Analysis
-
max time kernel
126s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
26-03-2023 23:07
Static task
static1
General
-
Target
885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe
-
Size
1.0MB
-
MD5
e99ed5cc4506d117cd2502f7b56b779b
-
SHA1
c2a68ef6f451a8c20ef97d35c3abf76224f5b555
-
SHA256
885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac
-
SHA512
8788da6b61231423ea3629cb1589c7513c67b4f08e2499522d4486f211778964e639cb8e7df824b9623eade30e4c0b35fefaaee9d78700f59f94426091595b70
-
SSDEEP
24576:qybY9AmZ1gVXITtKI3fq0RO6f3akDuDYXOIyxkm9yD:xbYSO1TtKZ0Rz8DyOIyXo
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Extracted
redline
fort
193.233.20.33:4125
-
auth_value
5ea5673154a804d8c80f565f7276f720
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
aurora
212.87.204.93:8081
Signatures
-
Processes:
tz5511.exev2528Rk.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz5511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz5511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz5511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v2528Rk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v2528Rk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz5511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz5511.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v2528Rk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v2528Rk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v2528Rk.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1408-200-0x0000000004C50000-0x0000000004C96000-memory.dmp family_redline behavioral1/memory/1408-203-0x0000000007130000-0x0000000007174000-memory.dmp family_redline behavioral1/memory/1408-204-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-205-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-207-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-209-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-211-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-213-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-215-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-217-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-219-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-221-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-223-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-225-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-227-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-229-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-231-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-233-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-235-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-237-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1408-1125-0x00000000072D0000-0x00000000072E0000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
zap9280.exezap1813.exezap8176.exetz5511.exev2528Rk.exew19YZ19.exexbNPt89.exey15Xi45.exelegenda.exe2023.exelegenda.exelegenda.exepid process 2256 zap9280.exe 2600 zap1813.exe 2648 zap8176.exe 3100 tz5511.exe 5080 v2528Rk.exe 1408 w19YZ19.exe 4804 xbNPt89.exe 4896 y15Xi45.exe 728 legenda.exe 3956 2023.exe 284 legenda.exe 4284 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 924 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz5511.exev2528Rk.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz5511.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v2528Rk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v2528Rk.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap9280.exezap1813.exezap8176.exe885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap9280.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap9280.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap1813.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap1813.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap8176.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap8176.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
tz5511.exev2528Rk.exew19YZ19.exexbNPt89.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3100 tz5511.exe 3100 tz5511.exe 5080 v2528Rk.exe 5080 v2528Rk.exe 1408 w19YZ19.exe 1408 w19YZ19.exe 4804 xbNPt89.exe 4804 xbNPt89.exe 1524 powershell.exe 1524 powershell.exe 1524 powershell.exe 1836 powershell.exe 1836 powershell.exe 1836 powershell.exe 2700 powershell.exe 2700 powershell.exe 2700 powershell.exe 3644 powershell.exe 3644 powershell.exe 3644 powershell.exe 4536 powershell.exe 4536 powershell.exe 4536 powershell.exe 2012 powershell.exe 2012 powershell.exe 2012 powershell.exe 3196 powershell.exe 3196 powershell.exe 3196 powershell.exe 3484 powershell.exe 3484 powershell.exe 3484 powershell.exe 1132 powershell.exe 1132 powershell.exe 1132 powershell.exe 4692 powershell.exe 4692 powershell.exe 4692 powershell.exe 3988 powershell.exe 3988 powershell.exe 3988 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tz5511.exev2528Rk.exew19YZ19.exexbNPt89.exeWMIC.exewmic.exedescription pid process Token: SeDebugPrivilege 3100 tz5511.exe Token: SeDebugPrivilege 5080 v2528Rk.exe Token: SeDebugPrivilege 1408 w19YZ19.exe Token: SeDebugPrivilege 4804 xbNPt89.exe Token: SeIncreaseQuotaPrivilege 5048 WMIC.exe Token: SeSecurityPrivilege 5048 WMIC.exe Token: SeTakeOwnershipPrivilege 5048 WMIC.exe Token: SeLoadDriverPrivilege 5048 WMIC.exe Token: SeSystemProfilePrivilege 5048 WMIC.exe Token: SeSystemtimePrivilege 5048 WMIC.exe Token: SeProfSingleProcessPrivilege 5048 WMIC.exe Token: SeIncBasePriorityPrivilege 5048 WMIC.exe Token: SeCreatePagefilePrivilege 5048 WMIC.exe Token: SeBackupPrivilege 5048 WMIC.exe Token: SeRestorePrivilege 5048 WMIC.exe Token: SeShutdownPrivilege 5048 WMIC.exe Token: SeDebugPrivilege 5048 WMIC.exe Token: SeSystemEnvironmentPrivilege 5048 WMIC.exe Token: SeRemoteShutdownPrivilege 5048 WMIC.exe Token: SeUndockPrivilege 5048 WMIC.exe Token: SeManageVolumePrivilege 5048 WMIC.exe Token: 33 5048 WMIC.exe Token: 34 5048 WMIC.exe Token: 35 5048 WMIC.exe Token: 36 5048 WMIC.exe Token: SeIncreaseQuotaPrivilege 5048 WMIC.exe Token: SeSecurityPrivilege 5048 WMIC.exe Token: SeTakeOwnershipPrivilege 5048 WMIC.exe Token: SeLoadDriverPrivilege 5048 WMIC.exe Token: SeSystemProfilePrivilege 5048 WMIC.exe Token: SeSystemtimePrivilege 5048 WMIC.exe Token: SeProfSingleProcessPrivilege 5048 WMIC.exe Token: SeIncBasePriorityPrivilege 5048 WMIC.exe Token: SeCreatePagefilePrivilege 5048 WMIC.exe Token: SeBackupPrivilege 5048 WMIC.exe Token: SeRestorePrivilege 5048 WMIC.exe Token: SeShutdownPrivilege 5048 WMIC.exe Token: SeDebugPrivilege 5048 WMIC.exe Token: SeSystemEnvironmentPrivilege 5048 WMIC.exe Token: SeRemoteShutdownPrivilege 5048 WMIC.exe Token: SeUndockPrivilege 5048 WMIC.exe Token: SeManageVolumePrivilege 5048 WMIC.exe Token: 33 5048 WMIC.exe Token: 34 5048 WMIC.exe Token: 35 5048 WMIC.exe Token: 36 5048 WMIC.exe Token: SeIncreaseQuotaPrivilege 4828 wmic.exe Token: SeSecurityPrivilege 4828 wmic.exe Token: SeTakeOwnershipPrivilege 4828 wmic.exe Token: SeLoadDriverPrivilege 4828 wmic.exe Token: SeSystemProfilePrivilege 4828 wmic.exe Token: SeSystemtimePrivilege 4828 wmic.exe Token: SeProfSingleProcessPrivilege 4828 wmic.exe Token: SeIncBasePriorityPrivilege 4828 wmic.exe Token: SeCreatePagefilePrivilege 4828 wmic.exe Token: SeBackupPrivilege 4828 wmic.exe Token: SeRestorePrivilege 4828 wmic.exe Token: SeShutdownPrivilege 4828 wmic.exe Token: SeDebugPrivilege 4828 wmic.exe Token: SeSystemEnvironmentPrivilege 4828 wmic.exe Token: SeRemoteShutdownPrivilege 4828 wmic.exe Token: SeUndockPrivilege 4828 wmic.exe Token: SeManageVolumePrivilege 4828 wmic.exe Token: 33 4828 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exezap9280.exezap1813.exezap8176.exey15Xi45.exelegenda.execmd.exe2023.execmd.exedescription pid process target process PID 2060 wrote to memory of 2256 2060 885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe zap9280.exe PID 2060 wrote to memory of 2256 2060 885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe zap9280.exe PID 2060 wrote to memory of 2256 2060 885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe zap9280.exe PID 2256 wrote to memory of 2600 2256 zap9280.exe zap1813.exe PID 2256 wrote to memory of 2600 2256 zap9280.exe zap1813.exe PID 2256 wrote to memory of 2600 2256 zap9280.exe zap1813.exe PID 2600 wrote to memory of 2648 2600 zap1813.exe zap8176.exe PID 2600 wrote to memory of 2648 2600 zap1813.exe zap8176.exe PID 2600 wrote to memory of 2648 2600 zap1813.exe zap8176.exe PID 2648 wrote to memory of 3100 2648 zap8176.exe tz5511.exe PID 2648 wrote to memory of 3100 2648 zap8176.exe tz5511.exe PID 2648 wrote to memory of 5080 2648 zap8176.exe v2528Rk.exe PID 2648 wrote to memory of 5080 2648 zap8176.exe v2528Rk.exe PID 2648 wrote to memory of 5080 2648 zap8176.exe v2528Rk.exe PID 2600 wrote to memory of 1408 2600 zap1813.exe w19YZ19.exe PID 2600 wrote to memory of 1408 2600 zap1813.exe w19YZ19.exe PID 2600 wrote to memory of 1408 2600 zap1813.exe w19YZ19.exe PID 2256 wrote to memory of 4804 2256 zap9280.exe xbNPt89.exe PID 2256 wrote to memory of 4804 2256 zap9280.exe xbNPt89.exe PID 2256 wrote to memory of 4804 2256 zap9280.exe xbNPt89.exe PID 2060 wrote to memory of 4896 2060 885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe y15Xi45.exe PID 2060 wrote to memory of 4896 2060 885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe y15Xi45.exe PID 2060 wrote to memory of 4896 2060 885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe y15Xi45.exe PID 4896 wrote to memory of 728 4896 y15Xi45.exe legenda.exe PID 4896 wrote to memory of 728 4896 y15Xi45.exe legenda.exe PID 4896 wrote to memory of 728 4896 y15Xi45.exe legenda.exe PID 728 wrote to memory of 3884 728 legenda.exe schtasks.exe PID 728 wrote to memory of 3884 728 legenda.exe schtasks.exe PID 728 wrote to memory of 3884 728 legenda.exe schtasks.exe PID 728 wrote to memory of 3784 728 legenda.exe cmd.exe PID 728 wrote to memory of 3784 728 legenda.exe cmd.exe PID 728 wrote to memory of 3784 728 legenda.exe cmd.exe PID 3784 wrote to memory of 4344 3784 cmd.exe cmd.exe PID 3784 wrote to memory of 4344 3784 cmd.exe cmd.exe PID 3784 wrote to memory of 4344 3784 cmd.exe cmd.exe PID 3784 wrote to memory of 4368 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 4368 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 4368 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 5044 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 5044 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 5044 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 3344 3784 cmd.exe cmd.exe PID 3784 wrote to memory of 3344 3784 cmd.exe cmd.exe PID 3784 wrote to memory of 3344 3784 cmd.exe cmd.exe PID 3784 wrote to memory of 4372 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 4372 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 4372 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 3848 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 3848 3784 cmd.exe cacls.exe PID 3784 wrote to memory of 3848 3784 cmd.exe cacls.exe PID 728 wrote to memory of 3956 728 legenda.exe 2023.exe PID 728 wrote to memory of 3956 728 legenda.exe 2023.exe PID 728 wrote to memory of 3956 728 legenda.exe 2023.exe PID 3956 wrote to memory of 5072 3956 2023.exe cmd.exe PID 3956 wrote to memory of 5072 3956 2023.exe cmd.exe PID 3956 wrote to memory of 5072 3956 2023.exe cmd.exe PID 5072 wrote to memory of 5048 5072 cmd.exe WMIC.exe PID 5072 wrote to memory of 5048 5072 cmd.exe WMIC.exe PID 5072 wrote to memory of 5048 5072 cmd.exe WMIC.exe PID 3956 wrote to memory of 4828 3956 2023.exe wmic.exe PID 3956 wrote to memory of 4828 3956 2023.exe wmic.exe PID 3956 wrote to memory of 4828 3956 2023.exe wmic.exe PID 3956 wrote to memory of 3276 3956 2023.exe cmd.exe PID 3956 wrote to memory of 3276 3956 2023.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe"C:\Users\Admin\AppData\Local\Temp\885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9280.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9280.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1813.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1813.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8176.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8176.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5511.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5511.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2528Rk.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2528Rk.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19YZ19.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19YZ19.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbNPt89.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbNPt89.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15Xi45.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15Xi45.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Roaming\1000177000\2023.exe"C:\Users\Admin\AppData\Roaming\1000177000\2023.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wmic csproduct get uuid"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd "/c " systeminfo5⤵
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo6⤵
- Gathers system information
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History\" \"C:\Users\Admin\AppData\Local\Temp\XVlBzgbaiC\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHctcuAx\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\hxKQFDaFpL\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFfRsWxP\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\LDnJObCsNV\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQleQYh\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\YzRyWJjPjz\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\pfRFEgmotaFetHs\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\bZRjxAwnwe\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcEkXBA\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\" \"C:\Users\Admin\AppData\Local\Temp\kjQZLCtTMt\""5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD56bf0e5945fb9da68e1b03bdaed5f6f8d
SHA1eed3802c8e4abe3b327c100c99c53d3bbcf8a33d
SHA256dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1
SHA512977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5d95f3e0861f792eadd03de3c547c1022
SHA1c5448f4a7d0aeb8e156db6af683bbf59b49971dc
SHA256cb4788e1490f60bde617a458a3f1246f17cd4d1e825ab4d9da2e277a2784152d
SHA512506bdaa7d37bdc49ff669c8aef4bf916aa3ce9786bd8ea7905d0ca17a78743303b98ac4e949646acf4ef640ffb6a045b39d2135b0da41058a64ab010f92fe522
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5d20b3b776cf7098e7ce5d0070e122a3b
SHA1ac2180478a17b2e46f145f4767873dcf96fe255e
SHA256bc143225f3853dd1a1473e0713302a794a15600c869e577e2998f01e050aae80
SHA512cf8b68c2dcdc2205e54e083ef0da4da6e74072c0d4d76e149ca166cc6280f59734321ca54fe98d41a066026f89225f912f91d9299a0b6ae7a5433c3092249ca2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5be192b92516d8e6209addc51478188f9
SHA1c7f518e11f092e258e7a59cfdaf404c526fb6ca5
SHA256f54a15bfaa0fff013359edfcc2c0d0e6af948900d4a53be43aa1b8eda955a84b
SHA512355ec2c9559a2f8ac7d4742f7b991d91dd7061bba54f8304227cb2845497ca01ea3e148586795c7f2f0ff167bef2d714e2b65ae4362dbad4ba1b130d6611dcc5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD55a6f149be92de294e78fec8aea00bf41
SHA12e086f7160ce0707c08c24c29bc9cad7dd1d503c
SHA256423102bd3ad05a4ffbf337a30e4b0aca4baa0014b6cf571865147fbb3e53c4db
SHA512e67973ee77ef16b6f806ad0eaca09c9618d46c39e02f1e6c73004810123b74eef9405d12e683b6aded570ff80e3aa8449352bc04c1b9a2ff042376cccac3f150
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5e1947c20cb6a2c44fea5ce5172369a2e
SHA1ba781cca30157d104b1cdcded74272e273fc3446
SHA25618316d91f8106ae198399fd54afa8756305abfc2cb0cf2dfe7e381c3d6180df7
SHA512877fa031b59b677e20eb00a79c8576a49373ce5e443ec30340585cf046964d7f4153f875ddc80a1f2a3558cc6c076250619c168fd462a7d0f3b376e5493d5ada
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD501da9fc8fb16bb2e0ab529d01fa1c51e
SHA19773556724d4b384b1db9c91e04bef79ec278cc5
SHA256fbcc172c04f76839c95e08a2ad01e3f77dd71edb5583fef3f62e5445f744d058
SHA5124077b8a037e3f448f59b8562fd53eb69b79793b9cb86a29a90a85655259d9cd61dfa2c354a1d3c4046b05f809b3600a90de9d21f9dc1c81c8147b773447bfbea
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD52ad19b7d46aa0eb2b7bcc032fdb9ee0e
SHA169b80a2ba550541032324df9aaa05d0afca1fc28
SHA256d0323a6e04452dd208533bf456cd47e103aa7223a06209936960f830f24feb13
SHA5128e54d83a41cc55b903a06d6effe7afae295dd808a2af319c9870cdaee7842114745ef28b4ae196126a1f8216dfef5775e1cdf90cbc21631b3f9c6c0319a8aea1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD54a6865237e6a0bcd661ad4bc4d36660d
SHA17db818d8657fea702cec80536672b3139e45836d
SHA256401519d544a05b93c815ae28327d2cf829696fa27eb5b796f61e402863f72382
SHA512617d12e1f374c5bf50b38aeadc0e79d33bf6124f81db4d4c5cc950b809a29f50cfefe4cfaf4db28b412e22d7179f68159962123b143083ac6c02ff48f67e61aa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD53960b201734d11576262462c1182e501
SHA1d1606dfb6d0544d99dabb1561dc4f3be8a3ea5a5
SHA25638f3fa9ca211feb44909e3eb95bc8d19e4f2ed82960417d51767d5fedc32f0b0
SHA51295e7c1c28adcc7400f0525a014a71a5e433d8a30db2383cfddd798e46dc06824edc4894da68306571c5e40b9130a2812e5e9c638f3193747b113a1a2a8700970
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5fa347b02b4555234883c9635d7eb9b13
SHA171af7945a9ce2c6bfbf09bd94144c3de155df629
SHA25643551664273233dffb0c0d6455b37a6acbaa0a16689adbceec7e9e9045370be4
SHA512c0cf913a4c0dd30d66743d5f59ace39d0f9ca6124f6279b083238e920e07d41bd1d5fcef36b115f4a75d22575cc57c9cece0021dbbbcdb2310f72dbd627cd848
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15Xi45.exeFilesize
236KB
MD55d74535be34293a2bf02c28b65e63b42
SHA1cd7e2a60e4ad7f92376349db6bea31d0678dfca3
SHA256d2b2eabe999a3d09d305d25f6614db0ccc138785ab0c9ba4c2d94e0c6ace6c25
SHA512de3480a8364d0ac483bd84712786e9469690e0de19019a7114ccb26ad81d86ea06c7cd3368dcb69ebe0d06e6dc9ae21a6ec7e475c2652e46da26976a74eb9097
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15Xi45.exeFilesize
236KB
MD55d74535be34293a2bf02c28b65e63b42
SHA1cd7e2a60e4ad7f92376349db6bea31d0678dfca3
SHA256d2b2eabe999a3d09d305d25f6614db0ccc138785ab0c9ba4c2d94e0c6ace6c25
SHA512de3480a8364d0ac483bd84712786e9469690e0de19019a7114ccb26ad81d86ea06c7cd3368dcb69ebe0d06e6dc9ae21a6ec7e475c2652e46da26976a74eb9097
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9280.exeFilesize
846KB
MD51b15052b17fbaf87e431bfdde395f524
SHA105eb6cfa0682b9d6d1616a3fad930465b4d2a415
SHA256013c7d6ccf32303fa3608d56fb682a2232e472f5e86628bfdfc7cae9b122bcfe
SHA512d3d743d3979377f6c119b4a80c2b10db23a908f8196c617430a9808515666e1a3d036d7504d5379e5dbc65df576a80d53f9bc1fa2d0a7f1e46944e6c5bcfad87
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9280.exeFilesize
846KB
MD51b15052b17fbaf87e431bfdde395f524
SHA105eb6cfa0682b9d6d1616a3fad930465b4d2a415
SHA256013c7d6ccf32303fa3608d56fb682a2232e472f5e86628bfdfc7cae9b122bcfe
SHA512d3d743d3979377f6c119b4a80c2b10db23a908f8196c617430a9808515666e1a3d036d7504d5379e5dbc65df576a80d53f9bc1fa2d0a7f1e46944e6c5bcfad87
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbNPt89.exeFilesize
175KB
MD5b71b47b4a247c2cd1cf9c18e86ce9cd6
SHA19cb8022a375229c991307ccd60787e078e61892b
SHA256371ceda002690dd006d196c61af64f08d3c80b32c296f15135f8c434b7781795
SHA5123172f43fff62f2ef502cc4bb87db90d67e9c8890b7608a2f2b32763529656d207921b086e3c4395e369bc7d05073e2cf80c620a8135a55feac2116d90a5fc906
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbNPt89.exeFilesize
175KB
MD5b71b47b4a247c2cd1cf9c18e86ce9cd6
SHA19cb8022a375229c991307ccd60787e078e61892b
SHA256371ceda002690dd006d196c61af64f08d3c80b32c296f15135f8c434b7781795
SHA5123172f43fff62f2ef502cc4bb87db90d67e9c8890b7608a2f2b32763529656d207921b086e3c4395e369bc7d05073e2cf80c620a8135a55feac2116d90a5fc906
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1813.exeFilesize
704KB
MD5fa426c947afc41c4af5642ca4cf1c43f
SHA129a1a84c0f2e317c95d1915811ec1e1018d8e5ee
SHA2567ee663534eb769897240454f14c9488cf371176db22f528c5672a83c1c86973d
SHA512d66080561a98c066067f497dd1ccd5e4e69cb53464fc7220a659037ee1a0f85fb2998a82918abb205fc4bd20854119de0954585b8316669505ccb01a0d8f20f7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1813.exeFilesize
704KB
MD5fa426c947afc41c4af5642ca4cf1c43f
SHA129a1a84c0f2e317c95d1915811ec1e1018d8e5ee
SHA2567ee663534eb769897240454f14c9488cf371176db22f528c5672a83c1c86973d
SHA512d66080561a98c066067f497dd1ccd5e4e69cb53464fc7220a659037ee1a0f85fb2998a82918abb205fc4bd20854119de0954585b8316669505ccb01a0d8f20f7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19YZ19.exeFilesize
379KB
MD56c6d5e6ca5467465ba677f5f27bf1b82
SHA1c72f0caf7fcfcf1187af5a89282c4afe221f4a08
SHA256789b944e1fe0af44062cb55ee58e371d549c010e5d1ebac09b492aa0496f016b
SHA51247a25a50db77431600e4ff2ae6288819fc96feb698e2234b99c5fccf0cf7fa5cd480e034ff2327883f4b8a93c2b9f86faf033cd6f9088fa0cab563a44e17497b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19YZ19.exeFilesize
379KB
MD56c6d5e6ca5467465ba677f5f27bf1b82
SHA1c72f0caf7fcfcf1187af5a89282c4afe221f4a08
SHA256789b944e1fe0af44062cb55ee58e371d549c010e5d1ebac09b492aa0496f016b
SHA51247a25a50db77431600e4ff2ae6288819fc96feb698e2234b99c5fccf0cf7fa5cd480e034ff2327883f4b8a93c2b9f86faf033cd6f9088fa0cab563a44e17497b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8176.exeFilesize
349KB
MD58c4db31ddf7a90e7540334b064508e25
SHA1b6622af4d670db1080d8b681eb0078a7dc94a2e4
SHA256dec2b356ce2187443f75d745a53c5c265c8366e8c65b9fc4b10b0736e6ee3dd6
SHA5126d48f73a3ce27eaf8af08790a8c8fe6e430e5793c75dab3ad27252f9a012bab64dd883a57f6db21f8f655e3cdabd7402821980a9d7e57ce68586da72e9de7e7b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8176.exeFilesize
349KB
MD58c4db31ddf7a90e7540334b064508e25
SHA1b6622af4d670db1080d8b681eb0078a7dc94a2e4
SHA256dec2b356ce2187443f75d745a53c5c265c8366e8c65b9fc4b10b0736e6ee3dd6
SHA5126d48f73a3ce27eaf8af08790a8c8fe6e430e5793c75dab3ad27252f9a012bab64dd883a57f6db21f8f655e3cdabd7402821980a9d7e57ce68586da72e9de7e7b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5511.exeFilesize
12KB
MD54cf9fe78fe40fe24ca1b91b2bb263218
SHA17f5084078f3244c125cf2b532dd92cc804054e2c
SHA256ca1833b0c45c278dfaf0b906c313a2712912bc0558d46e539a88477b96e66ac4
SHA512f7a7891e3efad584d5833e67733e5aa45f0933efd6d6568fcbb6a7f85d366518de80eafdb16c6102cf708349e9dc89e7f19ab366d5b6584fc6930602ee3a0918
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5511.exeFilesize
12KB
MD54cf9fe78fe40fe24ca1b91b2bb263218
SHA17f5084078f3244c125cf2b532dd92cc804054e2c
SHA256ca1833b0c45c278dfaf0b906c313a2712912bc0558d46e539a88477b96e66ac4
SHA512f7a7891e3efad584d5833e67733e5aa45f0933efd6d6568fcbb6a7f85d366518de80eafdb16c6102cf708349e9dc89e7f19ab366d5b6584fc6930602ee3a0918
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2528Rk.exeFilesize
322KB
MD5b22efec815e27b65fcfcb2e8a7404cd6
SHA1b780b0f2ad6b71256c6c064a33f7c6a4d3b235da
SHA256c46c00a2dc4789df17976d731cf0333432ce06fd4eaf78ecec0c5124001fc5e9
SHA51293530dee962fef1063f0d86361dea65107a5a02b20e893446624430ceda48393ee5a6352ba9f11e375a43db59829997d86d4ee6e7deb20218fc9551fc5ffc890
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2528Rk.exeFilesize
322KB
MD5b22efec815e27b65fcfcb2e8a7404cd6
SHA1b780b0f2ad6b71256c6c064a33f7c6a4d3b235da
SHA256c46c00a2dc4789df17976d731cf0333432ce06fd4eaf78ecec0c5124001fc5e9
SHA51293530dee962fef1063f0d86361dea65107a5a02b20e893446624430ceda48393ee5a6352ba9f11e375a43db59829997d86d4ee6e7deb20218fc9551fc5ffc890
-
C:\Users\Admin\AppData\Local\Temp\LDnJObCsNVFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHctcuAxFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFfRsWxPFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
C:\Users\Admin\AppData\Local\Temp\XVlBzgbaiCFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\YzRyWJjPjzFilesize
92KB
MD5e93f499f52c3bc7e456a1b5978fc05d5
SHA17deaa85ec9fb9401f2010bb0a893635d9a7e02bd
SHA2568405cf0dbae6930f4add6b7354f71d815919211f8be724292f26e028253e94d2
SHA5122aa3d1573cc52a1107a9b31fdce074e325130a64e5faa282c7c6b2ca88646013106e39d357710deb90c253e885479ea512d04b2e162a936c58c1e40812af9b31
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wlag34m4.5l0.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\bZRjxAwnweFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
C:\Users\Admin\AppData\Local\Temp\bZRjxAwnweFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
236KB
MD55d74535be34293a2bf02c28b65e63b42
SHA1cd7e2a60e4ad7f92376349db6bea31d0678dfca3
SHA256d2b2eabe999a3d09d305d25f6614db0ccc138785ab0c9ba4c2d94e0c6ace6c25
SHA512de3480a8364d0ac483bd84712786e9469690e0de19019a7114ccb26ad81d86ea06c7cd3368dcb69ebe0d06e6dc9ae21a6ec7e475c2652e46da26976a74eb9097
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
236KB
MD55d74535be34293a2bf02c28b65e63b42
SHA1cd7e2a60e4ad7f92376349db6bea31d0678dfca3
SHA256d2b2eabe999a3d09d305d25f6614db0ccc138785ab0c9ba4c2d94e0c6ace6c25
SHA512de3480a8364d0ac483bd84712786e9469690e0de19019a7114ccb26ad81d86ea06c7cd3368dcb69ebe0d06e6dc9ae21a6ec7e475c2652e46da26976a74eb9097
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
236KB
MD55d74535be34293a2bf02c28b65e63b42
SHA1cd7e2a60e4ad7f92376349db6bea31d0678dfca3
SHA256d2b2eabe999a3d09d305d25f6614db0ccc138785ab0c9ba4c2d94e0c6ace6c25
SHA512de3480a8364d0ac483bd84712786e9469690e0de19019a7114ccb26ad81d86ea06c7cd3368dcb69ebe0d06e6dc9ae21a6ec7e475c2652e46da26976a74eb9097
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
236KB
MD55d74535be34293a2bf02c28b65e63b42
SHA1cd7e2a60e4ad7f92376349db6bea31d0678dfca3
SHA256d2b2eabe999a3d09d305d25f6614db0ccc138785ab0c9ba4c2d94e0c6ace6c25
SHA512de3480a8364d0ac483bd84712786e9469690e0de19019a7114ccb26ad81d86ea06c7cd3368dcb69ebe0d06e6dc9ae21a6ec7e475c2652e46da26976a74eb9097
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
236KB
MD55d74535be34293a2bf02c28b65e63b42
SHA1cd7e2a60e4ad7f92376349db6bea31d0678dfca3
SHA256d2b2eabe999a3d09d305d25f6614db0ccc138785ab0c9ba4c2d94e0c6ace6c25
SHA512de3480a8364d0ac483bd84712786e9469690e0de19019a7114ccb26ad81d86ea06c7cd3368dcb69ebe0d06e6dc9ae21a6ec7e475c2652e46da26976a74eb9097
-
C:\Users\Admin\AppData\Local\Temp\hxKQFDaFpLFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcEkXBAFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQleQYhFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
C:\Users\Admin\AppData\Local\Temp\pfRFEgmotaFetHsFilesize
71KB
MD595a12fa5756d0040e1c1284371ea17e4
SHA1a9c9c457a87ecca994364b6b0a8bbe815c64197d
SHA256805458918a058fbae738b7e4fc57e4d3b8317adf26d11b9b9e53e22bc946b562
SHA5121d71748f56e83e3d8e68bcec6a17ace238d904e767a10ef20c86be8c785ab3c3fea60c832e3b68e0277467ac1b053849d1f3d52bd872b2b9aa7206616ced56c5
-
C:\Users\Admin\AppData\Roaming\1000177000\2023.exeFilesize
3.1MB
MD5027a60b4337dd0847d0414aa8719ffec
SHA180f78f880e891adfa8f71fb1447ed19734077062
SHA2563dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168
SHA512009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d
-
C:\Users\Admin\AppData\Roaming\1000177000\2023.exeFilesize
3.1MB
MD5027a60b4337dd0847d0414aa8719ffec
SHA180f78f880e891adfa8f71fb1447ed19734077062
SHA2563dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168
SHA512009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d
-
C:\Users\Admin\AppData\Roaming\1000177000\2023.exeFilesize
3.1MB
MD5027a60b4337dd0847d0414aa8719ffec
SHA180f78f880e891adfa8f71fb1447ed19734077062
SHA2563dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168
SHA512009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
memory/1132-1360-0x0000000007270000-0x0000000007280000-memory.dmpFilesize
64KB
-
memory/1408-1123-0x0000000008AF0000-0x0000000008CB2000-memory.dmpFilesize
1.8MB
-
memory/1408-202-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/1408-223-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-225-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-227-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-229-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-231-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-233-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-235-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-237-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-309-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/1408-1111-0x00000000077E0000-0x0000000007DE6000-memory.dmpFilesize
6.0MB
-
memory/1408-1112-0x0000000007DF0000-0x0000000007EFA000-memory.dmpFilesize
1.0MB
-
memory/1408-1113-0x0000000007240000-0x0000000007252000-memory.dmpFilesize
72KB
-
memory/1408-1114-0x0000000007260000-0x000000000729E000-memory.dmpFilesize
248KB
-
memory/1408-1115-0x0000000008000000-0x000000000804B000-memory.dmpFilesize
300KB
-
memory/1408-1116-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/1408-1118-0x0000000008170000-0x00000000081D6000-memory.dmpFilesize
408KB
-
memory/1408-1119-0x0000000008710000-0x00000000087A2000-memory.dmpFilesize
584KB
-
memory/1408-1120-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/1408-1121-0x0000000008920000-0x0000000008996000-memory.dmpFilesize
472KB
-
memory/1408-1122-0x00000000089A0000-0x00000000089F0000-memory.dmpFilesize
320KB
-
memory/1408-219-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-1124-0x0000000008CE0000-0x000000000920C000-memory.dmpFilesize
5.2MB
-
memory/1408-1125-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/1408-217-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-215-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-221-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-200-0x0000000004C50000-0x0000000004C96000-memory.dmpFilesize
280KB
-
memory/1408-201-0x0000000002DB0000-0x0000000002DFB000-memory.dmpFilesize
300KB
-
memory/1408-213-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-211-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-209-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-207-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-205-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-204-0x0000000007130000-0x000000000716E000-memory.dmpFilesize
248KB
-
memory/1408-203-0x0000000007130000-0x0000000007174000-memory.dmpFilesize
272KB
-
memory/1524-1183-0x0000000008E10000-0x0000000008EA4000-memory.dmpFilesize
592KB
-
memory/1524-1184-0x0000000008AD0000-0x0000000008AEA000-memory.dmpFilesize
104KB
-
memory/1524-1160-0x0000000006D10000-0x0000000007338000-memory.dmpFilesize
6.2MB
-
memory/1524-1159-0x0000000000CE0000-0x0000000000D16000-memory.dmpFilesize
216KB
-
memory/1524-1162-0x0000000006C30000-0x0000000006C52000-memory.dmpFilesize
136KB
-
memory/1524-1164-0x0000000007340000-0x00000000073A6000-memory.dmpFilesize
408KB
-
memory/1524-1163-0x0000000000C90000-0x0000000000CA0000-memory.dmpFilesize
64KB
-
memory/1524-1165-0x0000000000C90000-0x0000000000CA0000-memory.dmpFilesize
64KB
-
memory/1524-1166-0x0000000007600000-0x0000000007950000-memory.dmpFilesize
3.3MB
-
memory/1524-1167-0x00000000079D0000-0x00000000079EC000-memory.dmpFilesize
112KB
-
memory/1524-1168-0x0000000007A00000-0x0000000007A4B000-memory.dmpFilesize
300KB
-
memory/1524-1185-0x0000000008B40000-0x0000000008B62000-memory.dmpFilesize
136KB
-
memory/1836-1194-0x00000000068F0000-0x0000000006900000-memory.dmpFilesize
64KB
-
memory/1836-1195-0x0000000007560000-0x00000000078B0000-memory.dmpFilesize
3.3MB
-
memory/1836-1196-0x00000000068F0000-0x0000000006900000-memory.dmpFilesize
64KB
-
memory/2012-1291-0x00000000010B0000-0x00000000010C0000-memory.dmpFilesize
64KB
-
memory/2012-1292-0x00000000010B0000-0x00000000010C0000-memory.dmpFilesize
64KB
-
memory/2700-1218-0x00000000076F0000-0x0000000007A40000-memory.dmpFilesize
3.3MB
-
memory/2700-1220-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/2700-1222-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/2700-1221-0x0000000008250000-0x000000000829B000-memory.dmpFilesize
300KB
-
memory/3100-149-0x0000000000140000-0x000000000014A000-memory.dmpFilesize
40KB
-
memory/3196-1325-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/3196-1313-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/3484-1337-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/3484-1338-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/3644-1243-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/3644-1245-0x00000000080F0000-0x0000000008440000-memory.dmpFilesize
3.3MB
-
memory/3644-1244-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/4536-1268-0x0000000006B10000-0x0000000006B20000-memory.dmpFilesize
64KB
-
memory/4536-1269-0x0000000006B10000-0x0000000006B20000-memory.dmpFilesize
64KB
-
memory/4804-1131-0x0000000000990000-0x00000000009C2000-memory.dmpFilesize
200KB
-
memory/4804-1133-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/4804-1132-0x00000000053D0000-0x000000000541B000-memory.dmpFilesize
300KB
-
memory/5080-195-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/5080-183-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-181-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-185-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-179-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-187-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-177-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-189-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-175-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-190-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/5080-173-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-171-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-191-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/5080-193-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/5080-169-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-167-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-165-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-163-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-162-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/5080-161-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/5080-160-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/5080-159-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/5080-158-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/5080-157-0x0000000004950000-0x0000000004968000-memory.dmpFilesize
96KB
-
memory/5080-156-0x00000000071D0000-0x00000000076CE000-memory.dmpFilesize
5.0MB
-
memory/5080-155-0x00000000047C0000-0x00000000047DA000-memory.dmpFilesize
104KB
-
memory/5080-192-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB