Malware Analysis Report

2024-11-13 17:11

Sample ID 230321-vzp29acb97
Target a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135
SHA256 a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135
Tags
amadey aurora redline gena vint discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135

Threat Level: Known bad

The file a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135 was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline gena vint discovery evasion infostealer persistence spyware stealer trojan

Amadey

RedLine payload

Modifies Windows Defender Real-time Protection settings

Aurora

RedLine

Downloads MZ/PE file

Windows security modification

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-21 17:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-21 17:25

Reported

2023-03-21 17:28

Platform

win10-20230220-en

Max time kernel

127s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe
PID 2072 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe
PID 2072 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe
PID 2296 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe
PID 2296 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe
PID 2296 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe
PID 2604 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe
PID 2604 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe
PID 2604 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe
PID 2640 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe
PID 2640 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe
PID 2640 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe
PID 2640 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe
PID 2640 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe
PID 2604 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe
PID 2604 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe
PID 2604 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe
PID 2296 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe
PID 2296 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe
PID 2296 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe
PID 2072 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe
PID 2072 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe
PID 2072 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe
PID 576 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 576 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 576 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 3992 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 3992 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 3992 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 3992 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 3992 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 3992 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4376 wrote to memory of 3400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4376 wrote to memory of 3400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4376 wrote to memory of 3400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4376 wrote to memory of 3076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 3076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 3076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4376 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4376 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4376 wrote to memory of 4380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 4380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 4380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4376 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3992 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
PID 3992 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
PID 3992 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
PID 988 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 988 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 988 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 988 wrote to memory of 68 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 988 wrote to memory of 68 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 988 wrote to memory of 68 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 68 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 68 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 68 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 988 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 988 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe

"C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Network

Country Destination Domain Proto
DE 193.233.20.30:4125 tcp
US 8.8.8.8:53 30.20.233.193.in-addr.arpa udp
NL 52.178.17.3:443 tcp
DE 193.233.20.30:4125 tcp
RU 62.204.41.87:80 62.204.41.87 tcp
NL 185.246.221.126:80 185.246.221.126 tcp
US 8.8.8.8:53 203.151.224.20.in-addr.arpa udp
US 8.8.8.8:53 87.41.204.62.in-addr.arpa udp
US 8.8.8.8:53 126.221.246.185.in-addr.arpa udp
NL 212.87.204.93:8081 tcp
US 8.8.8.8:53 93.204.87.212.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe

MD5 c3a94da5012675ecb0a94c75f9e1d2dc
SHA1 4f32f2a720e8d8ca1761e6e2cf4243fd7b174924
SHA256 e3f897673d4f66b15efe565365191633b8f9fa9e5615a999ae12b9d75c8c5cd3
SHA512 09a62dc92d172f3f2f1351f03d14dbe5c37ed170036403a71445858cf9f77a2fb6a755afaff2b472d9de7622cf2b5592efc8005f1059ca86ddcda5fbb080b86e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe

MD5 c3a94da5012675ecb0a94c75f9e1d2dc
SHA1 4f32f2a720e8d8ca1761e6e2cf4243fd7b174924
SHA256 e3f897673d4f66b15efe565365191633b8f9fa9e5615a999ae12b9d75c8c5cd3
SHA512 09a62dc92d172f3f2f1351f03d14dbe5c37ed170036403a71445858cf9f77a2fb6a755afaff2b472d9de7622cf2b5592efc8005f1059ca86ddcda5fbb080b86e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe

MD5 5289565cbe50dc3699106c5a8aaff421
SHA1 b1b5a439f946d6c6847e67bd9dd60bda50ab10d4
SHA256 24f130daca549734f8d500d185f58ab78ae8af4107d81198c37a9b9bb0942809
SHA512 faff4fa659f4fac50b4e2790d87f34db6e0ea73b372c68525f3c9b3011516131ecc36072c59f128662714e2ab8bebee6e509e075ac7c6b5a7680284bc9e4cd6e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe

MD5 5289565cbe50dc3699106c5a8aaff421
SHA1 b1b5a439f946d6c6847e67bd9dd60bda50ab10d4
SHA256 24f130daca549734f8d500d185f58ab78ae8af4107d81198c37a9b9bb0942809
SHA512 faff4fa659f4fac50b4e2790d87f34db6e0ea73b372c68525f3c9b3011516131ecc36072c59f128662714e2ab8bebee6e509e075ac7c6b5a7680284bc9e4cd6e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe

MD5 dedfa9c5ba99d91699a7172c0a13dc61
SHA1 2ec733d0bd219643819dcde7a45a63a90594db85
SHA256 9a034e0dbeba7eee8bc6fc6387cb8927ae5e76e955a48ad73b605c6b3d33b531
SHA512 0b59be47b4e5f5629a701a7a0d1e13e358c71d7e6f2ef120a20df9a4f6eec7421c83a9c4b6870dbea3bb8511f925c352e2fe80331608756a4fd5eb52f1dd22f0

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe

MD5 dedfa9c5ba99d91699a7172c0a13dc61
SHA1 2ec733d0bd219643819dcde7a45a63a90594db85
SHA256 9a034e0dbeba7eee8bc6fc6387cb8927ae5e76e955a48ad73b605c6b3d33b531
SHA512 0b59be47b4e5f5629a701a7a0d1e13e358c71d7e6f2ef120a20df9a4f6eec7421c83a9c4b6870dbea3bb8511f925c352e2fe80331608756a4fd5eb52f1dd22f0

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3132-149-0x00000000001E0000-0x00000000001EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe

MD5 a1bcfde2ae54e4a275cd2b3202f94606
SHA1 700add0eca2d00aea3dc80b6e7149f1a8263ec17
SHA256 400ab3b87905c4e93c975b49341a66a8fdac4d81b9aeb91bf3e5611cca641cde
SHA512 73e83859ae6f6a16ff11dc88d7db90c08e8f5bc817989860dfd1581934cfc833b16dcbfe2c8b86638745314602b0cd948dc371f2f3d04e21dccf46552f7d2c20

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe

MD5 a1bcfde2ae54e4a275cd2b3202f94606
SHA1 700add0eca2d00aea3dc80b6e7149f1a8263ec17
SHA256 400ab3b87905c4e93c975b49341a66a8fdac4d81b9aeb91bf3e5611cca641cde
SHA512 73e83859ae6f6a16ff11dc88d7db90c08e8f5bc817989860dfd1581934cfc833b16dcbfe2c8b86638745314602b0cd948dc371f2f3d04e21dccf46552f7d2c20

memory/5076-155-0x0000000002220000-0x000000000223A000-memory.dmp

memory/5076-156-0x0000000004DD0000-0x00000000052CE000-memory.dmp

memory/5076-157-0x0000000002500000-0x0000000002518000-memory.dmp

memory/5076-158-0x00000000001D0000-0x00000000001FD000-memory.dmp

memory/5076-159-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/5076-160-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-162-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-161-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/5076-163-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/5076-165-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-167-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-169-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-171-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-173-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-177-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-175-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-179-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-181-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-183-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-185-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-187-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-189-0x0000000002500000-0x0000000002512000-memory.dmp

memory/5076-190-0x0000000000400000-0x0000000000726000-memory.dmp

memory/5076-191-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/5076-193-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/5076-192-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/5076-195-0x0000000000400000-0x0000000000726000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe

MD5 c64c2d169e9fcc8783b3ca8ca7bf177d
SHA1 bf76c903b8e0161d8c80c33067cb022b5a461bc6
SHA256 b0e63d14b1dc393603953433e9af8996f99e3eed4940de5d5bd9688ebfcfa210
SHA512 6c71c38369e7264b3242a78321f6aa10b3b98cdd79c119741d1f4794872894e58211a1725289e0fd7418b2b37b734d2854fb5dc3e76a00c2d5c98d3161ab3f3b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe

MD5 c64c2d169e9fcc8783b3ca8ca7bf177d
SHA1 bf76c903b8e0161d8c80c33067cb022b5a461bc6
SHA256 b0e63d14b1dc393603953433e9af8996f99e3eed4940de5d5bd9688ebfcfa210
SHA512 6c71c38369e7264b3242a78321f6aa10b3b98cdd79c119741d1f4794872894e58211a1725289e0fd7418b2b37b734d2854fb5dc3e76a00c2d5c98d3161ab3f3b

memory/1432-200-0x0000000004C40000-0x0000000004C86000-memory.dmp

memory/1432-201-0x00000000051C0000-0x0000000005204000-memory.dmp

memory/1432-202-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-203-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-205-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-207-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-209-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-211-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-213-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-215-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-217-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-221-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-219-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-223-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-225-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-227-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-229-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-231-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-233-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-235-0x00000000051C0000-0x00000000051FE000-memory.dmp

memory/1432-402-0x0000000002250000-0x0000000002260000-memory.dmp

memory/1432-399-0x0000000000740000-0x000000000078B000-memory.dmp

memory/1432-403-0x0000000002250000-0x0000000002260000-memory.dmp

memory/1432-405-0x0000000002250000-0x0000000002260000-memory.dmp

memory/1432-1112-0x0000000005250000-0x0000000005856000-memory.dmp

memory/1432-1113-0x00000000058E0000-0x00000000059EA000-memory.dmp

memory/1432-1114-0x0000000005A20000-0x0000000005A32000-memory.dmp

memory/1432-1115-0x0000000005A40000-0x0000000005A7E000-memory.dmp

memory/1432-1116-0x0000000005B90000-0x0000000005BDB000-memory.dmp

memory/1432-1117-0x0000000002250000-0x0000000002260000-memory.dmp

memory/1432-1119-0x0000000005D20000-0x0000000005DB2000-memory.dmp

memory/1432-1120-0x0000000005DC0000-0x0000000005E26000-memory.dmp

memory/1432-1121-0x0000000006480000-0x00000000064F6000-memory.dmp

memory/1432-1122-0x0000000006530000-0x0000000006580000-memory.dmp

memory/1432-1123-0x00000000065A0000-0x0000000006762000-memory.dmp

memory/1432-1124-0x0000000006780000-0x0000000006CAC000-memory.dmp

memory/1432-1126-0x0000000002250000-0x0000000002260000-memory.dmp

memory/1432-1127-0x0000000002250000-0x0000000002260000-memory.dmp

memory/1432-1125-0x0000000002250000-0x0000000002260000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe

MD5 3389637c0d072121bf1b127629736d37
SHA1 300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA256 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512 a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

memory/4872-1133-0x0000000000ED0000-0x0000000000F02000-memory.dmp

memory/4872-1134-0x0000000005910000-0x000000000595B000-memory.dmp

memory/4872-1135-0x0000000005B00000-0x0000000005B10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe

MD5 a8a106555b9e1f92569d623c66ee8c12
SHA1 a5080c26b5f5911c10d80654c84239a226fc75d1
SHA256 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA512 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26

C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

MD5 95a12fa5756d0040e1c1284371ea17e4
SHA1 a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256 805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA512 1d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5