Analysis Overview
SHA256
a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135
Threat Level: Known bad
The file a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135 was found to be: Known bad.
Malicious Activity Summary
Amadey
RedLine payload
Modifies Windows Defender Real-time Protection settings
Aurora
RedLine
Downloads MZ/PE file
Windows security modification
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-03-21 17:25
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-03-21 17:25
Reported
2023-03-21 17:28
Platform
win10-20230220-en
Max time kernel
127s
Max time network
102s
Command Line
Signatures
Amadey
Aurora
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe | N/A |
Checks installed software on the system
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe
"C:\Users\Admin\AppData\Local\Temp\a04cf3e0bd099f7578ee83009af908a5b34efd381e640e90a9a9820eedefd135.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"
C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Network
| Country | Destination | Domain | Proto |
| DE | 193.233.20.30:4125 | tcp | |
| US | 8.8.8.8:53 | 30.20.233.193.in-addr.arpa | udp |
| NL | 52.178.17.3:443 | tcp | |
| DE | 193.233.20.30:4125 | tcp | |
| RU | 62.204.41.87:80 | 62.204.41.87 | tcp |
| NL | 185.246.221.126:80 | 185.246.221.126 | tcp |
| US | 8.8.8.8:53 | 203.151.224.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 87.41.204.62.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.221.246.185.in-addr.arpa | udp |
| NL | 212.87.204.93:8081 | tcp | |
| US | 8.8.8.8:53 | 93.204.87.212.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe
| MD5 | c3a94da5012675ecb0a94c75f9e1d2dc |
| SHA1 | 4f32f2a720e8d8ca1761e6e2cf4243fd7b174924 |
| SHA256 | e3f897673d4f66b15efe565365191633b8f9fa9e5615a999ae12b9d75c8c5cd3 |
| SHA512 | 09a62dc92d172f3f2f1351f03d14dbe5c37ed170036403a71445858cf9f77a2fb6a755afaff2b472d9de7622cf2b5592efc8005f1059ca86ddcda5fbb080b86e |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6943.exe
| MD5 | c3a94da5012675ecb0a94c75f9e1d2dc |
| SHA1 | 4f32f2a720e8d8ca1761e6e2cf4243fd7b174924 |
| SHA256 | e3f897673d4f66b15efe565365191633b8f9fa9e5615a999ae12b9d75c8c5cd3 |
| SHA512 | 09a62dc92d172f3f2f1351f03d14dbe5c37ed170036403a71445858cf9f77a2fb6a755afaff2b472d9de7622cf2b5592efc8005f1059ca86ddcda5fbb080b86e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe
| MD5 | 5289565cbe50dc3699106c5a8aaff421 |
| SHA1 | b1b5a439f946d6c6847e67bd9dd60bda50ab10d4 |
| SHA256 | 24f130daca549734f8d500d185f58ab78ae8af4107d81198c37a9b9bb0942809 |
| SHA512 | faff4fa659f4fac50b4e2790d87f34db6e0ea73b372c68525f3c9b3011516131ecc36072c59f128662714e2ab8bebee6e509e075ac7c6b5a7680284bc9e4cd6e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9786.exe
| MD5 | 5289565cbe50dc3699106c5a8aaff421 |
| SHA1 | b1b5a439f946d6c6847e67bd9dd60bda50ab10d4 |
| SHA256 | 24f130daca549734f8d500d185f58ab78ae8af4107d81198c37a9b9bb0942809 |
| SHA512 | faff4fa659f4fac50b4e2790d87f34db6e0ea73b372c68525f3c9b3011516131ecc36072c59f128662714e2ab8bebee6e509e075ac7c6b5a7680284bc9e4cd6e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe
| MD5 | dedfa9c5ba99d91699a7172c0a13dc61 |
| SHA1 | 2ec733d0bd219643819dcde7a45a63a90594db85 |
| SHA256 | 9a034e0dbeba7eee8bc6fc6387cb8927ae5e76e955a48ad73b605c6b3d33b531 |
| SHA512 | 0b59be47b4e5f5629a701a7a0d1e13e358c71d7e6f2ef120a20df9a4f6eec7421c83a9c4b6870dbea3bb8511f925c352e2fe80331608756a4fd5eb52f1dd22f0 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3971.exe
| MD5 | dedfa9c5ba99d91699a7172c0a13dc61 |
| SHA1 | 2ec733d0bd219643819dcde7a45a63a90594db85 |
| SHA256 | 9a034e0dbeba7eee8bc6fc6387cb8927ae5e76e955a48ad73b605c6b3d33b531 |
| SHA512 | 0b59be47b4e5f5629a701a7a0d1e13e358c71d7e6f2ef120a20df9a4f6eec7421c83a9c4b6870dbea3bb8511f925c352e2fe80331608756a4fd5eb52f1dd22f0 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3777.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
memory/3132-149-0x00000000001E0000-0x00000000001EA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe
| MD5 | a1bcfde2ae54e4a275cd2b3202f94606 |
| SHA1 | 700add0eca2d00aea3dc80b6e7149f1a8263ec17 |
| SHA256 | 400ab3b87905c4e93c975b49341a66a8fdac4d81b9aeb91bf3e5611cca641cde |
| SHA512 | 73e83859ae6f6a16ff11dc88d7db90c08e8f5bc817989860dfd1581934cfc833b16dcbfe2c8b86638745314602b0cd948dc371f2f3d04e21dccf46552f7d2c20 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6839AP.exe
| MD5 | a1bcfde2ae54e4a275cd2b3202f94606 |
| SHA1 | 700add0eca2d00aea3dc80b6e7149f1a8263ec17 |
| SHA256 | 400ab3b87905c4e93c975b49341a66a8fdac4d81b9aeb91bf3e5611cca641cde |
| SHA512 | 73e83859ae6f6a16ff11dc88d7db90c08e8f5bc817989860dfd1581934cfc833b16dcbfe2c8b86638745314602b0cd948dc371f2f3d04e21dccf46552f7d2c20 |
memory/5076-155-0x0000000002220000-0x000000000223A000-memory.dmp
memory/5076-156-0x0000000004DD0000-0x00000000052CE000-memory.dmp
memory/5076-157-0x0000000002500000-0x0000000002518000-memory.dmp
memory/5076-158-0x00000000001D0000-0x00000000001FD000-memory.dmp
memory/5076-159-0x0000000002A40000-0x0000000002A50000-memory.dmp
memory/5076-160-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-162-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-161-0x0000000002A40000-0x0000000002A50000-memory.dmp
memory/5076-163-0x0000000002A40000-0x0000000002A50000-memory.dmp
memory/5076-165-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-167-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-169-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-171-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-173-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-177-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-175-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-179-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-181-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-183-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-185-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-187-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-189-0x0000000002500000-0x0000000002512000-memory.dmp
memory/5076-190-0x0000000000400000-0x0000000000726000-memory.dmp
memory/5076-191-0x0000000002A40000-0x0000000002A50000-memory.dmp
memory/5076-193-0x0000000002A40000-0x0000000002A50000-memory.dmp
memory/5076-192-0x0000000002A40000-0x0000000002A50000-memory.dmp
memory/5076-195-0x0000000000400000-0x0000000000726000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe
| MD5 | c64c2d169e9fcc8783b3ca8ca7bf177d |
| SHA1 | bf76c903b8e0161d8c80c33067cb022b5a461bc6 |
| SHA256 | b0e63d14b1dc393603953433e9af8996f99e3eed4940de5d5bd9688ebfcfa210 |
| SHA512 | 6c71c38369e7264b3242a78321f6aa10b3b98cdd79c119741d1f4794872894e58211a1725289e0fd7418b2b37b734d2854fb5dc3e76a00c2d5c98d3161ab3f3b |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58Jh57.exe
| MD5 | c64c2d169e9fcc8783b3ca8ca7bf177d |
| SHA1 | bf76c903b8e0161d8c80c33067cb022b5a461bc6 |
| SHA256 | b0e63d14b1dc393603953433e9af8996f99e3eed4940de5d5bd9688ebfcfa210 |
| SHA512 | 6c71c38369e7264b3242a78321f6aa10b3b98cdd79c119741d1f4794872894e58211a1725289e0fd7418b2b37b734d2854fb5dc3e76a00c2d5c98d3161ab3f3b |
memory/1432-200-0x0000000004C40000-0x0000000004C86000-memory.dmp
memory/1432-201-0x00000000051C0000-0x0000000005204000-memory.dmp
memory/1432-202-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-203-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-205-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-207-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-209-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-211-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-213-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-215-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-217-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-221-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-219-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-223-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-225-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-227-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-229-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-231-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-233-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-235-0x00000000051C0000-0x00000000051FE000-memory.dmp
memory/1432-402-0x0000000002250000-0x0000000002260000-memory.dmp
memory/1432-399-0x0000000000740000-0x000000000078B000-memory.dmp
memory/1432-403-0x0000000002250000-0x0000000002260000-memory.dmp
memory/1432-405-0x0000000002250000-0x0000000002260000-memory.dmp
memory/1432-1112-0x0000000005250000-0x0000000005856000-memory.dmp
memory/1432-1113-0x00000000058E0000-0x00000000059EA000-memory.dmp
memory/1432-1114-0x0000000005A20000-0x0000000005A32000-memory.dmp
memory/1432-1115-0x0000000005A40000-0x0000000005A7E000-memory.dmp
memory/1432-1116-0x0000000005B90000-0x0000000005BDB000-memory.dmp
memory/1432-1117-0x0000000002250000-0x0000000002260000-memory.dmp
memory/1432-1119-0x0000000005D20000-0x0000000005DB2000-memory.dmp
memory/1432-1120-0x0000000005DC0000-0x0000000005E26000-memory.dmp
memory/1432-1121-0x0000000006480000-0x00000000064F6000-memory.dmp
memory/1432-1122-0x0000000006530000-0x0000000006580000-memory.dmp
memory/1432-1123-0x00000000065A0000-0x0000000006762000-memory.dmp
memory/1432-1124-0x0000000006780000-0x0000000006CAC000-memory.dmp
memory/1432-1126-0x0000000002250000-0x0000000002260000-memory.dmp
memory/1432-1127-0x0000000002250000-0x0000000002260000-memory.dmp
memory/1432-1125-0x0000000002250000-0x0000000002260000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe
| MD5 | 3389637c0d072121bf1b127629736d37 |
| SHA1 | 300e915efdf2479bfd0d3699c0a6bc51260f9655 |
| SHA256 | 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153 |
| SHA512 | a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xoEDe62.exe
| MD5 | 3389637c0d072121bf1b127629736d37 |
| SHA1 | 300e915efdf2479bfd0d3699c0a6bc51260f9655 |
| SHA256 | 2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153 |
| SHA512 | a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4 |
memory/4872-1133-0x0000000000ED0000-0x0000000000F02000-memory.dmp
memory/4872-1134-0x0000000005910000-0x000000000595B000-memory.dmp
memory/4872-1135-0x0000000005B00000-0x0000000005B10000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91JW41.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
| MD5 | 95a12fa5756d0040e1c1284371ea17e4 |
| SHA1 | a9c9c457a87ecca994364b6b0a8bbe815c64197d |
| SHA256 | 805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562 |
| SHA512 | 1d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 94cbeec5d4343918fd0e48760e40539c |
| SHA1 | a049266c5c1131f692f306c8710d7e72586ae79d |
| SHA256 | 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279 |
| SHA512 | 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |