Analysis
-
max time kernel
132s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 17:01
Static task
static1
General
-
Target
ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe
-
Size
1.0MB
-
MD5
d6a42a9619b5e9a95158d2813fc44fa5
-
SHA1
c7f3d32e8534e1c78cf10104257bcc2a5e346f9b
-
SHA256
ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7
-
SHA512
a59551de9b9bb5e3065321de3ca75d69e767053c2160d09953641c2b46496cd88d797395b735846df7a6d2e5c1091122e5ce1fd191644767355f12ae771f6094
-
SSDEEP
12288:zMr+y907geVIDYgS0K7yCQulINYCtfE7FZsMQMt+rRZM3XdWVVZusV8Mh0oU9PJ6:RyTU4H9Y+oZsMH+rRZMnuQsCMhXQRI
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
lida
193.233.20.32:4125
-
auth_value
24052aa2e9b85984a98d80cf08623e8d
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
Cong
199.115.193.171:48258
-
auth_value
aecbeec46b8431628af8ba12e4621a71
Extracted
redline
whitedoc
81.161.229.143:45156
-
auth_value
2020d22aaa2ecafa1b12e00dfcffae03
Signatures
-
Processes:
tz4394.exev2911pS.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz4394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz4394.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v2911pS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v2911pS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v2911pS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v2911pS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v2911pS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz4394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz4394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz4394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz4394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v2911pS.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/5068-209-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-210-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-212-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-214-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-216-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-218-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-220-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-230-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-226-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-222-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-232-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-234-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-236-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-238-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-240-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-242-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-244-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline behavioral1/memory/5068-246-0x00000000076F0000-0x000000000772F000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y96dV52.exelegenda.exe76783.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation y96dV52.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation legenda.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation 76783.exe -
Executes dropped EXE 16 IoCs
Processes:
zap9845.exezap4336.exezap4583.exetz4394.exev2911pS.exew94Eb63.exexZDgi40.exey96dV52.exelegenda.exe76783.exeBlaubok.exeBlaubok.exeBlaubok.exelegenda.exebuild.exelegenda.exepid process 4316 zap9845.exe 4228 zap4336.exe 2544 zap4583.exe 236 tz4394.exe 2264 v2911pS.exe 5068 w94Eb63.exe 3556 xZDgi40.exe 3272 y96dV52.exe 1200 legenda.exe 216 76783.exe 4192 Blaubok.exe 828 Blaubok.exe 3280 Blaubok.exe 4664 legenda.exe 4456 build.exe 1800 legenda.exe -
Loads dropped DLL 2 IoCs
Processes:
build.exerundll32.exepid process 4456 build.exe 1580 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz4394.exev2911pS.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz4394.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v2911pS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v2911pS.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exezap9845.exezap4336.exezap4583.exebuild.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap9845.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap9845.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4336.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4583.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap4336.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap4583.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\build = "C:\\Users\\Admin\\AppData\\Local\\7bce0c7a2b0b2304182b7e68cbe22acc\\build.exe" build.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 98 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
Blaubok.exe76783.exedescription pid process target process PID 4192 set thread context of 3280 4192 Blaubok.exe Blaubok.exe PID 216 set thread context of 3780 216 76783.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2288 2264 WerFault.exe v2911pS.exe 1068 5068 WerFault.exe w94Eb63.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 build.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier build.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
build.exepid process 4456 build.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tz4394.exev2911pS.exew94Eb63.exexZDgi40.exe76783.exepid process 236 tz4394.exe 236 tz4394.exe 2264 v2911pS.exe 2264 v2911pS.exe 5068 w94Eb63.exe 5068 w94Eb63.exe 3556 xZDgi40.exe 3556 xZDgi40.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe 216 76783.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
tz4394.exev2911pS.exew94Eb63.exexZDgi40.exe76783.exeBlaubok.exebuild.exemsiexec.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 236 tz4394.exe Token: SeDebugPrivilege 2264 v2911pS.exe Token: SeDebugPrivilege 5068 w94Eb63.exe Token: SeDebugPrivilege 3556 xZDgi40.exe Token: SeDebugPrivilege 216 76783.exe Token: SeDebugPrivilege 3280 Blaubok.exe Token: SeDebugPrivilege 4456 build.exe Token: SeSecurityPrivilege 4404 msiexec.exe Token: SeDebugPrivilege 3780 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
build.exepid process 4456 build.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exezap9845.exezap4336.exezap4583.exey96dV52.exelegenda.execmd.exeBlaubok.exedescription pid process target process PID 3772 wrote to memory of 4316 3772 ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe zap9845.exe PID 3772 wrote to memory of 4316 3772 ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe zap9845.exe PID 3772 wrote to memory of 4316 3772 ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe zap9845.exe PID 4316 wrote to memory of 4228 4316 zap9845.exe zap4336.exe PID 4316 wrote to memory of 4228 4316 zap9845.exe zap4336.exe PID 4316 wrote to memory of 4228 4316 zap9845.exe zap4336.exe PID 4228 wrote to memory of 2544 4228 zap4336.exe zap4583.exe PID 4228 wrote to memory of 2544 4228 zap4336.exe zap4583.exe PID 4228 wrote to memory of 2544 4228 zap4336.exe zap4583.exe PID 2544 wrote to memory of 236 2544 zap4583.exe tz4394.exe PID 2544 wrote to memory of 236 2544 zap4583.exe tz4394.exe PID 2544 wrote to memory of 2264 2544 zap4583.exe v2911pS.exe PID 2544 wrote to memory of 2264 2544 zap4583.exe v2911pS.exe PID 2544 wrote to memory of 2264 2544 zap4583.exe v2911pS.exe PID 4228 wrote to memory of 5068 4228 zap4336.exe w94Eb63.exe PID 4228 wrote to memory of 5068 4228 zap4336.exe w94Eb63.exe PID 4228 wrote to memory of 5068 4228 zap4336.exe w94Eb63.exe PID 4316 wrote to memory of 3556 4316 zap9845.exe xZDgi40.exe PID 4316 wrote to memory of 3556 4316 zap9845.exe xZDgi40.exe PID 4316 wrote to memory of 3556 4316 zap9845.exe xZDgi40.exe PID 3772 wrote to memory of 3272 3772 ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe y96dV52.exe PID 3772 wrote to memory of 3272 3772 ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe y96dV52.exe PID 3772 wrote to memory of 3272 3772 ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe y96dV52.exe PID 3272 wrote to memory of 1200 3272 y96dV52.exe legenda.exe PID 3272 wrote to memory of 1200 3272 y96dV52.exe legenda.exe PID 3272 wrote to memory of 1200 3272 y96dV52.exe legenda.exe PID 1200 wrote to memory of 4988 1200 legenda.exe schtasks.exe PID 1200 wrote to memory of 4988 1200 legenda.exe schtasks.exe PID 1200 wrote to memory of 4988 1200 legenda.exe schtasks.exe PID 1200 wrote to memory of 4080 1200 legenda.exe cmd.exe PID 1200 wrote to memory of 4080 1200 legenda.exe cmd.exe PID 1200 wrote to memory of 4080 1200 legenda.exe cmd.exe PID 4080 wrote to memory of 404 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 404 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 404 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 1180 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 1180 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 1180 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 2208 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 2208 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 2208 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3884 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 3884 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 3884 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 3636 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3636 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3636 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3532 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3532 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3532 4080 cmd.exe cacls.exe PID 1200 wrote to memory of 216 1200 legenda.exe 76783.exe PID 1200 wrote to memory of 216 1200 legenda.exe 76783.exe PID 1200 wrote to memory of 216 1200 legenda.exe 76783.exe PID 1200 wrote to memory of 4192 1200 legenda.exe Blaubok.exe PID 1200 wrote to memory of 4192 1200 legenda.exe Blaubok.exe PID 1200 wrote to memory of 4192 1200 legenda.exe Blaubok.exe PID 4192 wrote to memory of 828 4192 Blaubok.exe Blaubok.exe PID 4192 wrote to memory of 828 4192 Blaubok.exe Blaubok.exe PID 4192 wrote to memory of 828 4192 Blaubok.exe Blaubok.exe PID 4192 wrote to memory of 828 4192 Blaubok.exe Blaubok.exe PID 4192 wrote to memory of 3280 4192 Blaubok.exe Blaubok.exe PID 4192 wrote to memory of 3280 4192 Blaubok.exe Blaubok.exe PID 4192 wrote to memory of 3280 4192 Blaubok.exe Blaubok.exe PID 4192 wrote to memory of 3280 4192 Blaubok.exe Blaubok.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe"C:\Users\Admin\AppData\Local\Temp\ecd5854a5095cf1546021974c28ab3a08aa34a840f5d1d3e004a6b96ee489ec7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9845.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9845.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4336.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4336.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4583.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4583.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4394.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4394.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2911pS.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2911pS.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 10806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94Eb63.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94Eb63.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 13525⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xZDgi40.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xZDgi40.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y96dV52.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y96dV52.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exe"C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile7⤵
-
C:\Windows\system32\findstr.exefindstr All7⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe"C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeC:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeC:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2264 -ip 22641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5068 -ip 50681⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Blaubok.exe.logFilesize
1KB
MD5a3c82409506a33dec1856104ca55cbfd
SHA12e2ba4e4227590f8821002831c5410f7f45fe812
SHA256780a0d4410f5f9798cb573bcd774561d1439987a39b1368d3c890226928cd203
SHA5129621cfd3dab86d964a2bea6b3788fc19a895307962dcc41428741b8a86291f114df722e9017f755f63d53d09b5111e68f05aa505d9c9deae6c4378a87cdfa69f
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\169c1112-5e38-4bd6-9d69-cab01278d784Filesize
5.0MB
MD59ddcc55845cd64d6eabec4d950c970f1
SHA1c88f272f6e27ee307ee4fe10124dee3ec15163d9
SHA2569d7b72c9102ad666896fc226ba77b64d3b3ce074207466eaa05588ae429e0640
SHA512197ca693cb4f2f7da12ebb0d58af26f8bcdaa98584dd59edcc86cf28607e1b128956f9a1e455e138a60b8ea89e4ace41e1777d9a1ac68c024aa75de1255e7e44
-
C:\Users\Admin\AppData\Local\Temp\7264dc22-0881-439d-bdba-2ec1e01be8a9Filesize
92KB
MD5651d855bcf44adceccfd3fffcd32956d
SHA145ac6cb8bd69976f45a37bf86193bd4c8e03fce9
SHA2564ada554163d26c8a3385d4fe372fc132971c867e23927a35d72a98aadb25b57b
SHA51267b4683a4e780093e5b3e73ea906a42c74f96a9234845114e0ea6e61ab0308c2e5b7f12d3428ce5bf48928863c102f57c011f9cdc4589d2d82c078b3db70c31f
-
C:\Users\Admin\AppData\Local\Temp\9285e43e-f9a4-402b-b3d7-f99db3b2d896Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\Costura\4993FC383A80402228FA13C13CB7F2C2\64\sqlite.interop.dllFilesize
1.6MB
MD50ec8d85d10ff52827930b1cec64a0933
SHA190c6d01aefa10f5488411c84553ed44131372c58
SHA2567f214dfccf659d8e4c0a08aa6772b2e540f20987aab2b26b6baad2d201554bec
SHA512650257cf683d030bfa6a8da7065409b47e994ae86ba96934a1d977c51a48b2d80d8e1bc8a7979deb089ba243cef13f9e2707837f9803d691b51c14c07aff3375
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y96dV52.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y96dV52.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9845.exeFilesize
859KB
MD580c7a1ef4daf457d6feb1310e4e71909
SHA117d6d37c34d6ae4f3d79ba2eaec454c556c74d04
SHA2563059d1eddfd94fc47a1544dfd13b427a285f866336989875580286dfa430435c
SHA51233b3f4b54d067a452905b15c0f5f87228184a1778a6d099c5cf2f211d1cc7fd6575d30fe796a7823ec8b9863ba7929bac3dc7098220872eb609fda0778967efa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9845.exeFilesize
859KB
MD580c7a1ef4daf457d6feb1310e4e71909
SHA117d6d37c34d6ae4f3d79ba2eaec454c556c74d04
SHA2563059d1eddfd94fc47a1544dfd13b427a285f866336989875580286dfa430435c
SHA51233b3f4b54d067a452905b15c0f5f87228184a1778a6d099c5cf2f211d1cc7fd6575d30fe796a7823ec8b9863ba7929bac3dc7098220872eb609fda0778967efa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xZDgi40.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xZDgi40.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4336.exeFilesize
717KB
MD50384e9385f06d9f9bc10177dbf0dcd0b
SHA199af4212fa499fceb6d0d8bcb3c852e4731c315c
SHA256819ddd52a4105e16ebe40579839b8e1f72489ebe331cdf94e99b29ac4587b89b
SHA5121b59616f6c04f00458cd6cf94ff900bac2edc435cf1763bfeaa418f0461c5b6084332620db6db03d160d44e2034354a266188f4a943338b34ec026696e55bd54
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4336.exeFilesize
717KB
MD50384e9385f06d9f9bc10177dbf0dcd0b
SHA199af4212fa499fceb6d0d8bcb3c852e4731c315c
SHA256819ddd52a4105e16ebe40579839b8e1f72489ebe331cdf94e99b29ac4587b89b
SHA5121b59616f6c04f00458cd6cf94ff900bac2edc435cf1763bfeaa418f0461c5b6084332620db6db03d160d44e2034354a266188f4a943338b34ec026696e55bd54
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94Eb63.exeFilesize
386KB
MD54203690d718f0e78c3d8404c5d59bd8f
SHA1968dfbc0d02965b200b6545f18075425d4557f60
SHA2562180e4abb9c277ddbc996d3da8d66cc15921bc473ca09d836c57dd7d6e7b7e0b
SHA5123d06c946e383af9ef057dc3373335a8d12db5621674bd86d1cbacb5e7142e9351d147d95a17d55434b459a1ab278020ecc9a354126e0d7a84b5560b78c181b33
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94Eb63.exeFilesize
386KB
MD54203690d718f0e78c3d8404c5d59bd8f
SHA1968dfbc0d02965b200b6545f18075425d4557f60
SHA2562180e4abb9c277ddbc996d3da8d66cc15921bc473ca09d836c57dd7d6e7b7e0b
SHA5123d06c946e383af9ef057dc3373335a8d12db5621674bd86d1cbacb5e7142e9351d147d95a17d55434b459a1ab278020ecc9a354126e0d7a84b5560b78c181b33
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4583.exeFilesize
354KB
MD5154e0ad1dd332b4b345e878934e4bf48
SHA1300c97067f24c058d83488aa2769da262560cdf6
SHA256e76756d0b25bc6ccce12105846cc4240ff8c7eb054f3dbba5a31d6d90128055e
SHA5128bd9856f350adeaf6e9f18bf88ec5c46180d934768bfbf8a3436c8239ef1b71188a32e0f26e9c50a3cbb4bfd36dcf71ab0a59fb4e439680a4908c0d6f6b0073f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4583.exeFilesize
354KB
MD5154e0ad1dd332b4b345e878934e4bf48
SHA1300c97067f24c058d83488aa2769da262560cdf6
SHA256e76756d0b25bc6ccce12105846cc4240ff8c7eb054f3dbba5a31d6d90128055e
SHA5128bd9856f350adeaf6e9f18bf88ec5c46180d934768bfbf8a3436c8239ef1b71188a32e0f26e9c50a3cbb4bfd36dcf71ab0a59fb4e439680a4908c0d6f6b0073f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4394.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4394.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2911pS.exeFilesize
328KB
MD5074ef7c26ccd18ed607c312936582ea8
SHA1b7be31dfb7a1e7ddd388a37107484055dee1695e
SHA2565f841e1f7752e98a4bf6e898ed07bcf93b889dc05e3ab98667173acc4630b01c
SHA5127bb79e749d663dfa826b15ceac86ada34acd05f8cbb1154e29c83532dcb3c61fe2c4646b8dedc7bd390fb044e605d76218427f58417bd3aedee6ec2d36f358a2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2911pS.exeFilesize
328KB
MD5074ef7c26ccd18ed607c312936582ea8
SHA1b7be31dfb7a1e7ddd388a37107484055dee1695e
SHA2565f841e1f7752e98a4bf6e898ed07bcf93b889dc05e3ab98667173acc4630b01c
SHA5127bb79e749d663dfa826b15ceac86ada34acd05f8cbb1154e29c83532dcb3c61fe2c4646b8dedc7bd390fb044e605d76218427f58417bd3aedee6ec2d36f358a2
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\PFJFTHNTPNwUXINIZSV.Admin\Browsers\Firefox\Bookmarks.txtFilesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Roaming\PFJFTHNTPNwUXINIZSV.Admin\System\Apps.txtFilesize
4KB
MD5ad30d5d8ed618fddfa811b281d2112c2
SHA1c95f0355575813e94cc1b83a4ca0522824b13ffb
SHA256d179849e42aa63e523bdcb02404c2f571488723d5d56df23f2d880c58784f95f
SHA51243c0c1e0ea0bffab94e83981d38ebb4e9de60c4f8bdb976cc2e3923a51ca2cd71e7fdeaab3cffc1b8230c5cfbf5e5f6b8871bbbb3bcbe5f2c0a2ee8b690a1ff5
-
C:\Users\Admin\AppData\Roaming\PFJFTHNTPNwUXINIZSV.Admin\System\Process.txtFilesize
720B
MD5619724831d96e1520bd7c46192a1dae0
SHA136b12aeb62b3533a93b633d1500d13afc6cabf9c
SHA25607e8a281d0e098e02ea5afdf9b87daee97e1e0f458941fa607b5eab7711d963f
SHA512f2f75441b050a58cbe240bce1b199fb5b895c8e4f8f1c9e35588e71a9465f3ffbc2d4b1eb75a27a57525f8602e3e985cf2942ed078c60d663fef9c3c97dab60b
-
C:\Users\Admin\AppData\Roaming\PFJFTHNTPNwUXINIZSV.Admin\System\Process.txtFilesize
1KB
MD5da5d3dc4d307c16237a4404b195e0f32
SHA1fd1368dfa51f6402c932567846135e3bdda05d4d
SHA256e4bb14a83dd0bb542b250f69e5f8d0b974d5162e2af30794fd07f21366967abd
SHA51286aa7b6b52d897c7ba24310e4ad2b1c7c0bd17199dce8c1aade5720f20edc4f8ee3d0acc83b48febd183460a2ae202d766f001b5530da75a71b5928ab090db6a
-
C:\Users\Admin\AppData\Roaming\PFJFTHNTPNwUXINIZSV.Admin\System\Process.txtFilesize
2KB
MD5684efc269c20fef3e9ee140d4d67c6eb
SHA170b43701a523c73e718e9a33065d34eaccb485c7
SHA256f236053040400e4f2623ba195f17ba77625c5aa8331a97e457519638bc834a23
SHA512cf42fd434222a193c42334d8dfeff2cb63cfa04a90fc09e79af3eb842c74209aecbbc8f72ce601f0a24675a84890ee7083f296bf1a3aebd87fbae41cb45b6532
-
C:\Users\Admin\AppData\Roaming\PFJFTHNTPNwUXINIZSV.Admin\System\Process.txtFilesize
2KB
MD53d61d7fbb2b37bd68fb126a4dddd6549
SHA1eb86ccc8e6b286571abb088c3b7940b659eb50a6
SHA256567a10df8cd35bbac3ad0c536e5d93c75179168beb81e5d554f5c0465e226ce0
SHA512fa42d9b2ad71312b08e69185081162c1a02dc8189682293be2438ddd34a9d97bd13ee4fc469245d623650742c4f84fa3481b2db27b21665c88ef0007b45fad5e
-
C:\Users\Admin\AppData\Roaming\PFJFTHNTPNwUXINIZSV.Admin\System\Process.txtFilesize
3KB
MD55173b784b9cb73ad1c02f5dd2e056c39
SHA1ab13f3e2dfa4f3ea7e012d1772422082fd4bc874
SHA256864387035fbbf50cb9c03bc144a557850b2073faa1a817e40a5ac7becf1a0785
SHA5128b17b29dd724474761cfb97022fe5a3ed10b907533456066536a51579b67f8108a36a7403892130bff785f96ac90c9efbe9a484eb75c2144e8d0e0bd942ad400
-
C:\Users\Admin\AppData\Roaming\PFJFTHNTPNwUXINIZSV.Admin\System\Process.txtFilesize
4KB
MD56d1cfdf8c8b5d70c5b89fea0e38fa810
SHA16911a08c118f56daf2f9a307972f508cd2af3911
SHA2561f76b5d62bfd2224d688b072fd4c0b5d211bcb6592b9e556d7730b77e52fa95f
SHA51209f58d56b5af217527a53122463b74731294f758732a7f9b2c039e6642ebdf6486199d73a64cb8a4cde0ae9d058950a68e2021bfcfcbdc8c9cb228605bb0fe4e
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/216-1448-0x0000000005AC0000-0x0000000005AD0000-memory.dmpFilesize
64KB
-
memory/216-1174-0x0000000000DA0000-0x0000000000EE0000-memory.dmpFilesize
1.2MB
-
memory/216-1225-0x0000000005AC0000-0x0000000005AD0000-memory.dmpFilesize
64KB
-
memory/216-1224-0x0000000005AC0000-0x0000000005AD0000-memory.dmpFilesize
64KB
-
memory/216-1211-0x0000000005AC0000-0x0000000005AD0000-memory.dmpFilesize
64KB
-
memory/216-1209-0x0000000005AC0000-0x0000000005AD0000-memory.dmpFilesize
64KB
-
memory/216-1201-0x0000000005AC0000-0x0000000005AD0000-memory.dmpFilesize
64KB
-
memory/216-1200-0x0000000005AC0000-0x0000000005AD0000-memory.dmpFilesize
64KB
-
memory/216-1199-0x00000000081D0000-0x00000000081DA000-memory.dmpFilesize
40KB
-
memory/216-1197-0x0000000005AC0000-0x0000000005AD0000-memory.dmpFilesize
64KB
-
memory/216-1185-0x00000000058C0000-0x000000000595C000-memory.dmpFilesize
624KB
-
memory/216-1175-0x00000000057C0000-0x0000000005D2C000-memory.dmpFilesize
5.4MB
-
memory/236-161-0x0000000000D50000-0x0000000000D5A000-memory.dmpFilesize
40KB
-
memory/2264-185-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-175-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-167-0x0000000002B80000-0x0000000002BAD000-memory.dmpFilesize
180KB
-
memory/2264-168-0x00000000074E0000-0x00000000074F0000-memory.dmpFilesize
64KB
-
memory/2264-169-0x00000000074F0000-0x0000000007A94000-memory.dmpFilesize
5.6MB
-
memory/2264-171-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-170-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-173-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-177-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-181-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-179-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-183-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-204-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/2264-203-0x00000000074E0000-0x00000000074F0000-memory.dmpFilesize
64KB
-
memory/2264-187-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-189-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-201-0x00000000074E0000-0x00000000074F0000-memory.dmpFilesize
64KB
-
memory/2264-200-0x00000000074E0000-0x00000000074F0000-memory.dmpFilesize
64KB
-
memory/2264-199-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/2264-198-0x00000000074E0000-0x00000000074F0000-memory.dmpFilesize
64KB
-
memory/2264-197-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-195-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-193-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/2264-191-0x00000000049B0000-0x00000000049C2000-memory.dmpFilesize
72KB
-
memory/3280-1226-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/3280-1208-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/3280-1207-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3556-1141-0x00000000058B0000-0x00000000058C0000-memory.dmpFilesize
64KB
-
memory/3556-1140-0x0000000000CF0000-0x0000000000D22000-memory.dmpFilesize
200KB
-
memory/3780-1489-0x0000000006C60000-0x0000000006C7E000-memory.dmpFilesize
120KB
-
memory/3780-1469-0x0000000005840000-0x0000000005850000-memory.dmpFilesize
64KB
-
memory/3780-1468-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4192-1196-0x00000000000D0000-0x00000000001B6000-memory.dmpFilesize
920KB
-
memory/4192-1198-0x00000000049E0000-0x00000000049F0000-memory.dmpFilesize
64KB
-
memory/4456-1409-0x0000000000CA0000-0x0000000000CB0000-memory.dmpFilesize
64KB
-
memory/4456-1366-0x0000000000CA0000-0x0000000000CB0000-memory.dmpFilesize
64KB
-
memory/4456-1463-0x0000000000CA0000-0x0000000000CB0000-memory.dmpFilesize
64KB
-
memory/4456-1368-0x0000000020140000-0x000000002017A000-memory.dmpFilesize
232KB
-
memory/4456-1367-0x0000000000CA0000-0x0000000000CB0000-memory.dmpFilesize
64KB
-
memory/4456-1464-0x0000000000CA0000-0x0000000000CB0000-memory.dmpFilesize
64KB
-
memory/4456-1465-0x0000000000CA0000-0x0000000000CB0000-memory.dmpFilesize
64KB
-
memory/4456-1434-0x000000001F560000-0x000000001F572000-memory.dmpFilesize
72KB
-
memory/4456-1364-0x0000000000CA0000-0x0000000000CB0000-memory.dmpFilesize
64KB
-
memory/4456-1363-0x0000000020310000-0x00000000204D2000-memory.dmpFilesize
1.8MB
-
memory/4456-1229-0x000000001E000000-0x000000001E00A000-memory.dmpFilesize
40KB
-
memory/4456-1228-0x000000001DFD0000-0x000000001DFEE000-memory.dmpFilesize
120KB
-
memory/4456-1227-0x000000001E050000-0x000000001E0C6000-memory.dmpFilesize
472KB
-
memory/4456-1223-0x00000000004C0000-0x0000000000500000-memory.dmpFilesize
256KB
-
memory/5068-232-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-1133-0x0000000009690000-0x00000000096E0000-memory.dmpFilesize
320KB
-
memory/5068-236-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-1129-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/5068-1130-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/5068-1123-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/5068-1122-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/5068-222-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-226-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-230-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-229-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/5068-227-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/5068-225-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/5068-1128-0x0000000008E60000-0x000000000938C000-memory.dmpFilesize
5.2MB
-
memory/5068-238-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-1131-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/5068-1127-0x0000000008C80000-0x0000000008E42000-memory.dmpFilesize
1.8MB
-
memory/5068-240-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-1132-0x0000000009610000-0x0000000009686000-memory.dmpFilesize
472KB
-
memory/5068-234-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-1126-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/5068-1125-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/5068-1135-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/5068-223-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/5068-242-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-220-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-244-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-246-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-1119-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/5068-209-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-1120-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/5068-218-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-216-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-214-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-212-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB
-
memory/5068-1121-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/5068-210-0x00000000076F0000-0x000000000772F000-memory.dmpFilesize
252KB