amadey | 67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067

Analysis

max time kernel
143s
max time network
149s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
19-03-2023 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe
Size

1.0MB
MD5

16660f033fcaebf744365ec2f9fe79b3
SHA1

33ce6f5891fd258b82336c9a08e71ac77559cb1f
SHA256

67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067
SHA512

86dc9022a0b32b9e2cf5b3712dc0e45e8cb5b68ed89045d72bdc1b4ad4af332f733457e266cd2a62ab1be44bf46ddf8efdd75ab5b19fd6e064ffb8267ecc36c4
SSDEEP

24576:ry7e8MO34FjHHKCrnTLHFIfqHkd6cDKRidC3MkiIXzIoT:e7e8dMHH7nTxICa6cDUP3nZXEo

Score

10^/10

amadey aurora redline rhadamanthys build_main gena vint discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Extracted

Family

aurora

212.87.204.93:8081

Extracted

Family

redline

Botnet

build_main

80.85.156.168:20189

Attributes

auth_value
5e5c9cacc6d168f8ade7fb6419edb114

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Detect rhadamanthys stealer shellcode 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2268-1242-0x0000000002C20000-0x0000000002C3C000-memory.dmp	family_rhadamanthys
behavioral1/memory/1060-1247-0x0000000000E30000-0x0000000000E4C000-memory.dmp	family_rhadamanthys
behavioral1/memory/2268-1251-0x0000000002C20000-0x0000000002C3C000-memory.dmp	family_rhadamanthys

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

mx7407xs.exens8993bN.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ns8993bN.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4836-194-0x00000000047D0000-0x0000000004816000-memory.dmp	family_redline
behavioral1/memory/4836-195-0x00000000070D0000-0x0000000007114000-memory.dmp	family_redline
behavioral1/memory/4836-196-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-197-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-199-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-201-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-206-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-203-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-213-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-210-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-215-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-217-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-219-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-221-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-223-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-225-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-227-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-229-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-231-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline
behavioral1/memory/4836-233-0x00000000070D0000-0x000000000710E000-memory.dmp	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

KMuffPQJRlr6.exe

description pid process target process

PID 3364 created 2972 3364 KMuffPQJRlr6.exe taskhostw.exe
Downloads MZ/PE file

description	pid	process	target process
PID 3364 created 2972	3364	KMuffPQJRlr6.exe	taskhostw.exe

Executes dropped EXE 14 IoCs

Processes:

will0157.exewill0432.exewill0507.exemx7407xs.exens8993bN.exepy07ck14.exeqs1679oq.exery67eJ11.exelegenda.exeKMuffPQJRlr6.exesvchost.exeserv.exelegenda.exelegenda.exe

pid	process
2512	will0157.exe
4960	will0432.exe
2064	will0507.exe
2688	mx7407xs.exe
3888	ns8993bN.exe
4836	py07ck14.exe
2672	qs1679oq.exe
3780	ry67eJ11.exe
4772	legenda.exe
3364	KMuffPQJRlr6.exe
756	svchost.exe
2268	serv.exe
2688	legenda.exe
4192	legenda.exe

Loads dropped DLL 2 IoCs

Processes:

KMuffPQJRlr6.exerundll32.exe

pid process

3364 KMuffPQJRlr6.exe
4848 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3364	KMuffPQJRlr6.exe
4848	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

mx7407xs.exens8993bN.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	mx7407xs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	ns8993bN.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

will0507.exe67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exewill0157.exewill0432.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will0507.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	will0507.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will0157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	will0157.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will0432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	will0432.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

serv.exe

pid process

2268 serv.exe
2268 serv.exe
2268 serv.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

KMuffPQJRlr6.exe

description pid process target process

PID 3364 set thread context of 212 3364 KMuffPQJRlr6.exe ngentask.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1096 3364 WerFault.exe KMuffPQJRlr6.exe

pid	process
2268	serv.exe
2268	serv.exe
2268	serv.exe

description	pid	process	target process
PID 3364 set thread context of 212	3364	KMuffPQJRlr6.exe	ngentask.exe

pid	pid_target	process	target process
1096	3364	WerFault.exe	KMuffPQJRlr6.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

serv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	serv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	serv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3384 schtasks.exe

pid	process
3384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

mx7407xs.exens8993bN.exepy07ck14.exeqs1679oq.exeKMuffPQJRlr6.exengentask.exe

pid	process
2688	mx7407xs.exe
2688	mx7407xs.exe
3888	ns8993bN.exe
3888	ns8993bN.exe
4836	py07ck14.exe
4836	py07ck14.exe
2672	qs1679oq.exe
2672	qs1679oq.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
3364	KMuffPQJRlr6.exe
212	ngentask.exe
212	ngentask.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

mx7407xs.exens8993bN.exepy07ck14.exeqs1679oq.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2688	mx7407xs.exe
Token: SeDebugPrivilege	3888	ns8993bN.exe
Token: SeDebugPrivilege	4836	py07ck14.exe
Token: SeDebugPrivilege	2672	qs1679oq.exe
Token: SeIncreaseQuotaPrivilege	2384	wmic.exe
Token: SeSecurityPrivilege	2384	wmic.exe
Token: SeTakeOwnershipPrivilege	2384	wmic.exe
Token: SeLoadDriverPrivilege	2384	wmic.exe
Token: SeSystemProfilePrivilege	2384	wmic.exe
Token: SeSystemtimePrivilege	2384	wmic.exe
Token: SeProfSingleProcessPrivilege	2384	wmic.exe
Token: SeIncBasePriorityPrivilege	2384	wmic.exe
Token: SeCreatePagefilePrivilege	2384	wmic.exe
Token: SeBackupPrivilege	2384	wmic.exe
Token: SeRestorePrivilege	2384	wmic.exe
Token: SeShutdownPrivilege	2384	wmic.exe
Token: SeDebugPrivilege	2384	wmic.exe
Token: SeSystemEnvironmentPrivilege	2384	wmic.exe
Token: SeRemoteShutdownPrivilege	2384	wmic.exe
Token: SeUndockPrivilege	2384	wmic.exe
Token: SeManageVolumePrivilege	2384	wmic.exe
Token: 33	2384	wmic.exe
Token: 34	2384	wmic.exe
Token: 35	2384	wmic.exe
Token: 36	2384	wmic.exe
Token: SeIncreaseQuotaPrivilege	2384	wmic.exe
Token: SeSecurityPrivilege	2384	wmic.exe
Token: SeTakeOwnershipPrivilege	2384	wmic.exe
Token: SeLoadDriverPrivilege	2384	wmic.exe
Token: SeSystemProfilePrivilege	2384	wmic.exe
Token: SeSystemtimePrivilege	2384	wmic.exe
Token: SeProfSingleProcessPrivilege	2384	wmic.exe
Token: SeIncBasePriorityPrivilege	2384	wmic.exe
Token: SeCreatePagefilePrivilege	2384	wmic.exe
Token: SeBackupPrivilege	2384	wmic.exe
Token: SeRestorePrivilege	2384	wmic.exe
Token: SeShutdownPrivilege	2384	wmic.exe
Token: SeDebugPrivilege	2384	wmic.exe
Token: SeSystemEnvironmentPrivilege	2384	wmic.exe
Token: SeRemoteShutdownPrivilege	2384	wmic.exe
Token: SeUndockPrivilege	2384	wmic.exe
Token: SeManageVolumePrivilege	2384	wmic.exe
Token: 33	2384	wmic.exe
Token: 34	2384	wmic.exe
Token: 35	2384	wmic.exe
Token: 36	2384	wmic.exe
Token: SeIncreaseQuotaPrivilege	4324	WMIC.exe
Token: SeSecurityPrivilege	4324	WMIC.exe
Token: SeTakeOwnershipPrivilege	4324	WMIC.exe
Token: SeLoadDriverPrivilege	4324	WMIC.exe
Token: SeSystemProfilePrivilege	4324	WMIC.exe
Token: SeSystemtimePrivilege	4324	WMIC.exe
Token: SeProfSingleProcessPrivilege	4324	WMIC.exe
Token: SeIncBasePriorityPrivilege	4324	WMIC.exe
Token: SeCreatePagefilePrivilege	4324	WMIC.exe
Token: SeBackupPrivilege	4324	WMIC.exe
Token: SeRestorePrivilege	4324	WMIC.exe
Token: SeShutdownPrivilege	4324	WMIC.exe
Token: SeDebugPrivilege	4324	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4324	WMIC.exe
Token: SeRemoteShutdownPrivilege	4324	WMIC.exe
Token: SeUndockPrivilege	4324	WMIC.exe
Token: SeManageVolumePrivilege	4324	WMIC.exe
Token: 33	4324	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exewill0157.exewill0432.exewill0507.exery67eJ11.exelegenda.execmd.exeKMuffPQJRlr6.exesvchost.exe

description	pid	process	target process
PID 4140 wrote to memory of 2512	4140	67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe	will0157.exe
PID 4140 wrote to memory of 2512	4140	67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe	will0157.exe
PID 4140 wrote to memory of 2512	4140	67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe	will0157.exe
PID 2512 wrote to memory of 4960	2512	will0157.exe	will0432.exe
PID 2512 wrote to memory of 4960	2512	will0157.exe	will0432.exe
PID 2512 wrote to memory of 4960	2512	will0157.exe	will0432.exe
PID 4960 wrote to memory of 2064	4960	will0432.exe	will0507.exe
PID 4960 wrote to memory of 2064	4960	will0432.exe	will0507.exe
PID 4960 wrote to memory of 2064	4960	will0432.exe	will0507.exe
PID 2064 wrote to memory of 2688	2064	will0507.exe	mx7407xs.exe
PID 2064 wrote to memory of 2688	2064	will0507.exe	mx7407xs.exe
PID 2064 wrote to memory of 3888	2064	will0507.exe	ns8993bN.exe
PID 2064 wrote to memory of 3888	2064	will0507.exe	ns8993bN.exe
PID 2064 wrote to memory of 3888	2064	will0507.exe	ns8993bN.exe
PID 4960 wrote to memory of 4836	4960	will0432.exe	py07ck14.exe
PID 4960 wrote to memory of 4836	4960	will0432.exe	py07ck14.exe
PID 4960 wrote to memory of 4836	4960	will0432.exe	py07ck14.exe
PID 2512 wrote to memory of 2672	2512	will0157.exe	qs1679oq.exe
PID 2512 wrote to memory of 2672	2512	will0157.exe	qs1679oq.exe
PID 2512 wrote to memory of 2672	2512	will0157.exe	qs1679oq.exe
PID 4140 wrote to memory of 3780	4140	67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe	ry67eJ11.exe
PID 4140 wrote to memory of 3780	4140	67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe	ry67eJ11.exe
PID 4140 wrote to memory of 3780	4140	67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe	ry67eJ11.exe
PID 3780 wrote to memory of 4772	3780	ry67eJ11.exe	legenda.exe
PID 3780 wrote to memory of 4772	3780	ry67eJ11.exe	legenda.exe
PID 3780 wrote to memory of 4772	3780	ry67eJ11.exe	legenda.exe
PID 4772 wrote to memory of 3384	4772	legenda.exe	schtasks.exe
PID 4772 wrote to memory of 3384	4772	legenda.exe	schtasks.exe
PID 4772 wrote to memory of 3384	4772	legenda.exe	schtasks.exe
PID 4772 wrote to memory of 5060	4772	legenda.exe	cmd.exe
PID 4772 wrote to memory of 5060	4772	legenda.exe	cmd.exe
PID 4772 wrote to memory of 5060	4772	legenda.exe	cmd.exe
PID 5060 wrote to memory of 5032	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 5032	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 5032	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 4968	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4968	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4968	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4976	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4976	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4976	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4988	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 4988	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 4988	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 5020	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 5020	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 5020	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4956	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4956	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 4956	5060	cmd.exe	cacls.exe
PID 4772 wrote to memory of 3364	4772	legenda.exe	KMuffPQJRlr6.exe
PID 4772 wrote to memory of 3364	4772	legenda.exe	KMuffPQJRlr6.exe
PID 4772 wrote to memory of 3364	4772	legenda.exe	KMuffPQJRlr6.exe
PID 4772 wrote to memory of 756	4772	legenda.exe	svchost.exe
PID 4772 wrote to memory of 756	4772	legenda.exe	svchost.exe
PID 4772 wrote to memory of 756	4772	legenda.exe	svchost.exe
PID 4772 wrote to memory of 2268	4772	legenda.exe	serv.exe
PID 4772 wrote to memory of 2268	4772	legenda.exe	serv.exe
PID 4772 wrote to memory of 2268	4772	legenda.exe	serv.exe
PID 3364 wrote to memory of 2372	3364	KMuffPQJRlr6.exe	ngentask.exe
PID 3364 wrote to memory of 2372	3364	KMuffPQJRlr6.exe	ngentask.exe
PID 3364 wrote to memory of 2372	3364	KMuffPQJRlr6.exe	ngentask.exe
PID 756 wrote to memory of 2384	756	svchost.exe	wmic.exe
PID 756 wrote to memory of 2384	756	svchost.exe	wmic.exe

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2972

C:\Windows\SYSWOW64\fontview.exe
"C:\Windows\SYSWOW64\fontview.exe"
2⤵
PID:1060

C:\Users\Admin\AppData\Local\Temp\67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe
"C:\Users\Admin\AppData\Local\Temp\67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4140

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0157.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0157.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will0432.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will0432.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4960

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0507.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0507.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7407xs.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7407xs.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8993bN.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8993bN.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py07ck14.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py07ck14.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs1679oq.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs1679oq.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry67eJ11.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry67eJ11.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:5032

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:4968

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:4976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4988

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:5020

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:4956

C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe
"C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
5⤵
PID:2372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 456
5⤵
- Program crash
PID:1096

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
5⤵
PID:3272

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
5⤵
PID:2532

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
6⤵
PID:3964

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe
"C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
PID:2268

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4848

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe
Filesize
1.5MB

MD5
103f1dc5270469cf9414ee95dee9561f

SHA1
f44b74ac4e35943c1b9f85ca560595bb64a8c918

SHA256
5d8fcce25d88b4e04ddda7cc22108623d6ca4dc9f7a6a671d57e9230fd6a95ac

SHA512
a9909671d9b628e34add9aeff9e06d85f505229505732609d32e7db74b887e404712b8ab92d40c12e553adfad0e4eb1225d03655b107462cf316328e5bf90e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe
Filesize
1.5MB

MD5
103f1dc5270469cf9414ee95dee9561f

SHA1
f44b74ac4e35943c1b9f85ca560595bb64a8c918

SHA256
5d8fcce25d88b4e04ddda7cc22108623d6ca4dc9f7a6a671d57e9230fd6a95ac

SHA512
a9909671d9b628e34add9aeff9e06d85f505229505732609d32e7db74b887e404712b8ab92d40c12e553adfad0e4eb1225d03655b107462cf316328e5bf90e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000065001\KMuffPQJRlr6.exe
Filesize
1.5MB

MD5
103f1dc5270469cf9414ee95dee9561f

SHA1
f44b74ac4e35943c1b9f85ca560595bb64a8c918

SHA256
5d8fcce25d88b4e04ddda7cc22108623d6ca4dc9f7a6a671d57e9230fd6a95ac

SHA512
a9909671d9b628e34add9aeff9e06d85f505229505732609d32e7db74b887e404712b8ab92d40c12e553adfad0e4eb1225d03655b107462cf316328e5bf90e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe
Filesize
3.0MB

MD5
a8a106555b9e1f92569d623c66ee8c12

SHA1
a5080c26b5f5911c10d80654c84239a226fc75d1

SHA256
84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a

SHA512
9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe
Filesize
3.0MB

MD5
a8a106555b9e1f92569d623c66ee8c12

SHA1
a5080c26b5f5911c10d80654c84239a226fc75d1

SHA256
84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a

SHA512
9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe
Filesize
3.0MB

MD5
a8a106555b9e1f92569d623c66ee8c12

SHA1
a5080c26b5f5911c10d80654c84239a226fc75d1

SHA256
84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a

SHA512
9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe
Filesize
353KB

MD5
8ad47f6bd62975254ede9b4737429715

SHA1
f772c8b56828c4c5dffb1c87ac3116de3c8bbc29

SHA256
7f5a1d9a81c8e16ed8e5fff72f8685f529235753bd3ebfabeb947c589774179d

SHA512
dd1cbe5302771a312afae4052c8f186bd04fdc313aaa89d4fcad899bfb31a55120f1d71c13799840be28c1d5b501c4a9b6d2e645f04b5af81a2966f3e06228b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe
Filesize
353KB

MD5
8ad47f6bd62975254ede9b4737429715

SHA1
f772c8b56828c4c5dffb1c87ac3116de3c8bbc29

SHA256
7f5a1d9a81c8e16ed8e5fff72f8685f529235753bd3ebfabeb947c589774179d

SHA512
dd1cbe5302771a312afae4052c8f186bd04fdc313aaa89d4fcad899bfb31a55120f1d71c13799840be28c1d5b501c4a9b6d2e645f04b5af81a2966f3e06228b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe
Filesize
353KB

MD5
8ad47f6bd62975254ede9b4737429715

SHA1
f772c8b56828c4c5dffb1c87ac3116de3c8bbc29

SHA256
7f5a1d9a81c8e16ed8e5fff72f8685f529235753bd3ebfabeb947c589774179d

SHA512
dd1cbe5302771a312afae4052c8f186bd04fdc313aaa89d4fcad899bfb31a55120f1d71c13799840be28c1d5b501c4a9b6d2e645f04b5af81a2966f3e06228b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry67eJ11.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry67eJ11.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0157.exe
Filesize
851KB

MD5
ef5889763c11ca181c56e65b2f5b2a0e

SHA1
23d60bfbffeacb9958fa55dbe80d88fbd2d96a7e

SHA256
b2234873cd79f834d388fcea9ab543d6a884f5e4e5dcadf50056a556bab7e68d

SHA512
fb51ba58e24fb73ba5dfc50cf3afafbd076cc4380aa48a2719860245d1a77f37325ebb82bfb4ad8e8d52782b64b2b00a04061f5ac8b140a05987917fb55b910b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0157.exe
Filesize
851KB

MD5
ef5889763c11ca181c56e65b2f5b2a0e

SHA1
23d60bfbffeacb9958fa55dbe80d88fbd2d96a7e

SHA256
b2234873cd79f834d388fcea9ab543d6a884f5e4e5dcadf50056a556bab7e68d

SHA512
fb51ba58e24fb73ba5dfc50cf3afafbd076cc4380aa48a2719860245d1a77f37325ebb82bfb4ad8e8d52782b64b2b00a04061f5ac8b140a05987917fb55b910b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs1679oq.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs1679oq.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will0432.exe
Filesize
707KB

MD5
63a2649ae317c013c51c5b875b96c7e0

SHA1
18c8397a3b61c5db1d38dcbf10cd1871941563e3

SHA256
83343d77de6bdd56694309bc4af0906418c0266227e3f531145d6edd0cbe1042

SHA512
ae98fb451158c82cafa85ae7fb3e9f776bce4d6cfd0a491851c909964fe83a82a308030e4cec34ff67b71c7f157f75d92a009464535ad0b81d9130052edd20a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will0432.exe
Filesize
707KB

MD5
63a2649ae317c013c51c5b875b96c7e0

SHA1
18c8397a3b61c5db1d38dcbf10cd1871941563e3

SHA256
83343d77de6bdd56694309bc4af0906418c0266227e3f531145d6edd0cbe1042

SHA512
ae98fb451158c82cafa85ae7fb3e9f776bce4d6cfd0a491851c909964fe83a82a308030e4cec34ff67b71c7f157f75d92a009464535ad0b81d9130052edd20a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py07ck14.exe
Filesize
391KB

MD5
324d31bcb4e62eea8a833e89ac9bd158

SHA1
9910f4606c492dbaa071321b3e69ee7d53e7836e

SHA256
f1f4076aa99a72dba7c5e722d018217ae8463176b6292157229ba4e0977dbc12

SHA512
d9a16348a2d870790f962bdcb0dc5f57ce882f62ac5749e95e76073b3eb6f840ac4ddc1fd8fcaf323f88ec77fdb9e8c441597d3d6a30f39133b581be8075c5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py07ck14.exe
Filesize
391KB

MD5
324d31bcb4e62eea8a833e89ac9bd158

SHA1
9910f4606c492dbaa071321b3e69ee7d53e7836e

SHA256
f1f4076aa99a72dba7c5e722d018217ae8463176b6292157229ba4e0977dbc12

SHA512
d9a16348a2d870790f962bdcb0dc5f57ce882f62ac5749e95e76073b3eb6f840ac4ddc1fd8fcaf323f88ec77fdb9e8c441597d3d6a30f39133b581be8075c5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0507.exe
Filesize
353KB

MD5
2c1d2d8088f4064e1fb0ef5d6c4cbb91

SHA1
7824674546f86e63db81ca7c6f33990154f81493

SHA256
c18dd165b2688f9afb6e723a4da90d42a85943471aacfd4b1c84d3742166d178

SHA512
c281ae614fc85753e736804d1dfdeae91a880b8e8e56216a3082a7c1ca0c46d16618bea992796b28da171fe9be4cca91c82061c52ec40f5d8029a5c4e1bc8a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0507.exe
Filesize
353KB

MD5
2c1d2d8088f4064e1fb0ef5d6c4cbb91

SHA1
7824674546f86e63db81ca7c6f33990154f81493

SHA256
c18dd165b2688f9afb6e723a4da90d42a85943471aacfd4b1c84d3742166d178

SHA512
c281ae614fc85753e736804d1dfdeae91a880b8e8e56216a3082a7c1ca0c46d16618bea992796b28da171fe9be4cca91c82061c52ec40f5d8029a5c4e1bc8a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7407xs.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7407xs.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8993bN.exe
Filesize
333KB

MD5
ac0c7b7b2f53a198c9a3ce08ad47d2ae

SHA1
2636d0f8bfe5cdac7977f55f51b19d87a4e901fa

SHA256
6bebaf5dbdcaebca0bf98f08b0a2da800c22010f51b647c2014c865f66cabbfd

SHA512
91080422faa7119ed7777e3f66ff2c5a489481abeb18792d1b2b9e30c69f085df6bdf7dd59befac5d286db1037c070dacf9504b7cadd0d3e8df725dfc103287f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8993bN.exe
Filesize
333KB

MD5
ac0c7b7b2f53a198c9a3ce08ad47d2ae

SHA1
2636d0f8bfe5cdac7977f55f51b19d87a4e901fa

SHA256
6bebaf5dbdcaebca0bf98f08b0a2da800c22010f51b647c2014c865f66cabbfd

SHA512
91080422faa7119ed7777e3f66ff2c5a489481abeb18792d1b2b9e30c69f085df6bdf7dd59befac5d286db1037c070dacf9504b7cadd0d3e8df725dfc103287f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
Filesize
71KB

MD5
a3eb5f22bc8e7f4060e3ff18c4ac70b9

SHA1
8480869a34c9723063dba9cc8279cf4e7c2bc4cd

SHA256
0582ca04b28149ce2fd9732dff5e9894a60454eeb03166ddde677c9224c1f9f6

SHA512
3e88f72ace3e80a18f2986b43d90b9bf33e131ec77ce34c1462605784332e4676af5e8414ee75146bd14ef8a2e60a13ecf097c189206cd010f748e171903c5f0

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
\Users\Admin\AppData\Local\Temp\240603796.dll
Filesize
334KB

MD5
098a4aa93e275de54bbc35ae4b981301

SHA1
d03646dc7c63e0784393f74085405c794b8555af

SHA256
5e81e932ef8520dd7de22cb9e3a02af66d29dc1726b133e894cbd7d797b9af3b

SHA512
2e039df42a6202f4e4c61c3bef62307dfa5b7e1e9103085c4f73c4459c8cc747bec85da8f1c87f97851de896104712c71f13da396c6016fc27f60cd358e93f46

Download Submit
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
memory/212-1195-0x00000000061E0000-0x000000000622B000-memory.dmp

Filesize
300KB

Download
memory/212-1235-0x00000000057D0000-0x00000000057E0000-memory.dmp

Filesize
64KB

Download
memory/212-1196-0x00000000057D0000-0x00000000057E0000-memory.dmp

Filesize
64KB

Download
memory/212-1194-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1060-1247-0x0000000000E30000-0x0000000000E4C000-memory.dmp

Filesize
112KB

Download
memory/2268-1242-0x0000000002C20000-0x0000000002C3C000-memory.dmp

Filesize
112KB

Download
memory/2268-1244-0x0000000002C50000-0x0000000002C53000-memory.dmp

Filesize
12KB

Download
memory/2268-1251-0x0000000002C20000-0x0000000002C3C000-memory.dmp

Filesize
112KB

Download
memory/2268-1243-0x0000000002C50000-0x0000000002C52000-memory.dmp

Filesize
8KB

Download
memory/2268-1190-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2672-1130-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/2672-1129-0x00000000058A0000-0x00000000058EB000-memory.dmp

Filesize
300KB

Download
memory/2672-1128-0x0000000000E60000-0x0000000000E92000-memory.dmp

Filesize
200KB

Download
memory/2688-144-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/3888-178-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-189-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/3888-150-0x0000000004650000-0x000000000466A000-memory.dmp

Filesize
104KB

Download
memory/3888-151-0x0000000007210000-0x000000000770E000-memory.dmp

Filesize
5.0MB

Download
memory/3888-152-0x0000000004BE0000-0x0000000004BF8000-memory.dmp

Filesize
96KB

Download
memory/3888-153-0x0000000002BE0000-0x0000000002C0D000-memory.dmp

Filesize
180KB

Download
memory/3888-154-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/3888-155-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/3888-156-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/3888-157-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-158-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-160-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-162-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-164-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-166-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-168-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-170-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-172-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-174-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-176-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-180-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-182-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-184-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3888-185-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/3888-186-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/3888-187-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/4836-1110-0x00000000080B0000-0x00000000080FB000-memory.dmp

Filesize
300KB

Download
memory/4836-1116-0x0000000007160000-0x0000000007170000-memory.dmp

Filesize
64KB

Download
memory/4836-1122-0x0000000007160000-0x0000000007170000-memory.dmp

Filesize
64KB

Download
memory/4836-213-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-209-0x0000000007160000-0x0000000007170000-memory.dmp

Filesize
64KB

Download
memory/4836-207-0x0000000007160000-0x0000000007170000-memory.dmp

Filesize
64KB

Download
memory/4836-203-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-206-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-205-0x0000000002B20000-0x0000000002B6B000-memory.dmp

Filesize
300KB

Download
memory/4836-201-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-199-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-197-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-196-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-195-0x00000000070D0000-0x0000000007114000-memory.dmp

Filesize
272KB

Download
memory/4836-194-0x00000000047D0000-0x0000000004816000-memory.dmp

Filesize
280KB

Download
memory/4836-1120-0x0000000008C20000-0x0000000008DE2000-memory.dmp

Filesize
1.8MB

Download
memory/4836-1119-0x0000000008B90000-0x0000000008BE0000-memory.dmp

Filesize
320KB

Download
memory/4836-1118-0x0000000008AF0000-0x0000000008B66000-memory.dmp

Filesize
472KB

Download
memory/4836-1117-0x0000000007160000-0x0000000007170000-memory.dmp

Filesize
64KB

Download
memory/4836-1121-0x0000000008DF0000-0x000000000931C000-memory.dmp

Filesize
5.2MB

Download
memory/4836-1115-0x0000000007160000-0x0000000007170000-memory.dmp

Filesize
64KB

Download
memory/4836-1114-0x0000000008900000-0x0000000008992000-memory.dmp

Filesize
584KB

Download
memory/4836-1113-0x0000000008240000-0x00000000082A6000-memory.dmp

Filesize
408KB

Download
memory/4836-1111-0x0000000007160000-0x0000000007170000-memory.dmp

Filesize
64KB

Download
memory/4836-211-0x0000000007160000-0x0000000007170000-memory.dmp

Filesize
64KB

Download
memory/4836-1109-0x0000000007F60000-0x0000000007F9E000-memory.dmp

Filesize
248KB

Download
memory/4836-1108-0x0000000007F40000-0x0000000007F52000-memory.dmp

Filesize
72KB

Download
memory/4836-1107-0x0000000007E00000-0x0000000007F0A000-memory.dmp

Filesize
1.0MB

Download
memory/4836-1106-0x0000000007770000-0x0000000007D76000-memory.dmp

Filesize
6.0MB

Download
memory/4836-233-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-231-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-229-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-227-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-225-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-223-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-221-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-219-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-217-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-215-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download
memory/4836-210-0x00000000070D0000-0x000000000710E000-memory.dmp

Filesize
248KB

Download