Analysis Overview
SHA256
8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67
Threat Level: Known bad
The file installer.exe was found to be: Known bad.
Malicious Activity Summary
Detect rhadamanthys stealer shellcode
Rhadamanthys
RedLine payload
Amadey
Aurora
RedLine
Modifies Windows Defender Real-time Protection settings
Looks for VirtualBox Guest Additions in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Enumerates VirtualBox registry keys
Downloads MZ/PE file
Looks for VMWare Tools registry key
Loads dropped DLL
Windows security modification
Executes dropped EXE
Checks BIOS information in registry
Checks computer location settings
Reads user/profile data of web browsers
Adds Run key to start application
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks system information in the registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks for VirtualBox DLLs, possible anti-VM trick
Program crash
Enumerates physical storage devices
Checks SCSI registry key(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-03-22 01:31
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-03-22 01:31
Reported
2023-03-22 01:33
Platform
win7-20230220-en
Max time kernel
112s
Max time network
108s
Command Line
Signatures
Amadey
Aurora
Detect rhadamanthys stealer shellcode
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Rhadamanthys
Enumerates VirtualBox registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Looks for VirtualBox Guest Additions in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Downloads MZ/PE file
Looks for VMWare Tools registry key
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe | N/A |
Checks installed software on the system
Checks system information in the registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Enumerates physical storage devices
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\installer.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
"C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"
C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe
"C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe"
C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Windows\system32\taskeng.exe
taskeng.exe {30FA4791-3EC1-4317-AD47-58F47A31E304} S-1-5-21-3499517378-2376672570-1134980332-1000:MLXLFKOI\Admin:Interactive:[1]
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Network
| Country | Destination | Domain | Proto |
| DE | 193.233.20.31:4125 | tcp | |
| DE | 193.233.20.31:4125 | tcp | |
| RU | 62.204.41.87:80 | 62.204.41.87 | tcp |
| US | 8.8.8.8:53 | ebfertility.com | udp |
| US | 89.190.157.61:80 | ebfertility.com | tcp |
| NL | 185.246.221.126:80 | 185.246.221.126 | tcp |
| ES | 18.100.155.25:80 | 18.100.155.25 | tcp |
| NL | 212.87.204.93:8081 | tcp | |
| US | 8.8.8.8:53 | ckuauohuihgms1p7u00gflazwnzxizd.aeu8hjm3ltchpyqwsnx9enrqaud | udp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
| MD5 | 9ce7789a117192ac2e425ef84cb828a0 |
| SHA1 | 98025f48e38fa8b75be6b3e3958b876fa4421dd6 |
| SHA256 | 7c64e59efdf784658c7b75c7e88e972ed2c5b5e59ceb7665bd891a32e2f9c6b2 |
| SHA512 | 62c8633c897b9ca56e8df968ec7b79c39dc8da92536212881ae9979db36f4303d0c3e4913aaf509b8f5baf56c1b9899f9ebab6897ae1ae8dd9ad57efdc947b1e |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
| MD5 | 9ce7789a117192ac2e425ef84cb828a0 |
| SHA1 | 98025f48e38fa8b75be6b3e3958b876fa4421dd6 |
| SHA256 | 7c64e59efdf784658c7b75c7e88e972ed2c5b5e59ceb7665bd891a32e2f9c6b2 |
| SHA512 | 62c8633c897b9ca56e8df968ec7b79c39dc8da92536212881ae9979db36f4303d0c3e4913aaf509b8f5baf56c1b9899f9ebab6897ae1ae8dd9ad57efdc947b1e |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
| MD5 | 9ce7789a117192ac2e425ef84cb828a0 |
| SHA1 | 98025f48e38fa8b75be6b3e3958b876fa4421dd6 |
| SHA256 | 7c64e59efdf784658c7b75c7e88e972ed2c5b5e59ceb7665bd891a32e2f9c6b2 |
| SHA512 | 62c8633c897b9ca56e8df968ec7b79c39dc8da92536212881ae9979db36f4303d0c3e4913aaf509b8f5baf56c1b9899f9ebab6897ae1ae8dd9ad57efdc947b1e |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
| MD5 | 9ce7789a117192ac2e425ef84cb828a0 |
| SHA1 | 98025f48e38fa8b75be6b3e3958b876fa4421dd6 |
| SHA256 | 7c64e59efdf784658c7b75c7e88e972ed2c5b5e59ceb7665bd891a32e2f9c6b2 |
| SHA512 | 62c8633c897b9ca56e8df968ec7b79c39dc8da92536212881ae9979db36f4303d0c3e4913aaf509b8f5baf56c1b9899f9ebab6897ae1ae8dd9ad57efdc947b1e |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
| MD5 | dfe5b6397edff0edf98fe4f954108364 |
| SHA1 | 4760065114b58c54b580a51f28236fe04400b7a0 |
| SHA256 | e7f240e2fcce11440b0cab062a1f5240da60a9cf0ff1c0a4e0ee9036de8ef924 |
| SHA512 | cabe73e75191ca1d472d43799c2b6b75002110f554f45752ba0089e757a7d0e900d3e5e51c907281bb90a2387727a5a96466ffad1cc90a35fd2a7c38f9bc947a |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
| MD5 | dfe5b6397edff0edf98fe4f954108364 |
| SHA1 | 4760065114b58c54b580a51f28236fe04400b7a0 |
| SHA256 | e7f240e2fcce11440b0cab062a1f5240da60a9cf0ff1c0a4e0ee9036de8ef924 |
| SHA512 | cabe73e75191ca1d472d43799c2b6b75002110f554f45752ba0089e757a7d0e900d3e5e51c907281bb90a2387727a5a96466ffad1cc90a35fd2a7c38f9bc947a |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
| MD5 | dfe5b6397edff0edf98fe4f954108364 |
| SHA1 | 4760065114b58c54b580a51f28236fe04400b7a0 |
| SHA256 | e7f240e2fcce11440b0cab062a1f5240da60a9cf0ff1c0a4e0ee9036de8ef924 |
| SHA512 | cabe73e75191ca1d472d43799c2b6b75002110f554f45752ba0089e757a7d0e900d3e5e51c907281bb90a2387727a5a96466ffad1cc90a35fd2a7c38f9bc947a |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
| MD5 | dfe5b6397edff0edf98fe4f954108364 |
| SHA1 | 4760065114b58c54b580a51f28236fe04400b7a0 |
| SHA256 | e7f240e2fcce11440b0cab062a1f5240da60a9cf0ff1c0a4e0ee9036de8ef924 |
| SHA512 | cabe73e75191ca1d472d43799c2b6b75002110f554f45752ba0089e757a7d0e900d3e5e51c907281bb90a2387727a5a96466ffad1cc90a35fd2a7c38f9bc947a |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
| MD5 | 6edabc7c6dc45f0db4be0955370efa02 |
| SHA1 | 7517049d80a48e14d99fce84b7fd91845ee27193 |
| SHA256 | b671bb8cc6476336b30090595a36b28e54f1ccf4c935227288db74ee000ca468 |
| SHA512 | 5d0c1248670d4c8cf923a1d2f29b3274ea5ed15d68c91c4b6b86f09c64221de1cbc85659ef70d9237b2114544524e734665b87650e14bbc2bd9a119c33075b5a |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
| MD5 | 6edabc7c6dc45f0db4be0955370efa02 |
| SHA1 | 7517049d80a48e14d99fce84b7fd91845ee27193 |
| SHA256 | b671bb8cc6476336b30090595a36b28e54f1ccf4c935227288db74ee000ca468 |
| SHA512 | 5d0c1248670d4c8cf923a1d2f29b3274ea5ed15d68c91c4b6b86f09c64221de1cbc85659ef70d9237b2114544524e734665b87650e14bbc2bd9a119c33075b5a |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
| MD5 | 6edabc7c6dc45f0db4be0955370efa02 |
| SHA1 | 7517049d80a48e14d99fce84b7fd91845ee27193 |
| SHA256 | b671bb8cc6476336b30090595a36b28e54f1ccf4c935227288db74ee000ca468 |
| SHA512 | 5d0c1248670d4c8cf923a1d2f29b3274ea5ed15d68c91c4b6b86f09c64221de1cbc85659ef70d9237b2114544524e734665b87650e14bbc2bd9a119c33075b5a |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
| MD5 | 6edabc7c6dc45f0db4be0955370efa02 |
| SHA1 | 7517049d80a48e14d99fce84b7fd91845ee27193 |
| SHA256 | b671bb8cc6476336b30090595a36b28e54f1ccf4c935227288db74ee000ca468 |
| SHA512 | 5d0c1248670d4c8cf923a1d2f29b3274ea5ed15d68c91c4b6b86f09c64221de1cbc85659ef70d9237b2114544524e734665b87650e14bbc2bd9a119c33075b5a |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
memory/1296-92-0x0000000000E40000-0x0000000000E4A000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
| MD5 | d3c4ba31e59c3efcec11d7f4344b6d8d |
| SHA1 | afb9037344b4a2c7f0a9e933bca524edd426889a |
| SHA256 | d76bed24c971d057a04c2b9b0233a786283b74e3142f8a8f6065976a6d538ff2 |
| SHA512 | fc3c94be8c7d15265ccebbb6292437576c3813e90fe9743e7c266fd773f346d18073c06c1ff896fcc0a68121106e78a69ec3ae72b7e69aad16bb03ce7ca430e4 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
| MD5 | d3c4ba31e59c3efcec11d7f4344b6d8d |
| SHA1 | afb9037344b4a2c7f0a9e933bca524edd426889a |
| SHA256 | d76bed24c971d057a04c2b9b0233a786283b74e3142f8a8f6065976a6d538ff2 |
| SHA512 | fc3c94be8c7d15265ccebbb6292437576c3813e90fe9743e7c266fd773f346d18073c06c1ff896fcc0a68121106e78a69ec3ae72b7e69aad16bb03ce7ca430e4 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
| MD5 | d3c4ba31e59c3efcec11d7f4344b6d8d |
| SHA1 | afb9037344b4a2c7f0a9e933bca524edd426889a |
| SHA256 | d76bed24c971d057a04c2b9b0233a786283b74e3142f8a8f6065976a6d538ff2 |
| SHA512 | fc3c94be8c7d15265ccebbb6292437576c3813e90fe9743e7c266fd773f346d18073c06c1ff896fcc0a68121106e78a69ec3ae72b7e69aad16bb03ce7ca430e4 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
| MD5 | d3c4ba31e59c3efcec11d7f4344b6d8d |
| SHA1 | afb9037344b4a2c7f0a9e933bca524edd426889a |
| SHA256 | d76bed24c971d057a04c2b9b0233a786283b74e3142f8a8f6065976a6d538ff2 |
| SHA512 | fc3c94be8c7d15265ccebbb6292437576c3813e90fe9743e7c266fd773f346d18073c06c1ff896fcc0a68121106e78a69ec3ae72b7e69aad16bb03ce7ca430e4 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
| MD5 | d3c4ba31e59c3efcec11d7f4344b6d8d |
| SHA1 | afb9037344b4a2c7f0a9e933bca524edd426889a |
| SHA256 | d76bed24c971d057a04c2b9b0233a786283b74e3142f8a8f6065976a6d538ff2 |
| SHA512 | fc3c94be8c7d15265ccebbb6292437576c3813e90fe9743e7c266fd773f346d18073c06c1ff896fcc0a68121106e78a69ec3ae72b7e69aad16bb03ce7ca430e4 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
| MD5 | d3c4ba31e59c3efcec11d7f4344b6d8d |
| SHA1 | afb9037344b4a2c7f0a9e933bca524edd426889a |
| SHA256 | d76bed24c971d057a04c2b9b0233a786283b74e3142f8a8f6065976a6d538ff2 |
| SHA512 | fc3c94be8c7d15265ccebbb6292437576c3813e90fe9743e7c266fd773f346d18073c06c1ff896fcc0a68121106e78a69ec3ae72b7e69aad16bb03ce7ca430e4 |
memory/1828-103-0x00000000003D0000-0x00000000003EA000-memory.dmp
memory/1828-104-0x00000000002D0000-0x00000000002FD000-memory.dmp
memory/1828-105-0x0000000005040000-0x0000000005080000-memory.dmp
memory/1828-106-0x0000000005040000-0x0000000005080000-memory.dmp
memory/1828-107-0x0000000000D10000-0x0000000000D28000-memory.dmp
memory/1828-108-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-109-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-111-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-113-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-115-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-117-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-119-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-121-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-123-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-125-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-127-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-129-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-131-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-133-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-135-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1828-136-0x0000000005040000-0x0000000005080000-memory.dmp
memory/1828-137-0x0000000000400000-0x0000000000726000-memory.dmp
memory/1828-138-0x0000000000400000-0x0000000000726000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
| MD5 | b7926ad6819f1f4a69deef363b298fe4 |
| SHA1 | c37d39d53d56de3b32aed603d80ee643008775d5 |
| SHA256 | 4fd5664183de2e6f0c8aed4db90701d11bbda3049e46e116c708ee099057736e |
| SHA512 | da18221e973ad40d30fc61edfe5c35d349e06588bd9e5bda1e355a5a7885fafa232852128378624be61991ed073fd8171947454bc2bb09f50eca9403e36b96d2 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
| MD5 | b7926ad6819f1f4a69deef363b298fe4 |
| SHA1 | c37d39d53d56de3b32aed603d80ee643008775d5 |
| SHA256 | 4fd5664183de2e6f0c8aed4db90701d11bbda3049e46e116c708ee099057736e |
| SHA512 | da18221e973ad40d30fc61edfe5c35d349e06588bd9e5bda1e355a5a7885fafa232852128378624be61991ed073fd8171947454bc2bb09f50eca9403e36b96d2 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
| MD5 | b7926ad6819f1f4a69deef363b298fe4 |
| SHA1 | c37d39d53d56de3b32aed603d80ee643008775d5 |
| SHA256 | 4fd5664183de2e6f0c8aed4db90701d11bbda3049e46e116c708ee099057736e |
| SHA512 | da18221e973ad40d30fc61edfe5c35d349e06588bd9e5bda1e355a5a7885fafa232852128378624be61991ed073fd8171947454bc2bb09f50eca9403e36b96d2 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
| MD5 | b7926ad6819f1f4a69deef363b298fe4 |
| SHA1 | c37d39d53d56de3b32aed603d80ee643008775d5 |
| SHA256 | 4fd5664183de2e6f0c8aed4db90701d11bbda3049e46e116c708ee099057736e |
| SHA512 | da18221e973ad40d30fc61edfe5c35d349e06588bd9e5bda1e355a5a7885fafa232852128378624be61991ed073fd8171947454bc2bb09f50eca9403e36b96d2 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
| MD5 | b7926ad6819f1f4a69deef363b298fe4 |
| SHA1 | c37d39d53d56de3b32aed603d80ee643008775d5 |
| SHA256 | 4fd5664183de2e6f0c8aed4db90701d11bbda3049e46e116c708ee099057736e |
| SHA512 | da18221e973ad40d30fc61edfe5c35d349e06588bd9e5bda1e355a5a7885fafa232852128378624be61991ed073fd8171947454bc2bb09f50eca9403e36b96d2 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
| MD5 | b7926ad6819f1f4a69deef363b298fe4 |
| SHA1 | c37d39d53d56de3b32aed603d80ee643008775d5 |
| SHA256 | 4fd5664183de2e6f0c8aed4db90701d11bbda3049e46e116c708ee099057736e |
| SHA512 | da18221e973ad40d30fc61edfe5c35d349e06588bd9e5bda1e355a5a7885fafa232852128378624be61991ed073fd8171947454bc2bb09f50eca9403e36b96d2 |
memory/272-149-0x0000000000D80000-0x0000000000DC6000-memory.dmp
memory/272-150-0x0000000000DC0000-0x0000000000E04000-memory.dmp
memory/272-152-0x0000000004DE0000-0x0000000004E20000-memory.dmp
memory/272-153-0x0000000004DE0000-0x0000000004E20000-memory.dmp
memory/272-154-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-155-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-157-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-161-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-163-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-167-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-171-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-175-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-177-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-181-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-183-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-187-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-185-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-179-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-173-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-169-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-165-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-159-0x0000000000DC0000-0x0000000000DFE000-memory.dmp
memory/272-151-0x0000000000280000-0x00000000002CB000-memory.dmp
memory/272-1060-0x0000000004DE0000-0x0000000004E20000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
| MD5 | 87d8308e8cda648f980eaded98c6dd64 |
| SHA1 | 8e1213fea55c704c3d133c4b8675b99a66c08fc1 |
| SHA256 | dfb2378d9e691c98c02a4ebd3196a313185549e72cd0d770972ea47888889246 |
| SHA512 | 04add36bd3e21f02b1fa836caddfbc0a0adfa480f18a369a5974bf98e093f17f36ab68251d5acdda4d8a94458451953b1fcf6ab7706b5e7125fc852c5dc71200 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
| MD5 | 87d8308e8cda648f980eaded98c6dd64 |
| SHA1 | 8e1213fea55c704c3d133c4b8675b99a66c08fc1 |
| SHA256 | dfb2378d9e691c98c02a4ebd3196a313185549e72cd0d770972ea47888889246 |
| SHA512 | 04add36bd3e21f02b1fa836caddfbc0a0adfa480f18a369a5974bf98e093f17f36ab68251d5acdda4d8a94458451953b1fcf6ab7706b5e7125fc852c5dc71200 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
| MD5 | 87d8308e8cda648f980eaded98c6dd64 |
| SHA1 | 8e1213fea55c704c3d133c4b8675b99a66c08fc1 |
| SHA256 | dfb2378d9e691c98c02a4ebd3196a313185549e72cd0d770972ea47888889246 |
| SHA512 | 04add36bd3e21f02b1fa836caddfbc0a0adfa480f18a369a5974bf98e093f17f36ab68251d5acdda4d8a94458451953b1fcf6ab7706b5e7125fc852c5dc71200 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
| MD5 | 87d8308e8cda648f980eaded98c6dd64 |
| SHA1 | 8e1213fea55c704c3d133c4b8675b99a66c08fc1 |
| SHA256 | dfb2378d9e691c98c02a4ebd3196a313185549e72cd0d770972ea47888889246 |
| SHA512 | 04add36bd3e21f02b1fa836caddfbc0a0adfa480f18a369a5974bf98e093f17f36ab68251d5acdda4d8a94458451953b1fcf6ab7706b5e7125fc852c5dc71200 |
memory/1656-1069-0x0000000000FB0000-0x0000000000FE2000-memory.dmp
memory/1656-1070-0x0000000000830000-0x0000000000870000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
| MD5 | 166d22ed93c723326a6d5fead162fdd3 |
| SHA1 | 17cfd9649a4f68ef90c72689820876dbe4ca22d1 |
| SHA256 | e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7 |
| SHA512 | c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4 |
memory/1488-1106-0x0000000000240000-0x000000000026E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
| MD5 | a8a106555b9e1f92569d623c66ee8c12 |
| SHA1 | a5080c26b5f5911c10d80654c84239a226fc75d1 |
| SHA256 | 84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a |
| SHA512 | 9b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26 |
C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe
| MD5 | a631f66eb7c5e6e476ebac0baa5b0dbe |
| SHA1 | 3ec553f7caffff701451fad841a7b0d38f538895 |
| SHA256 | d3f3ea77ce48cf9b66dd2e067f8c7555b1b1ba5d8cb3f61a91ce68db5a8e8e7e |
| SHA512 | 57dfed65f52374400d1f3193442ed2244a6d9797f360a46ef5a998bc8c2a7b30a501f6a0ab080e60541c4f4dce8502e0992d67cb45f69324893c56832438eb45 |
\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe
| MD5 | a631f66eb7c5e6e476ebac0baa5b0dbe |
| SHA1 | 3ec553f7caffff701451fad841a7b0d38f538895 |
| SHA256 | d3f3ea77ce48cf9b66dd2e067f8c7555b1b1ba5d8cb3f61a91ce68db5a8e8e7e |
| SHA512 | 57dfed65f52374400d1f3193442ed2244a6d9797f360a46ef5a998bc8c2a7b30a501f6a0ab080e60541c4f4dce8502e0992d67cb45f69324893c56832438eb45 |
C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe
| MD5 | a631f66eb7c5e6e476ebac0baa5b0dbe |
| SHA1 | 3ec553f7caffff701451fad841a7b0d38f538895 |
| SHA256 | d3f3ea77ce48cf9b66dd2e067f8c7555b1b1ba5d8cb3f61a91ce68db5a8e8e7e |
| SHA512 | 57dfed65f52374400d1f3193442ed2244a6d9797f360a46ef5a998bc8c2a7b30a501f6a0ab080e60541c4f4dce8502e0992d67cb45f69324893c56832438eb45 |
\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe
| MD5 | a631f66eb7c5e6e476ebac0baa5b0dbe |
| SHA1 | 3ec553f7caffff701451fad841a7b0d38f538895 |
| SHA256 | d3f3ea77ce48cf9b66dd2e067f8c7555b1b1ba5d8cb3f61a91ce68db5a8e8e7e |
| SHA512 | 57dfed65f52374400d1f3193442ed2244a6d9797f360a46ef5a998bc8c2a7b30a501f6a0ab080e60541c4f4dce8502e0992d67cb45f69324893c56832438eb45 |
C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe
| MD5 | a631f66eb7c5e6e476ebac0baa5b0dbe |
| SHA1 | 3ec553f7caffff701451fad841a7b0d38f538895 |
| SHA256 | d3f3ea77ce48cf9b66dd2e067f8c7555b1b1ba5d8cb3f61a91ce68db5a8e8e7e |
| SHA512 | 57dfed65f52374400d1f3193442ed2244a6d9797f360a46ef5a998bc8c2a7b30a501f6a0ab080e60541c4f4dce8502e0992d67cb45f69324893c56832438eb45 |
C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot
| MD5 | e5e81f0ae5ba9a2ac3db0a17d3c9f810 |
| SHA1 | c2d6bdf002325094ff399b1e4c36df575b48ee4f |
| SHA256 | a9826445bacefee0847379551b63949c11cd58e505129c12743da87be48254f3 |
| SHA512 | cb77e1b933cc5c8a2ff8e0e8281f1d6d45b9d3bacbd0adef33515445fb00030cdb2cefc0b7fa22d2b2085b1751ee603027f82656c8b1c289cc71a2bdea630cce |
memory/1488-1179-0x0000000000270000-0x000000000028C000-memory.dmp
memory/1488-1180-0x0000000000290000-0x0000000000291000-memory.dmp
memory/1488-1185-0x0000000000270000-0x000000000028C000-memory.dmp
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 94cbeec5d4343918fd0e48760e40539c |
| SHA1 | a049266c5c1131f692f306c8710d7e72586ae79d |
| SHA256 | 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279 |
| SHA512 | 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-03-22 01:31
Reported
2023-03-22 01:33
Platform
win10v2004-20230220-en
Max time kernel
145s
Max time network
115s
Command Line
Signatures
Amadey
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe | N/A |
Checks installed software on the system
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\installer.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 436 -ip 436
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1080
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4612 -ip 4612
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1176
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 164.113.223.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.38.195.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.220.44.20.in-addr.arpa | udp |
| US | 52.152.110.14:443 | tcp | |
| DE | 193.233.20.31:4125 | tcp | |
| US | 8.8.8.8:53 | 31.20.233.193.in-addr.arpa | udp |
| US | 13.89.178.27:443 | tcp | |
| DE | 193.233.20.31:4125 | tcp | |
| RU | 62.204.41.87:80 | 62.204.41.87 | tcp |
| US | 8.8.8.8:53 | 64.13.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 87.41.204.62.in-addr.arpa | udp |
| US | 209.197.3.8:80 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | 216.74.101.95.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
| MD5 | 9ce7789a117192ac2e425ef84cb828a0 |
| SHA1 | 98025f48e38fa8b75be6b3e3958b876fa4421dd6 |
| SHA256 | 7c64e59efdf784658c7b75c7e88e972ed2c5b5e59ceb7665bd891a32e2f9c6b2 |
| SHA512 | 62c8633c897b9ca56e8df968ec7b79c39dc8da92536212881ae9979db36f4303d0c3e4913aaf509b8f5baf56c1b9899f9ebab6897ae1ae8dd9ad57efdc947b1e |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
| MD5 | 9ce7789a117192ac2e425ef84cb828a0 |
| SHA1 | 98025f48e38fa8b75be6b3e3958b876fa4421dd6 |
| SHA256 | 7c64e59efdf784658c7b75c7e88e972ed2c5b5e59ceb7665bd891a32e2f9c6b2 |
| SHA512 | 62c8633c897b9ca56e8df968ec7b79c39dc8da92536212881ae9979db36f4303d0c3e4913aaf509b8f5baf56c1b9899f9ebab6897ae1ae8dd9ad57efdc947b1e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
| MD5 | dfe5b6397edff0edf98fe4f954108364 |
| SHA1 | 4760065114b58c54b580a51f28236fe04400b7a0 |
| SHA256 | e7f240e2fcce11440b0cab062a1f5240da60a9cf0ff1c0a4e0ee9036de8ef924 |
| SHA512 | cabe73e75191ca1d472d43799c2b6b75002110f554f45752ba0089e757a7d0e900d3e5e51c907281bb90a2387727a5a96466ffad1cc90a35fd2a7c38f9bc947a |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
| MD5 | dfe5b6397edff0edf98fe4f954108364 |
| SHA1 | 4760065114b58c54b580a51f28236fe04400b7a0 |
| SHA256 | e7f240e2fcce11440b0cab062a1f5240da60a9cf0ff1c0a4e0ee9036de8ef924 |
| SHA512 | cabe73e75191ca1d472d43799c2b6b75002110f554f45752ba0089e757a7d0e900d3e5e51c907281bb90a2387727a5a96466ffad1cc90a35fd2a7c38f9bc947a |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
| MD5 | 6edabc7c6dc45f0db4be0955370efa02 |
| SHA1 | 7517049d80a48e14d99fce84b7fd91845ee27193 |
| SHA256 | b671bb8cc6476336b30090595a36b28e54f1ccf4c935227288db74ee000ca468 |
| SHA512 | 5d0c1248670d4c8cf923a1d2f29b3274ea5ed15d68c91c4b6b86f09c64221de1cbc85659ef70d9237b2114544524e734665b87650e14bbc2bd9a119c33075b5a |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
| MD5 | 6edabc7c6dc45f0db4be0955370efa02 |
| SHA1 | 7517049d80a48e14d99fce84b7fd91845ee27193 |
| SHA256 | b671bb8cc6476336b30090595a36b28e54f1ccf4c935227288db74ee000ca468 |
| SHA512 | 5d0c1248670d4c8cf923a1d2f29b3274ea5ed15d68c91c4b6b86f09c64221de1cbc85659ef70d9237b2114544524e734665b87650e14bbc2bd9a119c33075b5a |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
memory/1772-161-0x0000000000760000-0x000000000076A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
| MD5 | d3c4ba31e59c3efcec11d7f4344b6d8d |
| SHA1 | afb9037344b4a2c7f0a9e933bca524edd426889a |
| SHA256 | d76bed24c971d057a04c2b9b0233a786283b74e3142f8a8f6065976a6d538ff2 |
| SHA512 | fc3c94be8c7d15265ccebbb6292437576c3813e90fe9743e7c266fd773f346d18073c06c1ff896fcc0a68121106e78a69ec3ae72b7e69aad16bb03ce7ca430e4 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
| MD5 | d3c4ba31e59c3efcec11d7f4344b6d8d |
| SHA1 | afb9037344b4a2c7f0a9e933bca524edd426889a |
| SHA256 | d76bed24c971d057a04c2b9b0233a786283b74e3142f8a8f6065976a6d538ff2 |
| SHA512 | fc3c94be8c7d15265ccebbb6292437576c3813e90fe9743e7c266fd773f346d18073c06c1ff896fcc0a68121106e78a69ec3ae72b7e69aad16bb03ce7ca430e4 |
memory/436-167-0x0000000000810000-0x000000000083D000-memory.dmp
memory/436-168-0x0000000004E60000-0x0000000005404000-memory.dmp
memory/436-169-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-170-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-172-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-174-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-178-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-176-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-180-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-182-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-184-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-186-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-188-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-193-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/436-191-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/436-190-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-194-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-196-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-198-0x0000000004C90000-0x0000000004CA2000-memory.dmp
memory/436-199-0x0000000000400000-0x0000000000726000-memory.dmp
memory/436-201-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/436-202-0x0000000000400000-0x0000000000726000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
| MD5 | b7926ad6819f1f4a69deef363b298fe4 |
| SHA1 | c37d39d53d56de3b32aed603d80ee643008775d5 |
| SHA256 | 4fd5664183de2e6f0c8aed4db90701d11bbda3049e46e116c708ee099057736e |
| SHA512 | da18221e973ad40d30fc61edfe5c35d349e06588bd9e5bda1e355a5a7885fafa232852128378624be61991ed073fd8171947454bc2bb09f50eca9403e36b96d2 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
| MD5 | b7926ad6819f1f4a69deef363b298fe4 |
| SHA1 | c37d39d53d56de3b32aed603d80ee643008775d5 |
| SHA256 | 4fd5664183de2e6f0c8aed4db90701d11bbda3049e46e116c708ee099057736e |
| SHA512 | da18221e973ad40d30fc61edfe5c35d349e06588bd9e5bda1e355a5a7885fafa232852128378624be61991ed073fd8171947454bc2bb09f50eca9403e36b96d2 |
memory/4612-207-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-208-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-212-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/4612-211-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-215-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-216-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/4612-218-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-214-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/4612-210-0x0000000000840000-0x000000000088B000-memory.dmp
memory/4612-220-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-222-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-224-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-226-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-228-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-230-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-232-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-234-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-236-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-238-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-240-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-242-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-244-0x00000000027C0000-0x00000000027FE000-memory.dmp
memory/4612-1117-0x00000000054B0000-0x0000000005AC8000-memory.dmp
memory/4612-1118-0x0000000005B20000-0x0000000005C2A000-memory.dmp
memory/4612-1119-0x0000000005C60000-0x0000000005C72000-memory.dmp
memory/4612-1120-0x0000000005C80000-0x0000000005CBC000-memory.dmp
memory/4612-1121-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/4612-1122-0x0000000005F70000-0x0000000006002000-memory.dmp
memory/4612-1123-0x0000000006010000-0x0000000006076000-memory.dmp
memory/4612-1125-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/4612-1126-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/4612-1127-0x0000000006730000-0x00000000068F2000-memory.dmp
memory/4612-1128-0x0000000006910000-0x0000000006E3C000-memory.dmp
memory/4612-1129-0x0000000007070000-0x00000000070E6000-memory.dmp
memory/4612-1130-0x0000000007100000-0x0000000007150000-memory.dmp
memory/4612-1132-0x0000000004EF0000-0x0000000004F00000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
| MD5 | 87d8308e8cda648f980eaded98c6dd64 |
| SHA1 | 8e1213fea55c704c3d133c4b8675b99a66c08fc1 |
| SHA256 | dfb2378d9e691c98c02a4ebd3196a313185549e72cd0d770972ea47888889246 |
| SHA512 | 04add36bd3e21f02b1fa836caddfbc0a0adfa480f18a369a5974bf98e093f17f36ab68251d5acdda4d8a94458451953b1fcf6ab7706b5e7125fc852c5dc71200 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
| MD5 | 87d8308e8cda648f980eaded98c6dd64 |
| SHA1 | 8e1213fea55c704c3d133c4b8675b99a66c08fc1 |
| SHA256 | dfb2378d9e691c98c02a4ebd3196a313185549e72cd0d770972ea47888889246 |
| SHA512 | 04add36bd3e21f02b1fa836caddfbc0a0adfa480f18a369a5974bf98e093f17f36ab68251d5acdda4d8a94458451953b1fcf6ab7706b5e7125fc852c5dc71200 |
memory/1060-1137-0x0000000000D60000-0x0000000000D92000-memory.dmp
memory/1060-1138-0x0000000005680000-0x0000000005690000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 94cbeec5d4343918fd0e48760e40539c |
| SHA1 | a049266c5c1131f692f306c8710d7e72586ae79d |
| SHA256 | 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279 |
| SHA512 | 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | 16cf28ebb6d37dbaba93f18320c6086e |
| SHA1 | eae7d4b7a9636329065877aabe8d4f721a26ab25 |
| SHA256 | c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106 |
| SHA512 | f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2 |
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
| MD5 | 5086db99de54fca268169a1c6cf26122 |
| SHA1 | 003f768ffcc99bda5cda1fb966fda8625a8fdc3e |
| SHA256 | 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4 |
| SHA512 | 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5 |