Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
24-03-2023 17:09
Static task
static1
General
-
Target
be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe
-
Size
1.0MB
-
MD5
ef50d6db418454f631ed71d40116bb3b
-
SHA1
506c685f8f948c915e265e129362a0b17c4cec80
-
SHA256
be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c
-
SHA512
bcd40a7c2195213a084563037f43c5b4202796decb53f11c160b56a74ba00d0211073a988479e2eafd918d2e88814e05ec38408a2285b085ac3c06e1c756940c
-
SSDEEP
24576:hy9A8atsXl8jF1wpIcS67xxpIdoNJvDjSXqFArJooX:Uudc6j0pSY9RCX8
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
lida
193.233.20.32:4125
-
auth_value
24052aa2e9b85984a98d80cf08623e8d
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
Anh123
199.115.193.116:11300
-
auth_value
db990971ec3911c24ea05eeccc2e1f60
Extracted
redline
Cong
199.115.193.171:48258
-
auth_value
aecbeec46b8431628af8ba12e4621a71
Signatures
-
Processes:
v5480An.exetz7246.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v5480An.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v5480An.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v5480An.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v5480An.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz7246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz7246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz7246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz7246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz7246.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v5480An.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1080-201-0x0000000004C80000-0x0000000004CC6000-memory.dmp family_redline behavioral1/memory/1080-202-0x00000000071C0000-0x0000000007204000-memory.dmp family_redline behavioral1/memory/1080-203-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-204-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-206-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-208-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-210-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-212-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-214-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-216-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-218-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-221-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-226-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-228-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-230-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-232-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-238-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-236-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline behavioral1/memory/1080-234-0x00000000071C0000-0x00000000071FF000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 19 IoCs
Processes:
zap0525.exezap1439.exezap4028.exetz7246.exev5480An.exew70yl39.exexfYsu33.exey43Gy60.exelegenda.exeNasalized.exe76783.exeBlaubok.exeNasalized.exelegenda.exeBlaubok.exeNasalized.exeBlaubok.exebuild.exelegenda.exepid process 2884 zap0525.exe 5092 zap1439.exe 4596 zap4028.exe 4224 tz7246.exe 1660 v5480An.exe 1080 w70yl39.exe 3416 xfYsu33.exe 4100 y43Gy60.exe 3984 legenda.exe 4332 Nasalized.exe 4896 76783.exe 1788 Blaubok.exe 4888 Nasalized.exe 3816 legenda.exe 824 Blaubok.exe 660 Nasalized.exe 1548 Blaubok.exe 3100 build.exe 4240 legenda.exe -
Loads dropped DLL 2 IoCs
Processes:
build.exerundll32.exepid process 3100 build.exe 4752 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz7246.exev5480An.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz7246.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v5480An.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v5480An.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
zap1439.exebuild.exezap0525.exezap4028.exebe05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap1439.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap1439.exe Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run\build = "C:\\Users\\Admin\\AppData\\Local\\6f95d8ce1a884419d38611d38a18d36f\\build.exe" build.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap0525.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap0525.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap4028.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 37 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
Nasalized.exeBlaubok.exe76783.exedescription pid process target process PID 4332 set thread context of 660 4332 Nasalized.exe Nasalized.exe PID 1788 set thread context of 1548 1788 Blaubok.exe Blaubok.exe PID 4896 set thread context of 2476 4896 76783.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 build.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier build.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
build.exepid process 3100 build.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tz7246.exev5480An.exew70yl39.exexfYsu33.exe76783.exepid process 4224 tz7246.exe 4224 tz7246.exe 1660 v5480An.exe 1660 v5480An.exe 1080 w70yl39.exe 1080 w70yl39.exe 3416 xfYsu33.exe 3416 xfYsu33.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe 4896 76783.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
tz7246.exev5480An.exew70yl39.exexfYsu33.exe76783.exeBlaubok.exebuild.exeNasalized.exemsiexec.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4224 tz7246.exe Token: SeDebugPrivilege 1660 v5480An.exe Token: SeDebugPrivilege 1080 w70yl39.exe Token: SeDebugPrivilege 3416 xfYsu33.exe Token: SeDebugPrivilege 4896 76783.exe Token: SeDebugPrivilege 1548 Blaubok.exe Token: SeDebugPrivilege 3100 build.exe Token: SeDebugPrivilege 660 Nasalized.exe Token: SeSecurityPrivilege 4692 msiexec.exe Token: SeDebugPrivilege 2476 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
build.exepid process 3100 build.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exezap0525.exezap1439.exezap4028.exey43Gy60.exelegenda.execmd.exeNasalized.exeBlaubok.exedescription pid process target process PID 2544 wrote to memory of 2884 2544 be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe zap0525.exe PID 2544 wrote to memory of 2884 2544 be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe zap0525.exe PID 2544 wrote to memory of 2884 2544 be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe zap0525.exe PID 2884 wrote to memory of 5092 2884 zap0525.exe zap1439.exe PID 2884 wrote to memory of 5092 2884 zap0525.exe zap1439.exe PID 2884 wrote to memory of 5092 2884 zap0525.exe zap1439.exe PID 5092 wrote to memory of 4596 5092 zap1439.exe zap4028.exe PID 5092 wrote to memory of 4596 5092 zap1439.exe zap4028.exe PID 5092 wrote to memory of 4596 5092 zap1439.exe zap4028.exe PID 4596 wrote to memory of 4224 4596 zap4028.exe tz7246.exe PID 4596 wrote to memory of 4224 4596 zap4028.exe tz7246.exe PID 4596 wrote to memory of 1660 4596 zap4028.exe v5480An.exe PID 4596 wrote to memory of 1660 4596 zap4028.exe v5480An.exe PID 4596 wrote to memory of 1660 4596 zap4028.exe v5480An.exe PID 5092 wrote to memory of 1080 5092 zap1439.exe w70yl39.exe PID 5092 wrote to memory of 1080 5092 zap1439.exe w70yl39.exe PID 5092 wrote to memory of 1080 5092 zap1439.exe w70yl39.exe PID 2884 wrote to memory of 3416 2884 zap0525.exe xfYsu33.exe PID 2884 wrote to memory of 3416 2884 zap0525.exe xfYsu33.exe PID 2884 wrote to memory of 3416 2884 zap0525.exe xfYsu33.exe PID 2544 wrote to memory of 4100 2544 be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe y43Gy60.exe PID 2544 wrote to memory of 4100 2544 be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe y43Gy60.exe PID 2544 wrote to memory of 4100 2544 be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe y43Gy60.exe PID 4100 wrote to memory of 3984 4100 y43Gy60.exe legenda.exe PID 4100 wrote to memory of 3984 4100 y43Gy60.exe legenda.exe PID 4100 wrote to memory of 3984 4100 y43Gy60.exe legenda.exe PID 3984 wrote to memory of 1000 3984 legenda.exe schtasks.exe PID 3984 wrote to memory of 1000 3984 legenda.exe schtasks.exe PID 3984 wrote to memory of 1000 3984 legenda.exe schtasks.exe PID 3984 wrote to memory of 1568 3984 legenda.exe cmd.exe PID 3984 wrote to memory of 1568 3984 legenda.exe cmd.exe PID 3984 wrote to memory of 1568 3984 legenda.exe cmd.exe PID 1568 wrote to memory of 5080 1568 cmd.exe cmd.exe PID 1568 wrote to memory of 5080 1568 cmd.exe cmd.exe PID 1568 wrote to memory of 5080 1568 cmd.exe cmd.exe PID 1568 wrote to memory of 8 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 8 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 8 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 3952 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 3952 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 3952 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 5104 1568 cmd.exe cmd.exe PID 1568 wrote to memory of 5104 1568 cmd.exe cmd.exe PID 1568 wrote to memory of 5104 1568 cmd.exe cmd.exe PID 1568 wrote to memory of 4276 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 4276 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 4276 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 4288 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 4288 1568 cmd.exe cacls.exe PID 1568 wrote to memory of 4288 1568 cmd.exe cacls.exe PID 3984 wrote to memory of 4332 3984 legenda.exe Nasalized.exe PID 3984 wrote to memory of 4332 3984 legenda.exe Nasalized.exe PID 3984 wrote to memory of 4332 3984 legenda.exe Nasalized.exe PID 4332 wrote to memory of 4888 4332 Nasalized.exe Nasalized.exe PID 4332 wrote to memory of 4888 4332 Nasalized.exe Nasalized.exe PID 4332 wrote to memory of 4888 4332 Nasalized.exe Nasalized.exe PID 3984 wrote to memory of 4896 3984 legenda.exe 76783.exe PID 3984 wrote to memory of 4896 3984 legenda.exe 76783.exe PID 3984 wrote to memory of 4896 3984 legenda.exe 76783.exe PID 3984 wrote to memory of 1788 3984 legenda.exe Blaubok.exe PID 3984 wrote to memory of 1788 3984 legenda.exe Blaubok.exe PID 3984 wrote to memory of 1788 3984 legenda.exe Blaubok.exe PID 1788 wrote to memory of 824 1788 Blaubok.exe Blaubok.exe PID 1788 wrote to memory of 824 1788 Blaubok.exe Blaubok.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe"C:\Users\Admin\AppData\Local\Temp\be05af909a3883a0cd6369cf796ff58e47b19da94e8b7b5698010c0ba506064c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0525.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0525.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1439.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1439.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4028.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4028.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7246.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7246.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5480An.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5480An.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w70yl39.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w70yl39.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xfYsu33.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xfYsu33.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y43Gy60.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y43Gy60.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exe"C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeC:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeC:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exe"C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile7⤵
-
C:\Windows\system32\findstr.exefindstr All7⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe"C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeC:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeC:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\6f95d8ce1a884419d38611d38a18d36f\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Blaubok.exe.logFilesize
1KB
MD58268d0ebb3b023f56d9a27f3933f124f
SHA1def43e831ca0fcbc1df8a1e11a41fe3ea1734f3b
SHA2562fdfee92c5ce81220a0b66cf0ec1411c923d48ae89232406c237e1bc5204392d
SHA512c61c2f8df84e4bbcb6f871befd4dde44188cf106c4af91a56b33a45692b83d1c52a953477f14f4239726b66ecab66842e910c2996631137355a4aba4ea793c97
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Nasalized.exe.logFilesize
1KB
MD5be1788135df70eb012f684bc8237162a
SHA1b2e0403661c14563fd48d8bb0d41ae2bcfbf3d36
SHA25688138ab6e758402a1a8c6c0249d7b8df1c1c47c5f9363b870cd4c23a45806506
SHA5121a7c633e2492066b1dae1bd90402e1345397dba876e955400c84eda6dfde0894b098487235ee5d096aae6cfc66cdefcf649c6484b669bcdbc85059ed9e8ca2a2
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\30614e50-966e-4de5-bf92-f0133a8d850aFilesize
92KB
MD5e93f499f52c3bc7e456a1b5978fc05d5
SHA17deaa85ec9fb9401f2010bb0a893635d9a7e02bd
SHA2568405cf0dbae6930f4add6b7354f71d815919211f8be724292f26e028253e94d2
SHA5122aa3d1573cc52a1107a9b31fdce074e325130a64e5faa282c7c6b2ca88646013106e39d357710deb90c253e885479ea512d04b2e162a936c58c1e40812af9b31
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y43Gy60.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y43Gy60.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0525.exeFilesize
858KB
MD5fa75887fa30f3ed5c297a6b35562467f
SHA18eff9064385dcb596b3e2ed01bc3dcbf2a0ed548
SHA256851c74aecad2bd5ca88a792e4783cdd52f7ae4296cae1760d3a3f76d59a34ef8
SHA51261b42188b36092c626445f12f9d6b146bba1ce492dbfc66c93816eb9ed7b9b01f2df7a907fa326e0dd99a7e9c3200c717f14f7e4392374dd49bacaf39fc7cb38
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0525.exeFilesize
858KB
MD5fa75887fa30f3ed5c297a6b35562467f
SHA18eff9064385dcb596b3e2ed01bc3dcbf2a0ed548
SHA256851c74aecad2bd5ca88a792e4783cdd52f7ae4296cae1760d3a3f76d59a34ef8
SHA51261b42188b36092c626445f12f9d6b146bba1ce492dbfc66c93816eb9ed7b9b01f2df7a907fa326e0dd99a7e9c3200c717f14f7e4392374dd49bacaf39fc7cb38
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xfYsu33.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xfYsu33.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1439.exeFilesize
716KB
MD58be00928b38ac434728b4a7cf3128fe8
SHA1fa556d50ff153cbde528371616e206cc9de25dd2
SHA256a9047713c0d6ac0771027d6a41186cb24352e7981d94d5ca48ba13f3af4b2ce8
SHA512bd5eaea9c51f71c846d9ba1463e5aebd9c922b6dd64ef41268bc908b54845bf4f9780fe6b69b4bbff6e2560814d613c5e3f645c150720f81e7dfc6fb465fdf3c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1439.exeFilesize
716KB
MD58be00928b38ac434728b4a7cf3128fe8
SHA1fa556d50ff153cbde528371616e206cc9de25dd2
SHA256a9047713c0d6ac0771027d6a41186cb24352e7981d94d5ca48ba13f3af4b2ce8
SHA512bd5eaea9c51f71c846d9ba1463e5aebd9c922b6dd64ef41268bc908b54845bf4f9780fe6b69b4bbff6e2560814d613c5e3f645c150720f81e7dfc6fb465fdf3c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w70yl39.exeFilesize
386KB
MD5e540f5d0df6541319dab4707ad4291ec
SHA10b510b102b20d9336ca7a6c8dfa62d70be90e449
SHA256a6301b28982b8cf0e55e8f6f007435b9399128716b9bf14b84460e703fa893a4
SHA5127ea5b000e72aa4287eb0ce1ce8a7e54fa2aaf0e7f6547efede3f362c49a4489f1ade3b35c608902543d74f292da1554a17b4c1db43c86acbe4d7804992169b2a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w70yl39.exeFilesize
386KB
MD5e540f5d0df6541319dab4707ad4291ec
SHA10b510b102b20d9336ca7a6c8dfa62d70be90e449
SHA256a6301b28982b8cf0e55e8f6f007435b9399128716b9bf14b84460e703fa893a4
SHA5127ea5b000e72aa4287eb0ce1ce8a7e54fa2aaf0e7f6547efede3f362c49a4489f1ade3b35c608902543d74f292da1554a17b4c1db43c86acbe4d7804992169b2a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4028.exeFilesize
354KB
MD5256fec7b349209a82f3203963daf1579
SHA1ede6f600b3bc7f32f16b87c6eefedd3c8b57957e
SHA256a4c90445c2c13114f1d3678eee1393c129af9a7603634dd147fc8f97ad8e4dd7
SHA512457a507f1262c78df18ce82ab5e10c580b6bf56ae69cd17914ade2be08cd3f6d543eba6be039f3518b6f715ed5cf477a0de71d9de8d962e3bd8750e1de02ad98
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4028.exeFilesize
354KB
MD5256fec7b349209a82f3203963daf1579
SHA1ede6f600b3bc7f32f16b87c6eefedd3c8b57957e
SHA256a4c90445c2c13114f1d3678eee1393c129af9a7603634dd147fc8f97ad8e4dd7
SHA512457a507f1262c78df18ce82ab5e10c580b6bf56ae69cd17914ade2be08cd3f6d543eba6be039f3518b6f715ed5cf477a0de71d9de8d962e3bd8750e1de02ad98
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7246.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7246.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5480An.exeFilesize
328KB
MD54b39641cace489eb94bb387c5a695338
SHA123a5d1323f08bd168810609b5d3b8b06a6e728c4
SHA2569f6bb2f0f9fa4e2aebfd2549415db407385e46c76908bf596ff45b00c1b67bb2
SHA5120dbd9048a8f7b46490a996484b74694a45f5f446bff2d8aa9209e70a4761d988afec590edc08f28452cfc32e0d4f094cf60eb7840bcef3d5d17a8d866018dcd3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5480An.exeFilesize
328KB
MD54b39641cace489eb94bb387c5a695338
SHA123a5d1323f08bd168810609b5d3b8b06a6e728c4
SHA2569f6bb2f0f9fa4e2aebfd2549415db407385e46c76908bf596ff45b00c1b67bb2
SHA5120dbd9048a8f7b46490a996484b74694a45f5f446bff2d8aa9209e70a4761d988afec590edc08f28452cfc32e0d4f094cf60eb7840bcef3d5d17a8d866018dcd3
-
C:\Users\Admin\AppData\Local\Temp\a2a2b34d-ed9b-4140-8c45-31624f26cb9cFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f6b822d3-f7de-40cb-b88f-3ef61579b272Filesize
5.0MB
MD5ca8eb210d9d6f1e6f04db78f76e335ec
SHA1582559e2689a8e351453a06bdd749b35d3e5c3b6
SHA2561f50e4c5cf2f98483208072945f272285c6d5b1581bd446d0fef11db3b3dd3c9
SHA51259a52cec0d4947004a5c6647de07a9b53d2eb65e3d8295d212ae7e8892a552a571bae03e26e75d0da72c560ff5a833c56714f74bc95cfbac0794625c01bae117
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\Browsers\Firefox\Bookmarks.txtFilesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Apps.txtFilesize
888B
MD59c888f396c930446eca7385761cccba3
SHA1c6720523f1c30416e91a07e13be56c14bf53e341
SHA256cfd95a9481b4b04a5063705c2578a19bd49ddbc44bc11ea22e5d5d563ffa6e68
SHA5123459cb46a772736bcdff4eca74d5371e782e03e80f647ee75781ff2c4f77ae6ce2de67de9b4521d4ceaa2c33a3c78e98a889c3522212bbbd67c58dc8d7972293
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Apps.txtFilesize
4KB
MD55c662abcd41d56e9895098b9c4f6908b
SHA19d00abbcbee140db589a13582079dd842e38e09d
SHA256990a64de4c96683b6f54cbba19c0b440f0b083f017ebbab825f927ed078978d9
SHA5126ae8816026becf7a72bab14f77c6fe68e82193d46ff7529cbb86c621468bd42f3184eea200faf7c69a42c9f40ae7425aaef3f86a3449ee7ef89da141792937b4
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Process.txtFilesize
1KB
MD582e34cd397b0864020a16d401c560b46
SHA1bd3adda0b46cfc6fb9f7b848fbffbb79e72558e4
SHA2564a8905334b6bec87f84969a94468926b67f45f36439c5beccd257b16b171a8b0
SHA51245e2b180bb63427abe20549b5527df9d41b9258a020f37b378e2f114053bdc88ff1fa64c45ea98f0fbd4bae47e3912e5de2df10429720809f2675af1bbe9f7d7
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Process.txtFilesize
1KB
MD56ca92e7ffcd77824174c5becc849a198
SHA111f4a2f5ce5c7b9325ba6efaba12a74754359a99
SHA2567dbeb0be681a9262123690f35c7324101027a2c085da9fb105d7163ca398db26
SHA512624bfc5c674fa9f80b24df7f39a5649c230396da5f57fbef5e5e8c1d52e27571614cbb5ce63ab5c39b0344c50e165287cda58808d3223a27f158d1572af7fb1b
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Process.txtFilesize
2KB
MD5887904833fd46f5fec9b24f40c5713f6
SHA1370b524a8f6aaaa690fd1e4d6bae09767fb65619
SHA256ed57de0058522ab1cefef4f958ff2251b6a6add2c5351017f0ed40ca165cab7e
SHA512a19b4effe8c8a12f93cf4e71a03ca12598879c3e9bebcfd3c7479d341fe8fa312d4a245deec6375e20ca55f634b056ce7f4279a60b9a4be435bebc98bcb89fa3
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Process.txtFilesize
2KB
MD552c148f4e51ba13c2b905c6e5bb5a07f
SHA1bb8d6045921d98cccae0dc36f17e1a9af9916d9b
SHA256456c7f9c752aaa795c441fce50ca120d0db152031bbad30e3dd7d94f7fbf3a36
SHA512fad63dc88ef4187c980ed6114323ec26411ec74ef8ba3ab2d0d3d42d801fc81c81327784a6c10bf564b299a343902a1a14b62e467bca43b2dff9f7914754da00
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Process.txtFilesize
3KB
MD5ea0a73610c546d25f8b8392d480ddc97
SHA1a982aa91c35e3c3bea9d601c7c9331184b6584cd
SHA256aa8935ca5f06219086cbd056a8647c510f745292f4534234eb0924d951e4f066
SHA5124989ad956316b480ee2d68166a178152ecfdadbc13c6669aff10467a8276a12b88d8018ca1ac93f95470fb75e65ca67204865480abfba716e70b1095144ba19f
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Process.txtFilesize
3KB
MD5cb53e9ed27b0bd9aa1738c36c604d425
SHA19fa3649028aeea6bdc921d94a5a62a4574f28921
SHA25624d041fd365b4aec24b3e3867f7b5e2b1c93f248f223037642793273a5b6f64b
SHA51204c4fa544c9c23f397cbb342612ea5bc4f3f3789788dc0a622cf2fdf3bf093d17d0671b9eeec87120f252d0fe016538ffa88be3b0d9d12fb64481ec4cc352bd9
-
C:\Users\Admin\AppData\Roaming\BDDTPJRDFNWBIJUTSD.Admin\System\Process.txtFilesize
4KB
MD5b43175646e49f4444338138219259a88
SHA136ab56f9a856bb599e30de2152a6a96587e2ccf8
SHA256e0a15fed8e7340760de3cd5222e1f726ef26ef04a91c186d78fbdf46bfeabfdd
SHA5129e941808fd1a6d76c0bc432f5c47285429fbe491d396d37ed2e002be4f1ab46040fb0e05cda8651abec8f6e572c7cc51d8886b5c443da409fd3690e4da163cb5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
\Users\Admin\AppData\Local\Temp\Costura\4993FC383A80402228FA13C13CB7F2C2\64\sqlite.interop.dllFilesize
1.6MB
MD50ec8d85d10ff52827930b1cec64a0933
SHA190c6d01aefa10f5488411c84553ed44131372c58
SHA2567f214dfccf659d8e4c0a08aa6772b2e540f20987aab2b26b6baad2d201554bec
SHA512650257cf683d030bfa6a8da7065409b47e994ae86ba96934a1d977c51a48b2d80d8e1bc8a7979deb089ba243cef13f9e2707837f9803d691b51c14c07aff3375
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
memory/660-1207-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/660-1208-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/660-1219-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/660-1209-0x00000000056E0000-0x000000000572B000-memory.dmpFilesize
300KB
-
memory/1080-208-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-228-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-234-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-1113-0x0000000007DD0000-0x00000000083D6000-memory.dmpFilesize
6.0MB
-
memory/1080-1114-0x00000000077C0000-0x00000000078CA000-memory.dmpFilesize
1.0MB
-
memory/1080-1115-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/1080-1116-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/1080-1117-0x0000000007260000-0x000000000729E000-memory.dmpFilesize
248KB
-
memory/1080-1118-0x00000000079D0000-0x0000000007A1B000-memory.dmpFilesize
300KB
-
memory/1080-1120-0x0000000007B60000-0x0000000007BC6000-memory.dmpFilesize
408KB
-
memory/1080-1121-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/1080-1122-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/1080-1123-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/1080-1124-0x0000000008830000-0x00000000088C2000-memory.dmpFilesize
584KB
-
memory/1080-1125-0x00000000088D0000-0x0000000008946000-memory.dmpFilesize
472KB
-
memory/1080-206-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-1127-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/1080-1128-0x0000000009DC0000-0x0000000009F82000-memory.dmpFilesize
1.8MB
-
memory/1080-1129-0x0000000009F90000-0x000000000A4BC000-memory.dmpFilesize
5.2MB
-
memory/1080-226-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-224-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/1080-202-0x00000000071C0000-0x0000000007204000-memory.dmpFilesize
272KB
-
memory/1080-203-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-230-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-225-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/1080-222-0x00000000072B0000-0x00000000072C0000-memory.dmpFilesize
64KB
-
memory/1080-221-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-220-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/1080-218-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-216-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-214-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-212-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-204-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-201-0x0000000004C80000-0x0000000004CC6000-memory.dmpFilesize
280KB
-
memory/1080-210-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-232-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-1126-0x0000000008970000-0x00000000089C0000-memory.dmpFilesize
320KB
-
memory/1080-238-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1080-236-0x00000000071C0000-0x00000000071FF000-memory.dmpFilesize
252KB
-
memory/1548-1214-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1548-1215-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/1548-1220-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/1660-170-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-190-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-163-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-164-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-166-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-182-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-168-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-161-0x00000000071F0000-0x0000000007200000-memory.dmpFilesize
64KB
-
memory/1660-162-0x00000000071F0000-0x0000000007200000-memory.dmpFilesize
64KB
-
memory/1660-172-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-196-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/1660-194-0x00000000071F0000-0x0000000007200000-memory.dmpFilesize
64KB
-
memory/1660-193-0x00000000071F0000-0x0000000007200000-memory.dmpFilesize
64KB
-
memory/1660-192-0x00000000071F0000-0x0000000007200000-memory.dmpFilesize
64KB
-
memory/1660-191-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/1660-184-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-160-0x00000000071F0000-0x0000000007200000-memory.dmpFilesize
64KB
-
memory/1660-186-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-158-0x0000000004B10000-0x0000000004B28000-memory.dmpFilesize
96KB
-
memory/1660-188-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-159-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/1660-174-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-176-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-178-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1660-157-0x0000000007200000-0x00000000076FE000-memory.dmpFilesize
5.0MB
-
memory/1660-156-0x00000000048B0000-0x00000000048CA000-memory.dmpFilesize
104KB
-
memory/1660-180-0x0000000004B10000-0x0000000004B22000-memory.dmpFilesize
72KB
-
memory/1788-1193-0x0000000000220000-0x0000000000306000-memory.dmpFilesize
920KB
-
memory/1788-1196-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/3100-1227-0x0000000000770000-0x00000000007B0000-memory.dmpFilesize
256KB
-
memory/3100-1228-0x0000000002820000-0x0000000002826000-memory.dmpFilesize
24KB
-
memory/3100-1229-0x0000000002850000-0x0000000002882000-memory.dmpFilesize
200KB
-
memory/3100-1230-0x0000000002830000-0x0000000002836000-memory.dmpFilesize
24KB
-
memory/3416-1135-0x0000000000DB0000-0x0000000000DE2000-memory.dmpFilesize
200KB
-
memory/3416-1136-0x00000000057F0000-0x000000000583B000-memory.dmpFilesize
300KB
-
memory/3416-1137-0x0000000005610000-0x0000000005620000-memory.dmpFilesize
64KB
-
memory/4224-149-0x0000000000480000-0x000000000048A000-memory.dmpFilesize
40KB
-
memory/4224-151-0x0000000000AA0000-0x0000000000B29000-memory.dmpFilesize
548KB
-
memory/4332-1172-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/4332-1161-0x0000000000670000-0x0000000000756000-memory.dmpFilesize
920KB
-
memory/4332-1162-0x0000000005140000-0x0000000005490000-memory.dmpFilesize
3.3MB
-
memory/4896-1200-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/4896-1194-0x0000000005660000-0x00000000056AA000-memory.dmpFilesize
296KB
-
memory/4896-1192-0x0000000004D50000-0x0000000004DEC000-memory.dmpFilesize
624KB
-
memory/4896-1178-0x0000000005A80000-0x0000000005FE2000-memory.dmpFilesize
5.4MB
-
memory/4896-1177-0x0000000000AB0000-0x0000000000BF0000-memory.dmpFilesize
1.2MB
-
memory/4896-1195-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/4896-1197-0x0000000004FF0000-0x0000000005008000-memory.dmpFilesize
96KB
-
memory/4896-1198-0x0000000007E10000-0x0000000007E1A000-memory.dmpFilesize
40KB
-
memory/4896-1222-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/4896-1216-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/4896-1217-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/4896-1218-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB