Malware Analysis Report

2024-11-15 09:17

Sample ID 230319-hw4d9ahd61
Target d7c5cd06143cd8e4aadf95c82935fd7e.exe
SHA256 361dda6d1052d40b13116e82e39e6e572bf6f10e838809053409e4f2c7adc779
Tags
amadey aurora redline rhadamanthys gena vint discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

361dda6d1052d40b13116e82e39e6e572bf6f10e838809053409e4f2c7adc779

Threat Level: Known bad

The file d7c5cd06143cd8e4aadf95c82935fd7e.exe was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline rhadamanthys gena vint discovery evasion infostealer persistence spyware stealer trojan

RedLine

Modifies Windows Defender Real-time Protection settings

Rhadamanthys

Detect rhadamanthys stealer shellcode

Amadey

Aurora

RedLine payload

Looks for VirtualBox Guest Additions in registry

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Enumerates VirtualBox registry keys

Looks for VMWare Tools registry key

Downloads MZ/PE file

Loads dropped DLL

Checks BIOS information in registry

Windows security modification

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Checks installed software on the system

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks system information in the registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks for VirtualBox DLLs, possible anti-VM trick

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-19 07:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-19 07:06

Reported

2023-03-19 07:08

Platform

win7-20230220-en

Max time kernel

119s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Rhadamanthys

stealer rhadamanthys

Enumerates VirtualBox registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Downloads MZ/PE file

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe N/A

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1392 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 1392 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 1392 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 1392 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 1392 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 1392 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 1392 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 1796 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 1796 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 1796 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 1796 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 1796 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 1796 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 1796 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 1512 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 1512 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 1512 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 1512 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 1512 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 1512 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 1512 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 772 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 772 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 772 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 772 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 772 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 772 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 772 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 772 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 772 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 772 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 772 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 772 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 772 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 772 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 1512 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 1512 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 1512 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 1512 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 1512 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 1512 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 1512 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 1796 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 1796 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 1796 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 1796 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 1796 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 1796 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 1796 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 1392 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 1392 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 1392 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 1392 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 1392 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 1392 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 1392 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 1668 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1668 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1668 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1668 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1668 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1668 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1668 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1212 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe

"C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

"C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe

"C:\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe"

C:\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe

"C:\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {0DDD663B-394B-4F8B-A444-710256C227C9} S-1-5-21-2647223082-2067913677-935928954-1000:BPOQNXYB\Admin:Interactive:[1]

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Network

Country Destination Domain Proto
DE 193.233.20.30:4125 tcp
DE 193.233.20.30:4125 tcp
RU 62.204.41.87:80 62.204.41.87 tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
DE 144.76.136.153:443 transfer.sh tcp
NL 185.246.221.126:80 185.246.221.126 tcp
US 8.8.8.8:53 ebfertility.com udp
US 89.190.157.61:80 ebfertility.com tcp
NL 212.87.204.93:8081 tcp
RU 62.204.41.88:80 62.204.41.88 tcp
US 66.42.108.195:40499 tcp
US 66.42.108.195:40499 tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

MD5 ac81bf20dfbf47ddbbee1ae8fdba4ddb
SHA1 a55b2f5de6332b7db8a20598c1f9de021b565445
SHA256 1dd67bb2ab4789a32c57ca7248dad49cbe59d0d7849ed940335312a251a05a89
SHA512 de179afea6aa5048141ec21f38987972b5122134ce20ffab373d12604299548d08e14742fae38d58dc80a87f417d31d7dd4c737eef701953c0f6a62f8e00b474

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

MD5 ac81bf20dfbf47ddbbee1ae8fdba4ddb
SHA1 a55b2f5de6332b7db8a20598c1f9de021b565445
SHA256 1dd67bb2ab4789a32c57ca7248dad49cbe59d0d7849ed940335312a251a05a89
SHA512 de179afea6aa5048141ec21f38987972b5122134ce20ffab373d12604299548d08e14742fae38d58dc80a87f417d31d7dd4c737eef701953c0f6a62f8e00b474

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

MD5 ac81bf20dfbf47ddbbee1ae8fdba4ddb
SHA1 a55b2f5de6332b7db8a20598c1f9de021b565445
SHA256 1dd67bb2ab4789a32c57ca7248dad49cbe59d0d7849ed940335312a251a05a89
SHA512 de179afea6aa5048141ec21f38987972b5122134ce20ffab373d12604299548d08e14742fae38d58dc80a87f417d31d7dd4c737eef701953c0f6a62f8e00b474

\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

MD5 ac81bf20dfbf47ddbbee1ae8fdba4ddb
SHA1 a55b2f5de6332b7db8a20598c1f9de021b565445
SHA256 1dd67bb2ab4789a32c57ca7248dad49cbe59d0d7849ed940335312a251a05a89
SHA512 de179afea6aa5048141ec21f38987972b5122134ce20ffab373d12604299548d08e14742fae38d58dc80a87f417d31d7dd4c737eef701953c0f6a62f8e00b474

\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

MD5 e3c1e59fde4661361fa2d8ff2eef29dc
SHA1 b3d747fd7c94260183d6ea1d559550121ee503a2
SHA256 248ad74f440401778657006912c9ef05bd64e82a09e93f117daf5a43ef49dfd1
SHA512 e7db7e67245ada384f33f41d86610ff0b63f0bb44f36fa006c431dbd46118671e08e1032286f664f053af9514609654f57563f449b8bd652b2aa93ad45c2831d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

MD5 e3c1e59fde4661361fa2d8ff2eef29dc
SHA1 b3d747fd7c94260183d6ea1d559550121ee503a2
SHA256 248ad74f440401778657006912c9ef05bd64e82a09e93f117daf5a43ef49dfd1
SHA512 e7db7e67245ada384f33f41d86610ff0b63f0bb44f36fa006c431dbd46118671e08e1032286f664f053af9514609654f57563f449b8bd652b2aa93ad45c2831d

\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

MD5 e3c1e59fde4661361fa2d8ff2eef29dc
SHA1 b3d747fd7c94260183d6ea1d559550121ee503a2
SHA256 248ad74f440401778657006912c9ef05bd64e82a09e93f117daf5a43ef49dfd1
SHA512 e7db7e67245ada384f33f41d86610ff0b63f0bb44f36fa006c431dbd46118671e08e1032286f664f053af9514609654f57563f449b8bd652b2aa93ad45c2831d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

MD5 e3c1e59fde4661361fa2d8ff2eef29dc
SHA1 b3d747fd7c94260183d6ea1d559550121ee503a2
SHA256 248ad74f440401778657006912c9ef05bd64e82a09e93f117daf5a43ef49dfd1
SHA512 e7db7e67245ada384f33f41d86610ff0b63f0bb44f36fa006c431dbd46118671e08e1032286f664f053af9514609654f57563f449b8bd652b2aa93ad45c2831d

\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

MD5 f9b78101ecfa74cbaa75ea24460070be
SHA1 eb618fa52ccbdf2b07de5c1895372d26b8a89dce
SHA256 211fc761231cf8a90eebee85b6c0974a2ff16eed28064a19d6583f28b9a2cd2e
SHA512 43e878b92cd27a0a4510eaf513aa2b8b3f56b65d5f84f4a21cc652fc8a560ce64ddb921fb0c0ea99841c0d4c78e802905e95efccddcafd738709c8ccc37890df

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

MD5 f9b78101ecfa74cbaa75ea24460070be
SHA1 eb618fa52ccbdf2b07de5c1895372d26b8a89dce
SHA256 211fc761231cf8a90eebee85b6c0974a2ff16eed28064a19d6583f28b9a2cd2e
SHA512 43e878b92cd27a0a4510eaf513aa2b8b3f56b65d5f84f4a21cc652fc8a560ce64ddb921fb0c0ea99841c0d4c78e802905e95efccddcafd738709c8ccc37890df

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

MD5 f9b78101ecfa74cbaa75ea24460070be
SHA1 eb618fa52ccbdf2b07de5c1895372d26b8a89dce
SHA256 211fc761231cf8a90eebee85b6c0974a2ff16eed28064a19d6583f28b9a2cd2e
SHA512 43e878b92cd27a0a4510eaf513aa2b8b3f56b65d5f84f4a21cc652fc8a560ce64ddb921fb0c0ea99841c0d4c78e802905e95efccddcafd738709c8ccc37890df

\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

MD5 f9b78101ecfa74cbaa75ea24460070be
SHA1 eb618fa52ccbdf2b07de5c1895372d26b8a89dce
SHA256 211fc761231cf8a90eebee85b6c0974a2ff16eed28064a19d6583f28b9a2cd2e
SHA512 43e878b92cd27a0a4510eaf513aa2b8b3f56b65d5f84f4a21cc652fc8a560ce64ddb921fb0c0ea99841c0d4c78e802905e95efccddcafd738709c8ccc37890df

\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1976-92-0x0000000001080000-0x000000000108A000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

MD5 acc6c04fd13b2933acef78de8d47e434
SHA1 0d674bb3f5f19db69ab636d3e5d8ec9224a31843
SHA256 bd3321ff2c37c3e3610350fdd59dc56ea957c022c4664e57b42a197801d74590
SHA512 0312d87d241246813c7e8cfdbf1c606325e19364a73978226461be414ff411fee44892ff65a3cb8e0c74444bd96b475936dcf588de2c83ebd63248520e6e10e3

\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

MD5 acc6c04fd13b2933acef78de8d47e434
SHA1 0d674bb3f5f19db69ab636d3e5d8ec9224a31843
SHA256 bd3321ff2c37c3e3610350fdd59dc56ea957c022c4664e57b42a197801d74590
SHA512 0312d87d241246813c7e8cfdbf1c606325e19364a73978226461be414ff411fee44892ff65a3cb8e0c74444bd96b475936dcf588de2c83ebd63248520e6e10e3

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

MD5 acc6c04fd13b2933acef78de8d47e434
SHA1 0d674bb3f5f19db69ab636d3e5d8ec9224a31843
SHA256 bd3321ff2c37c3e3610350fdd59dc56ea957c022c4664e57b42a197801d74590
SHA512 0312d87d241246813c7e8cfdbf1c606325e19364a73978226461be414ff411fee44892ff65a3cb8e0c74444bd96b475936dcf588de2c83ebd63248520e6e10e3

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

MD5 acc6c04fd13b2933acef78de8d47e434
SHA1 0d674bb3f5f19db69ab636d3e5d8ec9224a31843
SHA256 bd3321ff2c37c3e3610350fdd59dc56ea957c022c4664e57b42a197801d74590
SHA512 0312d87d241246813c7e8cfdbf1c606325e19364a73978226461be414ff411fee44892ff65a3cb8e0c74444bd96b475936dcf588de2c83ebd63248520e6e10e3

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

MD5 acc6c04fd13b2933acef78de8d47e434
SHA1 0d674bb3f5f19db69ab636d3e5d8ec9224a31843
SHA256 bd3321ff2c37c3e3610350fdd59dc56ea957c022c4664e57b42a197801d74590
SHA512 0312d87d241246813c7e8cfdbf1c606325e19364a73978226461be414ff411fee44892ff65a3cb8e0c74444bd96b475936dcf588de2c83ebd63248520e6e10e3

\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

MD5 acc6c04fd13b2933acef78de8d47e434
SHA1 0d674bb3f5f19db69ab636d3e5d8ec9224a31843
SHA256 bd3321ff2c37c3e3610350fdd59dc56ea957c022c4664e57b42a197801d74590
SHA512 0312d87d241246813c7e8cfdbf1c606325e19364a73978226461be414ff411fee44892ff65a3cb8e0c74444bd96b475936dcf588de2c83ebd63248520e6e10e3

memory/1356-103-0x0000000002F00000-0x0000000002F1A000-memory.dmp

memory/1356-104-0x0000000002F20000-0x0000000002F38000-memory.dmp

memory/1356-105-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-106-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-108-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-110-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-112-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-114-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-116-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-118-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-120-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-122-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-124-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-126-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-129-0x0000000000250000-0x000000000027D000-memory.dmp

memory/1356-128-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-132-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-131-0x00000000071C0000-0x0000000007200000-memory.dmp

memory/1356-133-0x00000000071C0000-0x0000000007200000-memory.dmp

memory/1356-135-0x0000000002F20000-0x0000000002F32000-memory.dmp

memory/1356-136-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/1356-137-0x0000000000400000-0x0000000002B0C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

MD5 2e5ec1801c4e9afcba6f9b043c07df6e
SHA1 1346e3db84fdeb3769421ae677e6088f13a6ee6b
SHA256 5f5ed7df6a2f3c8a67997475117c7a4a812b8ed993f37810eaa637315284c7cd
SHA512 0dcf71978ca4acb4247c697b439924f917b720ed4ebcd02c6ab2f1b033ae4523aad355319c67c8f9412f1788be73cd089cb6547511f446de882f1bc33513dce7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

MD5 2e5ec1801c4e9afcba6f9b043c07df6e
SHA1 1346e3db84fdeb3769421ae677e6088f13a6ee6b
SHA256 5f5ed7df6a2f3c8a67997475117c7a4a812b8ed993f37810eaa637315284c7cd
SHA512 0dcf71978ca4acb4247c697b439924f917b720ed4ebcd02c6ab2f1b033ae4523aad355319c67c8f9412f1788be73cd089cb6547511f446de882f1bc33513dce7

\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

MD5 2e5ec1801c4e9afcba6f9b043c07df6e
SHA1 1346e3db84fdeb3769421ae677e6088f13a6ee6b
SHA256 5f5ed7df6a2f3c8a67997475117c7a4a812b8ed993f37810eaa637315284c7cd
SHA512 0dcf71978ca4acb4247c697b439924f917b720ed4ebcd02c6ab2f1b033ae4523aad355319c67c8f9412f1788be73cd089cb6547511f446de882f1bc33513dce7

\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

MD5 2e5ec1801c4e9afcba6f9b043c07df6e
SHA1 1346e3db84fdeb3769421ae677e6088f13a6ee6b
SHA256 5f5ed7df6a2f3c8a67997475117c7a4a812b8ed993f37810eaa637315284c7cd
SHA512 0dcf71978ca4acb4247c697b439924f917b720ed4ebcd02c6ab2f1b033ae4523aad355319c67c8f9412f1788be73cd089cb6547511f446de882f1bc33513dce7

\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

MD5 2e5ec1801c4e9afcba6f9b043c07df6e
SHA1 1346e3db84fdeb3769421ae677e6088f13a6ee6b
SHA256 5f5ed7df6a2f3c8a67997475117c7a4a812b8ed993f37810eaa637315284c7cd
SHA512 0dcf71978ca4acb4247c697b439924f917b720ed4ebcd02c6ab2f1b033ae4523aad355319c67c8f9412f1788be73cd089cb6547511f446de882f1bc33513dce7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

MD5 2e5ec1801c4e9afcba6f9b043c07df6e
SHA1 1346e3db84fdeb3769421ae677e6088f13a6ee6b
SHA256 5f5ed7df6a2f3c8a67997475117c7a4a812b8ed993f37810eaa637315284c7cd
SHA512 0dcf71978ca4acb4247c697b439924f917b720ed4ebcd02c6ab2f1b033ae4523aad355319c67c8f9412f1788be73cd089cb6547511f446de882f1bc33513dce7

memory/1936-148-0x00000000030E0000-0x0000000003126000-memory.dmp

memory/1936-149-0x00000000048B0000-0x00000000048F4000-memory.dmp

memory/1936-150-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-157-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-155-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-153-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-151-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-160-0x00000000002D0000-0x000000000031B000-memory.dmp

memory/1936-159-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-162-0x00000000070D0000-0x0000000007110000-memory.dmp

memory/1936-163-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-165-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-167-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-171-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-169-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-175-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-173-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-177-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-179-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-181-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-183-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-185-0x00000000048B0000-0x00000000048EE000-memory.dmp

memory/1936-1058-0x00000000070D0000-0x0000000007110000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

memory/376-1067-0x0000000000D70000-0x0000000000DA2000-memory.dmp

memory/376-1068-0x0000000002570000-0x00000000025B0000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000066001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 96a1826acb653006f7528f77dc88a8f1
SHA1 f2d8b92a9a2c9cb043606a24697c28b01136ae2c
SHA256 74bb06f6276fec8207c129228abb064fc1dc1b3d499f258c5630d3069b032d2c
SHA512 347bbaf38e8852e30417cdb5dfe1891167f6b1c187eaff6bc9f625ad34cc74899e4c3ae741dba86f48d92a66bf5b5791fe7c9f060958c0cd1d638bd3bb11b8e8

\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 96a1826acb653006f7528f77dc88a8f1
SHA1 f2d8b92a9a2c9cb043606a24697c28b01136ae2c
SHA256 74bb06f6276fec8207c129228abb064fc1dc1b3d499f258c5630d3069b032d2c
SHA512 347bbaf38e8852e30417cdb5dfe1891167f6b1c187eaff6bc9f625ad34cc74899e4c3ae741dba86f48d92a66bf5b5791fe7c9f060958c0cd1d638bd3bb11b8e8

\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 96a1826acb653006f7528f77dc88a8f1
SHA1 f2d8b92a9a2c9cb043606a24697c28b01136ae2c
SHA256 74bb06f6276fec8207c129228abb064fc1dc1b3d499f258c5630d3069b032d2c
SHA512 347bbaf38e8852e30417cdb5dfe1891167f6b1c187eaff6bc9f625ad34cc74899e4c3ae741dba86f48d92a66bf5b5791fe7c9f060958c0cd1d638bd3bb11b8e8

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 96a1826acb653006f7528f77dc88a8f1
SHA1 f2d8b92a9a2c9cb043606a24697c28b01136ae2c
SHA256 74bb06f6276fec8207c129228abb064fc1dc1b3d499f258c5630d3069b032d2c
SHA512 347bbaf38e8852e30417cdb5dfe1891167f6b1c187eaff6bc9f625ad34cc74899e4c3ae741dba86f48d92a66bf5b5791fe7c9f060958c0cd1d638bd3bb11b8e8

C:\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 96a1826acb653006f7528f77dc88a8f1
SHA1 f2d8b92a9a2c9cb043606a24697c28b01136ae2c
SHA256 74bb06f6276fec8207c129228abb064fc1dc1b3d499f258c5630d3069b032d2c
SHA512 347bbaf38e8852e30417cdb5dfe1891167f6b1c187eaff6bc9f625ad34cc74899e4c3ae741dba86f48d92a66bf5b5791fe7c9f060958c0cd1d638bd3bb11b8e8

\Users\Admin\AppData\Local\Temp\1000067001\serv.exe

MD5 96a1826acb653006f7528f77dc88a8f1
SHA1 f2d8b92a9a2c9cb043606a24697c28b01136ae2c
SHA256 74bb06f6276fec8207c129228abb064fc1dc1b3d499f258c5630d3069b032d2c
SHA512 347bbaf38e8852e30417cdb5dfe1891167f6b1c187eaff6bc9f625ad34cc74899e4c3ae741dba86f48d92a66bf5b5791fe7c9f060958c0cd1d638bd3bb11b8e8

memory/1032-1123-0x0000000000240000-0x000000000026E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

C:\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

C:\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

\Users\Admin\AppData\Local\Temp\1000070001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

memory/1048-1140-0x0000000000240000-0x0000000000272000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot

MD5 2beb695add0546f6a18496aae58b2558
SHA1 1fd818202a94825c56ad7a7793bea87c6f02960e
SHA256 132cb7037ada7d8563c5b8cf64796ed22b0fbc1ccefbbbf5faa3c18545b289ed
SHA512 e80fa42ab27afa16e0f6f72639077be7da3e73f7c7b4cecbe0d24637ee76334de77a2b61e7c3afab4e3750e53a93baa68d3cdb9c1eb55fb9a5d580cff94f21f2

memory/1048-1163-0x0000000002370000-0x00000000023B0000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

C:\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

C:\Users\Admin\AppData\Local\Temp\1000071001\123ds.exe

MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512 52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

memory/1252-1189-0x0000000001060000-0x0000000001092000-memory.dmp

memory/1252-1190-0x0000000000890000-0x00000000008D0000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

memory/1032-1220-0x0000000000290000-0x0000000000291000-memory.dmp

memory/1032-1219-0x0000000000270000-0x000000000028C000-memory.dmp

memory/1032-1224-0x0000000000270000-0x000000000028C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-19 07:06

Reported

2023-03-19 07:08

Platform

win10v2004-20230220-en

Max time kernel

108s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe"

Signatures

Amadey

trojan amadey

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5116 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 5116 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 5116 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe
PID 2496 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 2496 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 2496 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe
PID 2672 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 2672 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 2672 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe
PID 1336 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 1336 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe
PID 1336 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 1336 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 1336 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe
PID 2672 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 2672 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 2672 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe
PID 2496 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 2496 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 2496 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe
PID 5116 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 5116 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 5116 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe
PID 1536 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1536 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1536 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1488 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1488 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1488 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 1488 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 1488 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 1488 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2624 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1488 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\rundll32.exe
PID 1488 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\rundll32.exe
PID 1488 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe

"C:\Users\Admin\AppData\Local\Temp\d7c5cd06143cd8e4aadf95c82935fd7e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1136

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 210.81.184.52.in-addr.arpa udp
US 8.8.8.8:53 160.252.72.23.in-addr.arpa udp
DE 193.233.20.30:4125 tcp
US 20.189.173.9:443 tcp
US 8.8.8.8:53 30.20.233.193.in-addr.arpa udp
DE 193.233.20.30:4125 tcp
NL 8.238.21.126:80 tcp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
RU 62.204.41.87:80 62.204.41.87 tcp
US 8.8.8.8:53 87.41.204.62.in-addr.arpa udp
NL 8.238.21.126:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

MD5 ac81bf20dfbf47ddbbee1ae8fdba4ddb
SHA1 a55b2f5de6332b7db8a20598c1f9de021b565445
SHA256 1dd67bb2ab4789a32c57ca7248dad49cbe59d0d7849ed940335312a251a05a89
SHA512 de179afea6aa5048141ec21f38987972b5122134ce20ffab373d12604299548d08e14742fae38d58dc80a87f417d31d7dd4c737eef701953c0f6a62f8e00b474

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8944.exe

MD5 ac81bf20dfbf47ddbbee1ae8fdba4ddb
SHA1 a55b2f5de6332b7db8a20598c1f9de021b565445
SHA256 1dd67bb2ab4789a32c57ca7248dad49cbe59d0d7849ed940335312a251a05a89
SHA512 de179afea6aa5048141ec21f38987972b5122134ce20ffab373d12604299548d08e14742fae38d58dc80a87f417d31d7dd4c737eef701953c0f6a62f8e00b474

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

MD5 e3c1e59fde4661361fa2d8ff2eef29dc
SHA1 b3d747fd7c94260183d6ea1d559550121ee503a2
SHA256 248ad74f440401778657006912c9ef05bd64e82a09e93f117daf5a43ef49dfd1
SHA512 e7db7e67245ada384f33f41d86610ff0b63f0bb44f36fa006c431dbd46118671e08e1032286f664f053af9514609654f57563f449b8bd652b2aa93ad45c2831d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will4062.exe

MD5 e3c1e59fde4661361fa2d8ff2eef29dc
SHA1 b3d747fd7c94260183d6ea1d559550121ee503a2
SHA256 248ad74f440401778657006912c9ef05bd64e82a09e93f117daf5a43ef49dfd1
SHA512 e7db7e67245ada384f33f41d86610ff0b63f0bb44f36fa006c431dbd46118671e08e1032286f664f053af9514609654f57563f449b8bd652b2aa93ad45c2831d

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

MD5 f9b78101ecfa74cbaa75ea24460070be
SHA1 eb618fa52ccbdf2b07de5c1895372d26b8a89dce
SHA256 211fc761231cf8a90eebee85b6c0974a2ff16eed28064a19d6583f28b9a2cd2e
SHA512 43e878b92cd27a0a4510eaf513aa2b8b3f56b65d5f84f4a21cc652fc8a560ce64ddb921fb0c0ea99841c0d4c78e802905e95efccddcafd738709c8ccc37890df

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will5034.exe

MD5 f9b78101ecfa74cbaa75ea24460070be
SHA1 eb618fa52ccbdf2b07de5c1895372d26b8a89dce
SHA256 211fc761231cf8a90eebee85b6c0974a2ff16eed28064a19d6583f28b9a2cd2e
SHA512 43e878b92cd27a0a4510eaf513aa2b8b3f56b65d5f84f4a21cc652fc8a560ce64ddb921fb0c0ea99841c0d4c78e802905e95efccddcafd738709c8ccc37890df

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7469Yi.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2500-161-0x0000000000D00000-0x0000000000D0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

MD5 acc6c04fd13b2933acef78de8d47e434
SHA1 0d674bb3f5f19db69ab636d3e5d8ec9224a31843
SHA256 bd3321ff2c37c3e3610350fdd59dc56ea957c022c4664e57b42a197801d74590
SHA512 0312d87d241246813c7e8cfdbf1c606325e19364a73978226461be414ff411fee44892ff65a3cb8e0c74444bd96b475936dcf588de2c83ebd63248520e6e10e3

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8020nO.exe

MD5 acc6c04fd13b2933acef78de8d47e434
SHA1 0d674bb3f5f19db69ab636d3e5d8ec9224a31843
SHA256 bd3321ff2c37c3e3610350fdd59dc56ea957c022c4664e57b42a197801d74590
SHA512 0312d87d241246813c7e8cfdbf1c606325e19364a73978226461be414ff411fee44892ff65a3cb8e0c74444bd96b475936dcf588de2c83ebd63248520e6e10e3

memory/4348-167-0x0000000007270000-0x0000000007814000-memory.dmp

memory/4348-168-0x0000000002C60000-0x0000000002C8D000-memory.dmp

memory/4348-169-0x0000000007260000-0x0000000007270000-memory.dmp

memory/4348-170-0x0000000007260000-0x0000000007270000-memory.dmp

memory/4348-171-0x0000000007260000-0x0000000007270000-memory.dmp

memory/4348-172-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-173-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-175-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-177-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-179-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-181-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-183-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-185-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-187-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-189-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-191-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-193-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-195-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-197-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-199-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/4348-200-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4348-202-0x0000000007260000-0x0000000007270000-memory.dmp

memory/4348-204-0x0000000007260000-0x0000000007270000-memory.dmp

memory/4348-205-0x0000000007260000-0x0000000007270000-memory.dmp

memory/4348-203-0x0000000000400000-0x0000000002B0C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

MD5 2e5ec1801c4e9afcba6f9b043c07df6e
SHA1 1346e3db84fdeb3769421ae677e6088f13a6ee6b
SHA256 5f5ed7df6a2f3c8a67997475117c7a4a812b8ed993f37810eaa637315284c7cd
SHA512 0dcf71978ca4acb4247c697b439924f917b720ed4ebcd02c6ab2f1b033ae4523aad355319c67c8f9412f1788be73cd089cb6547511f446de882f1bc33513dce7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py79oo52.exe

MD5 2e5ec1801c4e9afcba6f9b043c07df6e
SHA1 1346e3db84fdeb3769421ae677e6088f13a6ee6b
SHA256 5f5ed7df6a2f3c8a67997475117c7a4a812b8ed993f37810eaa637315284c7cd
SHA512 0dcf71978ca4acb4247c697b439924f917b720ed4ebcd02c6ab2f1b033ae4523aad355319c67c8f9412f1788be73cd089cb6547511f446de882f1bc33513dce7

memory/2484-210-0x0000000004760000-0x00000000047AB000-memory.dmp

memory/2484-211-0x0000000007210000-0x0000000007220000-memory.dmp

memory/2484-212-0x0000000007210000-0x0000000007220000-memory.dmp

memory/2484-213-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-214-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-216-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-218-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-220-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-222-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-224-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-226-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-228-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-230-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-232-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-236-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-234-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-238-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-240-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-246-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-244-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-242-0x00000000070D0000-0x000000000710E000-memory.dmp

memory/2484-393-0x0000000007210000-0x0000000007220000-memory.dmp

memory/2484-1120-0x00000000077D0000-0x0000000007DE8000-memory.dmp

memory/2484-1121-0x0000000007DF0000-0x0000000007EFA000-memory.dmp

memory/2484-1122-0x0000000007F00000-0x0000000007F12000-memory.dmp

memory/2484-1124-0x0000000007F20000-0x0000000007F5C000-memory.dmp

memory/2484-1123-0x0000000007210000-0x0000000007220000-memory.dmp

memory/2484-1126-0x0000000007210000-0x0000000007220000-memory.dmp

memory/2484-1127-0x0000000007210000-0x0000000007220000-memory.dmp

memory/2484-1128-0x0000000008210000-0x0000000008276000-memory.dmp

memory/2484-1129-0x0000000007210000-0x0000000007220000-memory.dmp

memory/2484-1130-0x00000000088D0000-0x0000000008962000-memory.dmp

memory/2484-1131-0x00000000089D0000-0x0000000008B92000-memory.dmp

memory/2484-1132-0x0000000008BB0000-0x00000000090DC000-memory.dmp

memory/2484-1133-0x0000000009350000-0x00000000093C6000-memory.dmp

memory/2484-1134-0x00000000093E0000-0x0000000009430000-memory.dmp

memory/2484-1135-0x0000000007210000-0x0000000007220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3105Pe.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

memory/2168-1141-0x0000000000850000-0x0000000000882000-memory.dmp

memory/2168-1142-0x0000000005420000-0x0000000005430000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry93gP66.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5