Malware Analysis Report

2024-10-23 19:16

Sample ID 230526-vf3h8sha2w
Target 06579099.exe
SHA256 ba7339b6ea34396a448e50dccf7a040e06d5b24e32b043bb1f3b9721fccc64a6
Tags
gurcu lumma redline sectoprat crypto goga lisa collection discovery evasion infostealer persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ba7339b6ea34396a448e50dccf7a040e06d5b24e32b043bb1f3b9721fccc64a6

Threat Level: Known bad

The file 06579099.exe was found to be: Known bad.

Malicious Activity Summary

gurcu lumma redline sectoprat crypto goga lisa collection discovery evasion infostealer persistence rat spyware stealer trojan

Gurcu, WhiteSnake

RedLine

SectopRAT payload

Modifies Windows Defender Real-time Protection settings

SectopRAT

RedLine payload

Lumma Stealer

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Program crash

Enumerates physical storage devices

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

outlook_win_path

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-26 16:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-26 16:56

Reported

2023-05-26 16:59

Platform

win7-20230220-en

Max time kernel

131s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06579099.exe"

Signatures

Gurcu, WhiteSnake

stealer gurcu

Lumma Stealer

stealer lumma

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000038001\build9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\06579099.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\06579099.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe N/A

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba87030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca60f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca6040000000100000010000000a923759bba49366e31c2dbf2e766ba872000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000038001\build9.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2012 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 2012 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 2012 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 2012 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 2012 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 2012 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 2012 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 1976 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 1976 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 1976 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 1976 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 1976 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 1976 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 1976 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 328 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 328 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 328 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 328 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 328 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 328 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 328 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1496 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 328 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 328 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 328 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 328 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 328 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 328 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 328 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 1976 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 1976 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 1976 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 1976 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 1976 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 1976 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 1976 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 528 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2012 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 2012 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 2012 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 2012 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 2012 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 2012 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 2012 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 928 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 928 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 928 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 928 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\06579099.exe

"C:\Users\Admin\AppData\Local\Temp\06579099.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legends.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legends.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\41bde21dc7" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\41bde21dc7" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

"C:\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 36

C:\Users\Admin\AppData\Local\Temp\1000038001\build9.exe

"C:\Users\Admin\AppData\Local\Temp\1000038001\build9.exe"

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

"C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {D96E94D0-3F72-4946-91EB-148978038AD0} S-1-5-21-3499517378-2376672570-1134980332-1000:MLXLFKOI\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

"C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe"

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

"C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe"

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

"C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe"

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

"C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 2308

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Network

Country Destination Domain Proto
N/A 83.97.73.122:19062 tcp
N/A 83.97.73.122:19062 tcp
US 95.214.27.98:80 95.214.27.98 tcp
US 163.123.142.235:61068 163.123.142.235 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
NZ 185.99.133.246:80 185.99.133.246 tcp
US 8.8.8.8:53 cyware.com udp
US 3.33.180.61:80 cyware.com tcp
US 3.33.180.61:443 cyware.com tcp
US 3.33.180.61:443 cyware.com tcp
US 8.8.8.8:53 google.kz udp
NL 142.250.179.132:80 google.kz tcp
US 3.33.180.61:443 cyware.com tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

MD5 bb2d5f6d7fee430ae87d8c6d9109199d
SHA1 f6c349894fe1f1f1b6c81900df570d2e47388d4c
SHA256 7501d69a2429b58a0d7d702e907c902b9451778831ded2b198ec1cdf7f81e792
SHA512 7e8d8b4ce6f834f068ecda8d0342a0b24be66daa61f0df5d3478ab8de121a6022a1ad90a240d8f7512eb256402aba5947fd176c1aac14d287e881777bbb9e7ab

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

MD5 bb2d5f6d7fee430ae87d8c6d9109199d
SHA1 f6c349894fe1f1f1b6c81900df570d2e47388d4c
SHA256 7501d69a2429b58a0d7d702e907c902b9451778831ded2b198ec1cdf7f81e792
SHA512 7e8d8b4ce6f834f068ecda8d0342a0b24be66daa61f0df5d3478ab8de121a6022a1ad90a240d8f7512eb256402aba5947fd176c1aac14d287e881777bbb9e7ab

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

MD5 bb2d5f6d7fee430ae87d8c6d9109199d
SHA1 f6c349894fe1f1f1b6c81900df570d2e47388d4c
SHA256 7501d69a2429b58a0d7d702e907c902b9451778831ded2b198ec1cdf7f81e792
SHA512 7e8d8b4ce6f834f068ecda8d0342a0b24be66daa61f0df5d3478ab8de121a6022a1ad90a240d8f7512eb256402aba5947fd176c1aac14d287e881777bbb9e7ab

\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

MD5 bb2d5f6d7fee430ae87d8c6d9109199d
SHA1 f6c349894fe1f1f1b6c81900df570d2e47388d4c
SHA256 7501d69a2429b58a0d7d702e907c902b9451778831ded2b198ec1cdf7f81e792
SHA512 7e8d8b4ce6f834f068ecda8d0342a0b24be66daa61f0df5d3478ab8de121a6022a1ad90a240d8f7512eb256402aba5947fd176c1aac14d287e881777bbb9e7ab

\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

MD5 5694fef82eb4c0e895195d9c0ce59bfa
SHA1 1178696c1980b7881040d5e88a71f480ad20464b
SHA256 33a1aea97780ca898518ebd382fac7f9fc2e76ca4f75a32ef8119c06ad2d0a14
SHA512 8267f459161e8893bf173cd03ed7ef7479c803118455a6776b0b35b927ee81c0c544d05f1ccfd36446ceeeabb33f28e902ac12e34581e76a430df81f32a43247

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

MD5 5694fef82eb4c0e895195d9c0ce59bfa
SHA1 1178696c1980b7881040d5e88a71f480ad20464b
SHA256 33a1aea97780ca898518ebd382fac7f9fc2e76ca4f75a32ef8119c06ad2d0a14
SHA512 8267f459161e8893bf173cd03ed7ef7479c803118455a6776b0b35b927ee81c0c544d05f1ccfd36446ceeeabb33f28e902ac12e34581e76a430df81f32a43247

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

MD5 5694fef82eb4c0e895195d9c0ce59bfa
SHA1 1178696c1980b7881040d5e88a71f480ad20464b
SHA256 33a1aea97780ca898518ebd382fac7f9fc2e76ca4f75a32ef8119c06ad2d0a14
SHA512 8267f459161e8893bf173cd03ed7ef7479c803118455a6776b0b35b927ee81c0c544d05f1ccfd36446ceeeabb33f28e902ac12e34581e76a430df81f32a43247

\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

MD5 5694fef82eb4c0e895195d9c0ce59bfa
SHA1 1178696c1980b7881040d5e88a71f480ad20464b
SHA256 33a1aea97780ca898518ebd382fac7f9fc2e76ca4f75a32ef8119c06ad2d0a14
SHA512 8267f459161e8893bf173cd03ed7ef7479c803118455a6776b0b35b927ee81c0c544d05f1ccfd36446ceeeabb33f28e902ac12e34581e76a430df81f32a43247

\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

MD5 c445fe801926a85479d56a1792c40845
SHA1 ccba5f0815a68e1b25b97b1bb7dc27f1a0882b26
SHA256 7d16ca66a6d873bb0fa68691eeba0fac42a95dc5d5d9212aff1dc78a94439c93
SHA512 61684e1127c011a0e2ce9510dacfdc6fc83c3e2a54a54c52e6a1dde397859330565da5a64bff98ff803d0e5bee1438f00a16f0913df9410a4ed5180cd6e9ddb6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

MD5 c445fe801926a85479d56a1792c40845
SHA1 ccba5f0815a68e1b25b97b1bb7dc27f1a0882b26
SHA256 7d16ca66a6d873bb0fa68691eeba0fac42a95dc5d5d9212aff1dc78a94439c93
SHA512 61684e1127c011a0e2ce9510dacfdc6fc83c3e2a54a54c52e6a1dde397859330565da5a64bff98ff803d0e5bee1438f00a16f0913df9410a4ed5180cd6e9ddb6

\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

MD5 c445fe801926a85479d56a1792c40845
SHA1 ccba5f0815a68e1b25b97b1bb7dc27f1a0882b26
SHA256 7d16ca66a6d873bb0fa68691eeba0fac42a95dc5d5d9212aff1dc78a94439c93
SHA512 61684e1127c011a0e2ce9510dacfdc6fc83c3e2a54a54c52e6a1dde397859330565da5a64bff98ff803d0e5bee1438f00a16f0913df9410a4ed5180cd6e9ddb6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

MD5 c445fe801926a85479d56a1792c40845
SHA1 ccba5f0815a68e1b25b97b1bb7dc27f1a0882b26
SHA256 7d16ca66a6d873bb0fa68691eeba0fac42a95dc5d5d9212aff1dc78a94439c93
SHA512 61684e1127c011a0e2ce9510dacfdc6fc83c3e2a54a54c52e6a1dde397859330565da5a64bff98ff803d0e5bee1438f00a16f0913df9410a4ed5180cd6e9ddb6

memory/1884-85-0x0000000000090000-0x000000000009A000-memory.dmp

memory/1884-86-0x0000000000090000-0x000000000009A000-memory.dmp

memory/1884-90-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1884-92-0x0000000000090000-0x000000000009A000-memory.dmp

memory/1884-93-0x0000000000090000-0x000000000009A000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

MD5 619d208dd1dec1bad30ba961eda5c538
SHA1 2a2fc07cd3cb76e52a63c7cd7e2245e44694d11c
SHA256 c95a69a9e3c09f31ea5e7f9a7d5a2effedf794fd4d384c584c531dffa0870fce
SHA512 efa5f29d5a835fde01b824f0b1ef487ce63eef40f03bf68d030ac53c7286c161993579b3f43b0b27a26838ea42defaea0229cf98e25792216742a2ec1c325ca2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

MD5 619d208dd1dec1bad30ba961eda5c538
SHA1 2a2fc07cd3cb76e52a63c7cd7e2245e44694d11c
SHA256 c95a69a9e3c09f31ea5e7f9a7d5a2effedf794fd4d384c584c531dffa0870fce
SHA512 efa5f29d5a835fde01b824f0b1ef487ce63eef40f03bf68d030ac53c7286c161993579b3f43b0b27a26838ea42defaea0229cf98e25792216742a2ec1c325ca2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

MD5 619d208dd1dec1bad30ba961eda5c538
SHA1 2a2fc07cd3cb76e52a63c7cd7e2245e44694d11c
SHA256 c95a69a9e3c09f31ea5e7f9a7d5a2effedf794fd4d384c584c531dffa0870fce
SHA512 efa5f29d5a835fde01b824f0b1ef487ce63eef40f03bf68d030ac53c7286c161993579b3f43b0b27a26838ea42defaea0229cf98e25792216742a2ec1c325ca2

\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

MD5 619d208dd1dec1bad30ba961eda5c538
SHA1 2a2fc07cd3cb76e52a63c7cd7e2245e44694d11c
SHA256 c95a69a9e3c09f31ea5e7f9a7d5a2effedf794fd4d384c584c531dffa0870fce
SHA512 efa5f29d5a835fde01b824f0b1ef487ce63eef40f03bf68d030ac53c7286c161993579b3f43b0b27a26838ea42defaea0229cf98e25792216742a2ec1c325ca2

memory/1360-100-0x00000000001D0000-0x00000000001FA000-memory.dmp

memory/1360-101-0x0000000000310000-0x0000000000350000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

MD5 e7caf807de46535bc71dcf6d8e8c6e5b
SHA1 5a2f33387e4f427f3980dcbcdea0de3125c7538a
SHA256 d8d557306fd0d1c36168a3593e5f9fb568dc3258db48932601586cc006672cc9
SHA512 c1da05766f702b07a9e7f9c2181c6ed092fa64a4cf8705a4b4e9b5152d8bc355a93cad45839bed3b59cace1c1526dd20041150d24ab6d3e337f5aee3e296038f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

MD5 e7caf807de46535bc71dcf6d8e8c6e5b
SHA1 5a2f33387e4f427f3980dcbcdea0de3125c7538a
SHA256 d8d557306fd0d1c36168a3593e5f9fb568dc3258db48932601586cc006672cc9
SHA512 c1da05766f702b07a9e7f9c2181c6ed092fa64a4cf8705a4b4e9b5152d8bc355a93cad45839bed3b59cace1c1526dd20041150d24ab6d3e337f5aee3e296038f

\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

MD5 e7caf807de46535bc71dcf6d8e8c6e5b
SHA1 5a2f33387e4f427f3980dcbcdea0de3125c7538a
SHA256 d8d557306fd0d1c36168a3593e5f9fb568dc3258db48932601586cc006672cc9
SHA512 c1da05766f702b07a9e7f9c2181c6ed092fa64a4cf8705a4b4e9b5152d8bc355a93cad45839bed3b59cace1c1526dd20041150d24ab6d3e337f5aee3e296038f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

MD5 e7caf807de46535bc71dcf6d8e8c6e5b
SHA1 5a2f33387e4f427f3980dcbcdea0de3125c7538a
SHA256 d8d557306fd0d1c36168a3593e5f9fb568dc3258db48932601586cc006672cc9
SHA512 c1da05766f702b07a9e7f9c2181c6ed092fa64a4cf8705a4b4e9b5152d8bc355a93cad45839bed3b59cace1c1526dd20041150d24ab6d3e337f5aee3e296038f

memory/1888-109-0x00000000000D0000-0x00000000000FA000-memory.dmp

memory/1888-110-0x00000000000D0000-0x00000000000FA000-memory.dmp

memory/1888-116-0x00000000000D0000-0x00000000000FA000-memory.dmp

memory/1888-117-0x00000000000D0000-0x00000000000FA000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/1888-125-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/928-128-0x0000000000D30000-0x0000000000E28000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/928-130-0x0000000007060000-0x00000000070A0000-memory.dmp

memory/1044-131-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/1044-134-0x0000000000400000-0x0000000000438000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/1044-140-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1044-141-0x00000000003E0000-0x00000000003E1000-memory.dmp

\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/1044-150-0x0000000000400000-0x0000000000438000-memory.dmp

memory/588-153-0x0000000000290000-0x0000000000388000-memory.dmp

\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/588-155-0x0000000007200000-0x0000000007240000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/1592-164-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1592-165-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

MD5 433dbed8a7afbf15bfee967c63a50769
SHA1 858e1279c2f6a47051eb963012099d11d60a881d
SHA256 6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601
SHA512 06c6af80a5ccc79bcabc64c217289eb3aeaca0fddbe9f1bd60de9927690a77dfd850edcfe0a1f2523e10f0074ae8bcb61076a9feb38d0113d38aff0121a36c4e

memory/1592-176-0x0000000000400000-0x0000000000438000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

MD5 433dbed8a7afbf15bfee967c63a50769
SHA1 858e1279c2f6a47051eb963012099d11d60a881d
SHA256 6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601
SHA512 06c6af80a5ccc79bcabc64c217289eb3aeaca0fddbe9f1bd60de9927690a77dfd850edcfe0a1f2523e10f0074ae8bcb61076a9feb38d0113d38aff0121a36c4e

memory/1592-182-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

MD5 433dbed8a7afbf15bfee967c63a50769
SHA1 858e1279c2f6a47051eb963012099d11d60a881d
SHA256 6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601
SHA512 06c6af80a5ccc79bcabc64c217289eb3aeaca0fddbe9f1bd60de9927690a77dfd850edcfe0a1f2523e10f0074ae8bcb61076a9feb38d0113d38aff0121a36c4e

C:\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

MD5 433dbed8a7afbf15bfee967c63a50769
SHA1 858e1279c2f6a47051eb963012099d11d60a881d
SHA256 6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601
SHA512 06c6af80a5ccc79bcabc64c217289eb3aeaca0fddbe9f1bd60de9927690a77dfd850edcfe0a1f2523e10f0074ae8bcb61076a9feb38d0113d38aff0121a36c4e

\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

MD5 433dbed8a7afbf15bfee967c63a50769
SHA1 858e1279c2f6a47051eb963012099d11d60a881d
SHA256 6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601
SHA512 06c6af80a5ccc79bcabc64c217289eb3aeaca0fddbe9f1bd60de9927690a77dfd850edcfe0a1f2523e10f0074ae8bcb61076a9feb38d0113d38aff0121a36c4e

memory/832-185-0x0000000000400000-0x0000000000454000-memory.dmp

memory/832-186-0x0000000000400000-0x0000000000454000-memory.dmp

memory/832-192-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

MD5 433dbed8a7afbf15bfee967c63a50769
SHA1 858e1279c2f6a47051eb963012099d11d60a881d
SHA256 6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601
SHA512 06c6af80a5ccc79bcabc64c217289eb3aeaca0fddbe9f1bd60de9927690a77dfd850edcfe0a1f2523e10f0074ae8bcb61076a9feb38d0113d38aff0121a36c4e

\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

MD5 433dbed8a7afbf15bfee967c63a50769
SHA1 858e1279c2f6a47051eb963012099d11d60a881d
SHA256 6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601
SHA512 06c6af80a5ccc79bcabc64c217289eb3aeaca0fddbe9f1bd60de9927690a77dfd850edcfe0a1f2523e10f0074ae8bcb61076a9feb38d0113d38aff0121a36c4e

C:\Users\Admin\AppData\Local\Temp\1000038001\build9.exe

MD5 2c5a75b7d24847bc5d206adb5c630a18
SHA1 89ca4d98947ab1248c022d66a23279f04cca6bbf
SHA256 dd09828ffbfdd784f83cac83641b8a0c3ca04b76becabb0ab5d170ad1bc169a7
SHA512 2ff1ad476ea1c72f6e1cda33f601e2eae06ca87bf4554cd085e17512a88ad515e95d42706e8e0a2c2b1fe17c9e0f1c511ef1554333d17a7e6e111b1531acc789

\Users\Admin\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

MD5 433dbed8a7afbf15bfee967c63a50769
SHA1 858e1279c2f6a47051eb963012099d11d60a881d
SHA256 6c5cff00451680070af8daca0a59ee6a6f467f6b3152f60de6cec6cdcb9cf601
SHA512 06c6af80a5ccc79bcabc64c217289eb3aeaca0fddbe9f1bd60de9927690a77dfd850edcfe0a1f2523e10f0074ae8bcb61076a9feb38d0113d38aff0121a36c4e

memory/1592-208-0x0000000000400000-0x0000000000438000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000038001\build9.exe

MD5 2c5a75b7d24847bc5d206adb5c630a18
SHA1 89ca4d98947ab1248c022d66a23279f04cca6bbf
SHA256 dd09828ffbfdd784f83cac83641b8a0c3ca04b76becabb0ab5d170ad1bc169a7
SHA512 2ff1ad476ea1c72f6e1cda33f601e2eae06ca87bf4554cd085e17512a88ad515e95d42706e8e0a2c2b1fe17c9e0f1c511ef1554333d17a7e6e111b1531acc789

memory/1592-214-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000038001\build9.exe

MD5 2c5a75b7d24847bc5d206adb5c630a18
SHA1 89ca4d98947ab1248c022d66a23279f04cca6bbf
SHA256 dd09828ffbfdd784f83cac83641b8a0c3ca04b76becabb0ab5d170ad1bc169a7
SHA512 2ff1ad476ea1c72f6e1cda33f601e2eae06ca87bf4554cd085e17512a88ad515e95d42706e8e0a2c2b1fe17c9e0f1c511ef1554333d17a7e6e111b1531acc789

C:\Users\Admin\AppData\Local\Temp\1000038001\build9.exe

MD5 2c5a75b7d24847bc5d206adb5c630a18
SHA1 89ca4d98947ab1248c022d66a23279f04cca6bbf
SHA256 dd09828ffbfdd784f83cac83641b8a0c3ca04b76becabb0ab5d170ad1bc169a7
SHA512 2ff1ad476ea1c72f6e1cda33f601e2eae06ca87bf4554cd085e17512a88ad515e95d42706e8e0a2c2b1fe17c9e0f1c511ef1554333d17a7e6e111b1531acc789

\Users\Admin\AppData\Local\Temp\1000038001\build9.exe

MD5 2c5a75b7d24847bc5d206adb5c630a18
SHA1 89ca4d98947ab1248c022d66a23279f04cca6bbf
SHA256 dd09828ffbfdd784f83cac83641b8a0c3ca04b76becabb0ab5d170ad1bc169a7
SHA512 2ff1ad476ea1c72f6e1cda33f601e2eae06ca87bf4554cd085e17512a88ad515e95d42706e8e0a2c2b1fe17c9e0f1c511ef1554333d17a7e6e111b1531acc789

memory/768-217-0x00000000001E0000-0x00000000001FE000-memory.dmp

memory/768-218-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

MD5 a1ce7b26712e1db177d86fa87d09c354
SHA1 23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256 b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512 e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4

memory/1592-228-0x0000000000400000-0x0000000000438000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

MD5 a1ce7b26712e1db177d86fa87d09c354
SHA1 23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256 b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512 e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4

memory/1592-233-0x0000000000400000-0x0000000000438000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

MD5 a1ce7b26712e1db177d86fa87d09c354
SHA1 23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256 b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512 e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

MD5 a1ce7b26712e1db177d86fa87d09c354
SHA1 23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256 b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512 e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

MD5 a1ce7b26712e1db177d86fa87d09c354
SHA1 23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256 b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512 e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4

memory/1752-237-0x0000000000100000-0x00000000001D6000-memory.dmp

memory/1752-238-0x0000000000570000-0x00000000005B0000-memory.dmp

memory/1752-239-0x00000000007D0000-0x00000000007E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC545.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpC55B.tmp

MD5 d6492f228d1417a459765d7b9657cbba
SHA1 ef73426c3634a16ac6c15803633e77035abd032c
SHA256 75fbdce4223e0df5805b3fddc158d6c955b34b2112ed83d9967e731cc9f8cfb7
SHA512 50c5c6955ac90ccc1602bc32fc2d03808f42fbde7be46c681d7b7e99eb4cfe222a868c6c73728e4afce1b5904d7b2148c29ed5b177c38a5c1bfaf047e86b5613

memory/1752-324-0x0000000000570000-0x00000000005B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/668-326-0x0000000000290000-0x0000000000388000-memory.dmp

\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/668-328-0x0000000006E20000-0x0000000006E60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/568-333-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

memory/1592-351-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

memory/1752-357-0x00000000008E0000-0x00000000008EA000-memory.dmp

memory/1752-358-0x0000000005E50000-0x0000000005EE0000-memory.dmp

memory/1752-359-0x0000000004D30000-0x0000000004D8C000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

MD5 a1ce7b26712e1db177d86fa87d09c354
SHA1 23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256 b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512 e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4

\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

MD5 a1ce7b26712e1db177d86fa87d09c354
SHA1 23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256 b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512 e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4

C:\Users\Admin\AppData\Local\Temp\1000039001\1232.exe

MD5 a1ce7b26712e1db177d86fa87d09c354
SHA1 23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256 b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512 e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4

memory/1912-363-0x0000000000400000-0x000000000045A000-memory.dmp

memory/1912-364-0x0000000000400000-0x000000000045A000-memory.dmp

memory/1912-365-0x0000000000400000-0x000000000045A000-memory.dmp

memory/1912-366-0x0000000000400000-0x000000000045A000-memory.dmp

memory/1912-367-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1912-368-0x0000000000400000-0x000000000045A000-memory.dmp

memory/1912-370-0x0000000000400000-0x000000000045A000-memory.dmp

memory/1912-372-0x0000000000400000-0x000000000045A000-memory.dmp

memory/1912-373-0x00000000051C0000-0x0000000005200000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

C:\Users\Admin\AppData\Local\Temp\Tar6A01.tmp

MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d18234f83fa72c305bb07b6b1c34c73
SHA1 c77b63af17706f54741bd3b39456e9857b3c2fcf
SHA256 4296ed1c7a38d47212fcadc0bb52666cc5dc983f716359381c952a2be941d2be
SHA512 50146141a211252cf2050fbbbc47920ca1d88041af21beb828f25e7a8dcfad3a934a1487a2b8f786dd81fed92da8f1bb09eed948698ea834010bdb25f3becb29

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b842367a8576bc4b60c6c176a13bcd84
SHA1 b80589cafa93d13e760c844fd183e66992147d15
SHA256 250e41e4cfbaca2f12fd9c5cf09213ed9b8ea74c8153464cefc0d85b2c3b9104
SHA512 cae31ade350a0be68d2eb618e6f5dec1ba2fcebd6420f1ccabb10d7d6311341414f981539700cf5778df1a667abc98f465107b10240867d8f9528d77ce36ce80

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be41d18c074120aecee683355d71d9a4
SHA1 d309c8bc3e55fa7e70379df6ea3dfa433f19166d
SHA256 dcced705aebab1e12d7fe49f1f8103f3dcecb9a48714542d49db7ff83705d758
SHA512 a0c91e640455ae84443af4ed02d4f37831b3e5739dec425f082094bcd7d8c12e83bc33e569a57602b141969a09d5ac54cae173edcec6353de6e3e1ecc78a708d

memory/1912-568-0x00000000051C0000-0x0000000005200000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-26 16:56

Reported

2023-05-26 16:59

Platform

win10v2004-20230220-en

Max time kernel

134s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06579099.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

RedLine

infostealer redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\06579099.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\06579099.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3820 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 3820 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 3820 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe
PID 760 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 760 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 760 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe
PID 376 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 376 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 376 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe
PID 1224 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1224 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1224 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1224 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1224 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 376 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 376 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 376 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe
PID 760 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 760 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 760 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe
PID 4712 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4712 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4712 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4712 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4712 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 3820 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 3820 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\06579099.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 1648 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe
PID 2844 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 2844 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 2844 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 744 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
PID 2312 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Windows\SysWOW64\schtasks.exe
PID 2312 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Windows\SysWOW64\schtasks.exe
PID 2312 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Windows\SysWOW64\schtasks.exe
PID 2312 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Windows\SysWOW64\cmd.exe
PID 2312 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Windows\SysWOW64\cmd.exe
PID 2312 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe C:\Windows\SysWOW64\cmd.exe
PID 1276 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1276 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1276 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06579099.exe

"C:\Users\Admin\AppData\Local\Temp\06579099.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legends.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legends.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\41bde21dc7" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\41bde21dc7" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Network

Country Destination Domain Proto
US 40.125.122.151:443 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.4.107.13.in-addr.arpa udp
N/A 83.97.73.122:19062 tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
N/A 83.97.73.122:19062 tcp
US 8.8.8.8:53 122.73.97.83.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 139.238.32.23.in-addr.arpa udp
NL 20.50.201.200:443 tcp
N/A 83.97.73.122:19062 tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 95.214.27.98:80 95.214.27.98 tcp
US 8.8.8.8:53 98.27.214.95.in-addr.arpa udp
US 117.18.237.29:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

MD5 bb2d5f6d7fee430ae87d8c6d9109199d
SHA1 f6c349894fe1f1f1b6c81900df570d2e47388d4c
SHA256 7501d69a2429b58a0d7d702e907c902b9451778831ded2b198ec1cdf7f81e792
SHA512 7e8d8b4ce6f834f068ecda8d0342a0b24be66daa61f0df5d3478ab8de121a6022a1ad90a240d8f7512eb256402aba5947fd176c1aac14d287e881777bbb9e7ab

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6795022.exe

MD5 bb2d5f6d7fee430ae87d8c6d9109199d
SHA1 f6c349894fe1f1f1b6c81900df570d2e47388d4c
SHA256 7501d69a2429b58a0d7d702e907c902b9451778831ded2b198ec1cdf7f81e792
SHA512 7e8d8b4ce6f834f068ecda8d0342a0b24be66daa61f0df5d3478ab8de121a6022a1ad90a240d8f7512eb256402aba5947fd176c1aac14d287e881777bbb9e7ab

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

MD5 5694fef82eb4c0e895195d9c0ce59bfa
SHA1 1178696c1980b7881040d5e88a71f480ad20464b
SHA256 33a1aea97780ca898518ebd382fac7f9fc2e76ca4f75a32ef8119c06ad2d0a14
SHA512 8267f459161e8893bf173cd03ed7ef7479c803118455a6776b0b35b927ee81c0c544d05f1ccfd36446ceeeabb33f28e902ac12e34581e76a430df81f32a43247

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5735686.exe

MD5 5694fef82eb4c0e895195d9c0ce59bfa
SHA1 1178696c1980b7881040d5e88a71f480ad20464b
SHA256 33a1aea97780ca898518ebd382fac7f9fc2e76ca4f75a32ef8119c06ad2d0a14
SHA512 8267f459161e8893bf173cd03ed7ef7479c803118455a6776b0b35b927ee81c0c544d05f1ccfd36446ceeeabb33f28e902ac12e34581e76a430df81f32a43247

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

MD5 c445fe801926a85479d56a1792c40845
SHA1 ccba5f0815a68e1b25b97b1bb7dc27f1a0882b26
SHA256 7d16ca66a6d873bb0fa68691eeba0fac42a95dc5d5d9212aff1dc78a94439c93
SHA512 61684e1127c011a0e2ce9510dacfdc6fc83c3e2a54a54c52e6a1dde397859330565da5a64bff98ff803d0e5bee1438f00a16f0913df9410a4ed5180cd6e9ddb6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5687881.exe

MD5 c445fe801926a85479d56a1792c40845
SHA1 ccba5f0815a68e1b25b97b1bb7dc27f1a0882b26
SHA256 7d16ca66a6d873bb0fa68691eeba0fac42a95dc5d5d9212aff1dc78a94439c93
SHA512 61684e1127c011a0e2ce9510dacfdc6fc83c3e2a54a54c52e6a1dde397859330565da5a64bff98ff803d0e5bee1438f00a16f0913df9410a4ed5180cd6e9ddb6

memory/2644-155-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

MD5 619d208dd1dec1bad30ba961eda5c538
SHA1 2a2fc07cd3cb76e52a63c7cd7e2245e44694d11c
SHA256 c95a69a9e3c09f31ea5e7f9a7d5a2effedf794fd4d384c584c531dffa0870fce
SHA512 efa5f29d5a835fde01b824f0b1ef487ce63eef40f03bf68d030ac53c7286c161993579b3f43b0b27a26838ea42defaea0229cf98e25792216742a2ec1c325ca2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7167525.exe

MD5 619d208dd1dec1bad30ba961eda5c538
SHA1 2a2fc07cd3cb76e52a63c7cd7e2245e44694d11c
SHA256 c95a69a9e3c09f31ea5e7f9a7d5a2effedf794fd4d384c584c531dffa0870fce
SHA512 efa5f29d5a835fde01b824f0b1ef487ce63eef40f03bf68d030ac53c7286c161993579b3f43b0b27a26838ea42defaea0229cf98e25792216742a2ec1c325ca2

memory/3376-163-0x0000000000350000-0x000000000037A000-memory.dmp

memory/3376-164-0x0000000005290000-0x00000000058A8000-memory.dmp

memory/3376-165-0x0000000004DF0000-0x0000000004EFA000-memory.dmp

memory/3376-166-0x0000000004D20000-0x0000000004D32000-memory.dmp

memory/3376-167-0x0000000005010000-0x0000000005020000-memory.dmp

memory/3376-168-0x0000000004D80000-0x0000000004DBC000-memory.dmp

memory/3376-170-0x0000000005010000-0x0000000005020000-memory.dmp

memory/3376-171-0x0000000005A80000-0x0000000005AE6000-memory.dmp

memory/3376-172-0x0000000005D90000-0x0000000005E22000-memory.dmp

memory/3376-173-0x00000000063E0000-0x0000000006984000-memory.dmp

memory/3376-174-0x0000000006010000-0x0000000006086000-memory.dmp

memory/3376-175-0x0000000005E80000-0x0000000005ED0000-memory.dmp

memory/3376-176-0x0000000006990000-0x0000000006B52000-memory.dmp

memory/3376-177-0x0000000007090000-0x00000000075BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

MD5 e7caf807de46535bc71dcf6d8e8c6e5b
SHA1 5a2f33387e4f427f3980dcbcdea0de3125c7538a
SHA256 d8d557306fd0d1c36168a3593e5f9fb568dc3258db48932601586cc006672cc9
SHA512 c1da05766f702b07a9e7f9c2181c6ed092fa64a4cf8705a4b4e9b5152d8bc355a93cad45839bed3b59cace1c1526dd20041150d24ab6d3e337f5aee3e296038f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4029417.exe

MD5 e7caf807de46535bc71dcf6d8e8c6e5b
SHA1 5a2f33387e4f427f3980dcbcdea0de3125c7538a
SHA256 d8d557306fd0d1c36168a3593e5f9fb568dc3258db48932601586cc006672cc9
SHA512 c1da05766f702b07a9e7f9c2181c6ed092fa64a4cf8705a4b4e9b5152d8bc355a93cad45839bed3b59cace1c1526dd20041150d24ab6d3e337f5aee3e296038f

memory/4816-183-0x0000000000720000-0x000000000074A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/1648-192-0x00000000006B0000-0x00000000007A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/4816-193-0x0000000004F90000-0x0000000004FA0000-memory.dmp

memory/1648-194-0x0000000007550000-0x0000000007560000-memory.dmp

memory/2844-195-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1870623.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/2844-198-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2844-199-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2844-201-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/2844-215-0x0000000000400000-0x0000000000438000-memory.dmp

memory/744-216-0x0000000002F90000-0x0000000002FA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/2312-221-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2312-222-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2312-224-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2312-225-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

memory/4652-229-0x0000000007310000-0x0000000007320000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/2240-233-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2240-234-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2240-235-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

memory/2312-253-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 73c0c85e39b9a63b42f6c4ff6d634f8b
SHA1 efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256 477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512 ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/4448-257-0x0000000007510000-0x0000000007520000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

MD5 d6cd2ed4f74029c08f7df131f6966dd5
SHA1 c5cb380788c1da9da7ce2780d5ad849d40c206a9
SHA256 b277aa309570dbf10c8690e3deef3982d703491723c0d403defd1f609f531fb4
SHA512 286fc678e980f8e3b9be4194b1ff1eda4596ea887d821bf88dc95654d4418e13398afbe37f15af68b9bad403c98e34623911666897de0dfb25d5c75e8a284846

memory/4424-260-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4424-261-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4424-262-0x0000000000400000-0x0000000000438000-memory.dmp