0620eb9fe584833d6ea8442913fe7ede38b72316db1
SHA512 9fa181b27f826b494a72d6498c83fe7cb7f31a98f28c5f50c4ed97a2d505ae7d032bbfcb5d0ca67864206ff72e487129749b64074003d0f33a5f4b2aefe060bc

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 6d81d19b6e02e1dc86b1bd2eb40e1507
SHA1 645e362eb27610601c57b9ca78d80ee84a5c0640
SHA256 178f26c99326101da77ce0620eb9fe584833d6ea8442913fe7ede38b72316db1
SHA512 9fa181b27f826b494a72d6498c83fe7cb7f31a98f28c5f50c4ed97a2d505ae7d032bbfcb5d0ca67864206ff72e487129749b64074003d0f33a5f4b2aefe060bc

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 6d81d19b6e02e1dc86b1bd2eb40e1507
SHA1 645e362eb27610601c57b9ca78d80ee84a5c0640
SHA256 178f26c99326101da77ce0620eb9fe584833d6ea8442913fe7ede38b72316db1
SHA512 9fa181b27f826b494a72d6498c83fe7cb7f31a98f28c5f50c4ed97a2d505ae7d032bbfcb5d0ca67864206ff72e487129749b64074003d0f33a5f4b2aefe060bc

memory/2496-1195-0x0000000002BE0000-0x0000000002C0E000-memory.dmp

memory/1780-1199-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1780-1200-0x0000000007B40000-0x0000000007B8B000-memory.dmp

\Users\Admin\AppData\Local\Temp\240598687.dll

MD5 098a4aa93e275de54bbc35ae4b981301
SHA1 d03646dc7c63e0784393f74085405c794b8555af
SHA256 5e81e932ef8520dd7de22cb9e3a02af66d29dc1726b133e894cbd7d797b9af3b
SHA512 2e039df42a6202f4e4c61c3bef62307dfa5b7e1e9103085c4f73c4459c8cc747bec85da8f1c87f97851de896104712c71f13da396c6016fc27f60cd358e93f46

memory/1780-1207-0x00000000057D0000-0x00000000057E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

MD5 2b8e1b75b4d4fdf0c640838191ac3946
SHA1 dfac012ccaa015f6a9ec5bd1c55ffa7b8074fb7f
SHA256 17a69481ffd684f025b0fe6b0f22529bd8454c49915e580da43fcb08a0c56e4e
SHA512 3c4de03250813dc78b772cc7e3246ac2726c37fae00844bfceda683e05506b53ba7ea95a06e2929e8ec736ccd50a9138e9f6e3c80980ebde5ed7ac66f06cc038

memory/1780-1240-0x00000000057D0000-0x00000000057E0000-memory.dmp

memory/2496-1247-0x00000000001E0000-0x00000000001FC000-memory.dmp

memory/2496-1248-0x0000000002C60000-0x0000000002C62000-memory.dmp

memory/2496-1249-0x0000000002C60000-0x0000000002C63000-memory.dmp

memory/1452-1251-0x0000000002BC0000-0x0000000002BDC000-memory.dmp

memory/2496-1255-0x00000000001E0000-0x00000000001FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2