Malware Analysis Report

2024-11-13 17:11

Sample ID 230321-tweaxadh8x
Target 052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5
SHA256 052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5
Tags
amadey aurora redline gena vint discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5

Threat Level: Known bad

The file 052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5 was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline gena vint discovery evasion infostealer persistence spyware stealer trojan

RedLine payload

Modifies Windows Defender Real-time Protection settings

RedLine

Amadey

Aurora

Downloads MZ/PE file

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Windows security modification

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-21 16:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-21 16:24

Reported

2023-03-21 16:26

Platform

win10-20230220-en

Max time kernel

109s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w56Lx96.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xijvZ95.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4616 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe
PID 4616 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe
PID 4616 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe
PID 4960 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe
PID 4960 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe
PID 4960 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe
PID 2068 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe
PID 2068 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe
PID 2068 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe
PID 1776 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe
PID 1776 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe
PID 1776 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe
PID 1776 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe
PID 1776 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe
PID 2068 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w56Lx96.exe
PID 2068 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w56Lx96.exe
PID 2068 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w56Lx96.exe
PID 4960 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xijvZ95.exe
PID 4960 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xijvZ95.exe
PID 4960 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xijvZ95.exe
PID 4616 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe
PID 4616 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe
PID 4616 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe
PID 4496 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 4496 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 4496 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 5108 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 5108 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 5108 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 5108 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 4276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 4276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 4276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4936 wrote to memory of 504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5108 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
PID 5108 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
PID 5108 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
PID 1364 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1364 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1364 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1364 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1364 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1364 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2436 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2436 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1364 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1364 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe

"C:\Users\Admin\AppData\Local\Temp\052ae1bd1c26ed2ffe512cf28d85a79c64b599d7d40051593c4987192f2de3f5.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w56Lx96.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w56Lx96.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xijvZ95.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xijvZ95.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Network

Country Destination Domain Proto
DE 193.233.20.30:4125 tcp
US 8.8.8.8:53 30.20.233.193.in-addr.arpa udp
DE 193.233.20.30:4125 tcp
US 20.189.173.15:443 tcp
US 93.184.221.240:80 tcp
RU 62.204.41.87:80 62.204.41.87 tcp
NL 185.246.221.126:80 185.246.221.126 tcp
US 8.8.8.8:53 87.41.204.62.in-addr.arpa udp
US 8.8.8.8:53 126.221.246.185.in-addr.arpa udp
US 8.8.8.8:53 62.13.109.52.in-addr.arpa udp
NL 212.87.204.93:8081 tcp
US 8.8.8.8:53 93.204.87.212.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe

MD5 327ab6351fc3d00deb8bb4ba9fd67ed9
SHA1 8b61f7f2974ff2e32b00b9996090b14be256484f
SHA256 37f5cc339dde6f0fc752d4138ad980209e8cd6d5dd7b66b0d9431d122718844b
SHA512 656275839f70fed56d36b95ed6f171e46b63f985e94e1be4912ee2d23efdd7b0039eab249fa468141464d293ed3abfa44b851eb2e0802457846e49f163361506

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2319.exe

MD5 327ab6351fc3d00deb8bb4ba9fd67ed9
SHA1 8b61f7f2974ff2e32b00b9996090b14be256484f
SHA256 37f5cc339dde6f0fc752d4138ad980209e8cd6d5dd7b66b0d9431d122718844b
SHA512 656275839f70fed56d36b95ed6f171e46b63f985e94e1be4912ee2d23efdd7b0039eab249fa468141464d293ed3abfa44b851eb2e0802457846e49f163361506

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe

MD5 3620898308cf4f737075ea711487a739
SHA1 032ec92ac49525508584be63ea2618d988cfcac9
SHA256 09c8c0136a8d43658bc186264e05c9433bf20115d56883e921c069f9774d8995
SHA512 ad4a4ac76ba7ce2058198cd53c3044eab870c0e585bf8f3f4d6af11cd23637c9ca0eca9a0e9e078f0116840f9f1103fd9390ebe1c35fc2e7c8fc57ac0b53641b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2942.exe

MD5 3620898308cf4f737075ea711487a739
SHA1 032ec92ac49525508584be63ea2618d988cfcac9
SHA256 09c8c0136a8d43658bc186264e05c9433bf20115d56883e921c069f9774d8995
SHA512 ad4a4ac76ba7ce2058198cd53c3044eab870c0e585bf8f3f4d6af11cd23637c9ca0eca9a0e9e078f0116840f9f1103fd9390ebe1c35fc2e7c8fc57ac0b53641b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe

MD5 67f225ddb0b29d69f5cc0ebcec5e1bfb
SHA1 9037d972488c9e3b0a362ecadf6d48616ddcd8bf
SHA256 a3672c58cc575bd8e436cce4fb194232d7db68948006dd793b44fa108c78acd9
SHA512 bdf061a6f0f7f3d5873d220ee945b0506651e2911c3396156d20af8a55c55560befa978dbd949c19d4f4541c9e300723c02f45ecce830950e4b9473aeb25357a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8205.exe

MD5 67f225ddb0b29d69f5cc0ebcec5e1bfb
SHA1 9037d972488c9e3b0a362ecadf6d48616ddcd8bf
SHA256 a3672c58cc575bd8e436cce4fb194232d7db68948006dd793b44fa108c78acd9
SHA512 bdf061a6f0f7f3d5873d220ee945b0506651e2911c3396156d20af8a55c55560befa978dbd949c19d4f4541c9e300723c02f45ecce830950e4b9473aeb25357a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7564.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2416-144-0x0000000000D90000-0x0000000000D9A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe

MD5 8258903114ea00ae5eae941043a89668
SHA1 f3cc7fe565fbe658b8be0f8e611b4e16f5fea2a4
SHA256 c977d1d26754e201c0141d2e6bb4b8d9825a521a0eba9e2bd96a0f90bba2bd05
SHA512 6a3b21032428793b9a98820617fd18e218f9e18227c56fad647cfc457138292b203bbc4b21ae5b0a7e1cff9c834e293a8b2cb92079c3de623e9e38b744fd636e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5583bu.exe

MD5 8258903114ea00ae5eae941043a89668
SHA1 f3cc7fe565fbe658b8be0f8e611b4e16f5fea2a4
SHA256 c977d1d26754e201c0141d2e6bb4b8d9825a521a0eba9e2bd96a0f90bba2bd05
SHA512 6a3b21032428793b9a98820617fd18e218f9e18227c56fad647cfc457138292b203bbc4b21ae5b0a7e1cff9c834e293a8b2cb92079c3de623e9e38b744fd636e

memory/2264-150-0x00000000001D0000-0x00000000001FD000-memory.dmp

memory/2264-151-0x0000000002660000-0x000000000267A000-memory.dmp

memory/2264-152-0x0000000004DB0000-0x00000000052AE000-memory.dmp

memory/2264-153-0x0000000004C40000-0x0000000004C58000-memory.dmp

memory/2264-154-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-155-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-157-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-159-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-161-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-163-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-165-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-167-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-169-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-171-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-173-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-175-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-177-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-179-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-181-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/2264-182-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

memory/2264-183-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

memory/2264-184-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

memory/2264-185-0x0000000000400000-0x000000000071D000-memory.dmp

memory/2264-187-0x0000000000400000-0x000000000071D000-memory.dmp

memory/2264-188-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w56Lx96.exe

MD5 925684aadfa03649ea5be99c0f86abc7
SHA1 4f7d8c99c6c10895a95a7fa559071d4721d237a3
SHA256 86c481a5ab1083f1d5e5be8e0d6a35536fcef4202a64ae59841ac989acf1eabf
SHA512 d645353778a15a14683c7a61234203edc7d35fdb460d14e775a0e76a44cb7f3cb10fae2ca56530d8277ed7c7f57c1740b42e6230850ba09423136eab40d6b1d4

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w56Lx96.exe

MD5 925684aadfa03649ea5be99c0f86abc7
SHA1 4f7d8c99c6c10895a95a7fa559071d4721d237a3
SHA256 86c481a5ab1083f1d5e5be8e0d6a35536fcef4202a64ae59841ac989acf1eabf
SHA512 d645353778a15a14683c7a61234203edc7d35fdb460d14e775a0e76a44cb7f3cb10fae2ca56530d8277ed7c7f57c1740b42e6230850ba09423136eab40d6b1d4

memory/1520-193-0x00000000023D0000-0x0000000002416000-memory.dmp

memory/1520-194-0x0000000004CA0000-0x0000000004CE4000-memory.dmp

memory/1520-195-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-196-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-198-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-200-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-204-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-202-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-206-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-208-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-210-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-212-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-214-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-216-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-218-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-220-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-222-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-224-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-226-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-228-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

memory/1520-232-0x0000000000850000-0x000000000089B000-memory.dmp

memory/1520-236-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1520-233-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1520-237-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1520-1105-0x0000000005380000-0x0000000005986000-memory.dmp

memory/1520-1106-0x0000000005990000-0x0000000005A9A000-memory.dmp

memory/1520-1107-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

memory/1520-1108-0x0000000004E00000-0x0000000004E3E000-memory.dmp

memory/1520-1109-0x0000000005BA0000-0x0000000005BEB000-memory.dmp

memory/1520-1110-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1520-1111-0x0000000005D10000-0x0000000005D76000-memory.dmp

memory/1520-1113-0x00000000063D0000-0x0000000006462000-memory.dmp

memory/1520-1114-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1520-1115-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1520-1116-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1520-1117-0x00000000064C0000-0x0000000006682000-memory.dmp

memory/1520-1118-0x0000000006690000-0x0000000006BBC000-memory.dmp

memory/1520-1119-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/1520-1120-0x000000000A4C0000-0x000000000A536000-memory.dmp

memory/1520-1121-0x0000000002700000-0x0000000002750000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xijvZ95.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xijvZ95.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

memory/5032-1127-0x0000000000930000-0x0000000000962000-memory.dmp

memory/5032-1128-0x0000000005370000-0x00000000053BB000-memory.dmp

memory/5032-1129-0x0000000005250000-0x0000000005260000-memory.dmp

memory/5032-1130-0x0000000005250000-0x0000000005260000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y29RF84.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

MD5 a3eb5f22bc8e7f4060e3ff18c4ac70b9
SHA1 8480869a34c9723063dba9cc8279cf4e7c2bc4cd
SHA256 0582ca04b28149ce2fd9732dff5e9894a60454eeb03166ddde677c9224c1f9f6
SHA512 3e88f72ace3e80a18f2986b43d90b9bf33e131ec77ce34c1462605784332e4676af5e8414ee75146bd14ef8a2e60a13ecf097c189206cd010f748e171903c5f0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5