Analysis
-
max time kernel
140s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 08:15
Static task
static1
Behavioral task
behavioral1
Sample
20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe
Resource
win7-20230831-en
General
-
Target
20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe
-
Size
1.3MB
-
MD5
77e5c2d9e6d109f97758b72cf73a69d2
-
SHA1
c11a2f05690131bdd6dd53e29bdd193e7c374a53
-
SHA256
20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885
-
SHA512
7538cd96ca57603c7831de0aff7c41063f8a4de0c034993f649f40c62d8fa03231a10edee8785fef302be626669f363c1ef8d562529e7bb7c16baaf29f49c575
-
SSDEEP
24576:vyjmji+qmbmhnjDQliEAYNQ4ys/j5yuMaJhgYnJ3rlGKYuxy4aJNU:66Xqe+njsliE9O4ymJVtr0KY94
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4592-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4592-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4592-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4592-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4596-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t9676602.exeu1680308.exeexplonde.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation t9676602.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation u1680308.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z9421974.exez5005073.exez4256902.exez2218442.exeq2187209.exer4623595.exes7625939.exet9676602.exeexplonde.exeu1680308.exelegota.exew2200674.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 1972 z9421974.exe 4588 z5005073.exe 1332 z4256902.exe 4060 z2218442.exe 3552 q2187209.exe 1184 r4623595.exe 4820 s7625939.exe 3856 t9676602.exe 4112 explonde.exe 2596 u1680308.exe 4116 legota.exe 5020 w2200674.exe 1576 legota.exe 3804 explonde.exe 3256 legota.exe 3968 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3460 rundll32.exe 5036 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exez9421974.exez5005073.exez4256902.exez2218442.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9421974.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z5005073.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z4256902.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z2218442.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q2187209.exer4623595.exes7625939.exedescription pid process target process PID 3552 set thread context of 4596 3552 q2187209.exe AppLaunch.exe PID 1184 set thread context of 4592 1184 r4623595.exe AppLaunch.exe PID 4820 set thread context of 4856 4820 s7625939.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2580 3552 WerFault.exe q2187209.exe 2628 1184 WerFault.exe r4623595.exe 5080 4592 WerFault.exe AppLaunch.exe 4848 4820 WerFault.exe s7625939.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2496 schtasks.exe 4140 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4596 AppLaunch.exe 4596 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4596 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exez9421974.exez5005073.exez4256902.exez2218442.exeq2187209.exer4623595.exes7625939.exet9676602.exeu1680308.exeexplonde.exedescription pid process target process PID 2036 wrote to memory of 1972 2036 20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe z9421974.exe PID 2036 wrote to memory of 1972 2036 20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe z9421974.exe PID 2036 wrote to memory of 1972 2036 20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe z9421974.exe PID 1972 wrote to memory of 4588 1972 z9421974.exe z5005073.exe PID 1972 wrote to memory of 4588 1972 z9421974.exe z5005073.exe PID 1972 wrote to memory of 4588 1972 z9421974.exe z5005073.exe PID 4588 wrote to memory of 1332 4588 z5005073.exe z4256902.exe PID 4588 wrote to memory of 1332 4588 z5005073.exe z4256902.exe PID 4588 wrote to memory of 1332 4588 z5005073.exe z4256902.exe PID 1332 wrote to memory of 4060 1332 z4256902.exe z2218442.exe PID 1332 wrote to memory of 4060 1332 z4256902.exe z2218442.exe PID 1332 wrote to memory of 4060 1332 z4256902.exe z2218442.exe PID 4060 wrote to memory of 3552 4060 z2218442.exe q2187209.exe PID 4060 wrote to memory of 3552 4060 z2218442.exe q2187209.exe PID 4060 wrote to memory of 3552 4060 z2218442.exe q2187209.exe PID 3552 wrote to memory of 4596 3552 q2187209.exe AppLaunch.exe PID 3552 wrote to memory of 4596 3552 q2187209.exe AppLaunch.exe PID 3552 wrote to memory of 4596 3552 q2187209.exe AppLaunch.exe PID 3552 wrote to memory of 4596 3552 q2187209.exe AppLaunch.exe PID 3552 wrote to memory of 4596 3552 q2187209.exe AppLaunch.exe PID 3552 wrote to memory of 4596 3552 q2187209.exe AppLaunch.exe PID 3552 wrote to memory of 4596 3552 q2187209.exe AppLaunch.exe PID 3552 wrote to memory of 4596 3552 q2187209.exe AppLaunch.exe PID 4060 wrote to memory of 1184 4060 z2218442.exe r4623595.exe PID 4060 wrote to memory of 1184 4060 z2218442.exe r4623595.exe PID 4060 wrote to memory of 1184 4060 z2218442.exe r4623595.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1184 wrote to memory of 4592 1184 r4623595.exe AppLaunch.exe PID 1332 wrote to memory of 4820 1332 z4256902.exe s7625939.exe PID 1332 wrote to memory of 4820 1332 z4256902.exe s7625939.exe PID 1332 wrote to memory of 4820 1332 z4256902.exe s7625939.exe PID 4820 wrote to memory of 4856 4820 s7625939.exe AppLaunch.exe PID 4820 wrote to memory of 4856 4820 s7625939.exe AppLaunch.exe PID 4820 wrote to memory of 4856 4820 s7625939.exe AppLaunch.exe PID 4820 wrote to memory of 4856 4820 s7625939.exe AppLaunch.exe PID 4820 wrote to memory of 4856 4820 s7625939.exe AppLaunch.exe PID 4820 wrote to memory of 4856 4820 s7625939.exe AppLaunch.exe PID 4820 wrote to memory of 4856 4820 s7625939.exe AppLaunch.exe PID 4820 wrote to memory of 4856 4820 s7625939.exe AppLaunch.exe PID 4588 wrote to memory of 3856 4588 z5005073.exe t9676602.exe PID 4588 wrote to memory of 3856 4588 z5005073.exe t9676602.exe PID 4588 wrote to memory of 3856 4588 z5005073.exe t9676602.exe PID 3856 wrote to memory of 4112 3856 t9676602.exe explonde.exe PID 3856 wrote to memory of 4112 3856 t9676602.exe explonde.exe PID 3856 wrote to memory of 4112 3856 t9676602.exe explonde.exe PID 1972 wrote to memory of 2596 1972 z9421974.exe u1680308.exe PID 1972 wrote to memory of 2596 1972 z9421974.exe u1680308.exe PID 1972 wrote to memory of 2596 1972 z9421974.exe u1680308.exe PID 2596 wrote to memory of 4116 2596 u1680308.exe legota.exe PID 2596 wrote to memory of 4116 2596 u1680308.exe legota.exe PID 2596 wrote to memory of 4116 2596 u1680308.exe legota.exe PID 4112 wrote to memory of 4140 4112 explonde.exe schtasks.exe PID 4112 wrote to memory of 4140 4112 explonde.exe schtasks.exe PID 4112 wrote to memory of 4140 4112 explonde.exe schtasks.exe PID 2036 wrote to memory of 5020 2036 20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe w2200674.exe PID 2036 wrote to memory of 5020 2036 20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe w2200674.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe"C:\Users\Admin\AppData\Local\Temp\20d7071167303358c048c903cffb2d2f1277e182cb695ae1b0804a6cb6572885.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9421974.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9421974.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5005073.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5005073.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4256902.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4256902.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2218442.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2218442.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2187209.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2187209.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4623595.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4623595.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 5887⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7625939.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7625939.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 1566⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9676602.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9676602.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1680308.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1680308.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2200674.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2200674.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3552 -ip 35521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1184 -ip 11841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4592 -ip 45921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4820 -ip 48201⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2200674.exeFilesize
22KB
MD5b9f77db9817fec4e1878db254d5ffadd
SHA1b56f7259ccbd174b2da1cf3bd33a53583ef4e848
SHA2569fa168b01466e78690cdd63452f1c7a736904c42305d76b08abb8b02356390f3
SHA512d47075130656b64b17c47087834018d082019811e205cbabf318ad623bed9c774d57d5b6ac9e15ff091067adb71ba0f85676ac21a5c8c43328aec4e53d1dabd4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2200674.exeFilesize
22KB
MD5b9f77db9817fec4e1878db254d5ffadd
SHA1b56f7259ccbd174b2da1cf3bd33a53583ef4e848
SHA2569fa168b01466e78690cdd63452f1c7a736904c42305d76b08abb8b02356390f3
SHA512d47075130656b64b17c47087834018d082019811e205cbabf318ad623bed9c774d57d5b6ac9e15ff091067adb71ba0f85676ac21a5c8c43328aec4e53d1dabd4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9421974.exeFilesize
1.2MB
MD5a02a05c8b29fb0f62b2382a761533a51
SHA19ce3470c951b3b8d70986058bfc7ee5538175d59
SHA2569b560d0e4010d57bbf6c9f40f37498b80ab46ff5ad8e1eebc4b75ed3c7b74abe
SHA5123cdb4d9ad6746ea813b0bd785fa86fda3047848ad0059288142ffa7b694af9f943b7c7d62494d94790cd5a024560fde23a487d138782aed15c904e26fb61df66
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9421974.exeFilesize
1.2MB
MD5a02a05c8b29fb0f62b2382a761533a51
SHA19ce3470c951b3b8d70986058bfc7ee5538175d59
SHA2569b560d0e4010d57bbf6c9f40f37498b80ab46ff5ad8e1eebc4b75ed3c7b74abe
SHA5123cdb4d9ad6746ea813b0bd785fa86fda3047848ad0059288142ffa7b694af9f943b7c7d62494d94790cd5a024560fde23a487d138782aed15c904e26fb61df66
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1680308.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1680308.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5005073.exeFilesize
1.0MB
MD5684894db74a8bf4dd17d93b9963c3b23
SHA114ea7dd11d62fe50b3e093c3c6712849a236e4ce
SHA256ebdd56039df1247959946df8c22f25db2fb3a8d95caf399d7522109a86a4cdd1
SHA512daf7d73ad486af8c559f3642597858b9257c73e9dd153ebdc5fa759e54bc2cf5dfee77eaf453c32ddbb7b9da3f14f8cba618b2aa2e3f3f3ad8ba8c4a73d63387
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5005073.exeFilesize
1.0MB
MD5684894db74a8bf4dd17d93b9963c3b23
SHA114ea7dd11d62fe50b3e093c3c6712849a236e4ce
SHA256ebdd56039df1247959946df8c22f25db2fb3a8d95caf399d7522109a86a4cdd1
SHA512daf7d73ad486af8c559f3642597858b9257c73e9dd153ebdc5fa759e54bc2cf5dfee77eaf453c32ddbb7b9da3f14f8cba618b2aa2e3f3f3ad8ba8c4a73d63387
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9676602.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9676602.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4256902.exeFilesize
885KB
MD5f4efd695a686d5b9cbcaef95c44d1816
SHA15e2124ffdf088cae68a41e3f5c04d7f8bb9740bc
SHA256471671135770ede3bfdda2f3ba461b42d32eeb5bd9ff53cf5be5e1c1ed2f0840
SHA5128a280f4d2faaf435a58a278fadcee1e89569a77cabdce931b4a47e1618cb9abe73d3804a8642aefd4dd204a795c5edfab2ee0868f9140e0edcdafe6b5eda8a8e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4256902.exeFilesize
885KB
MD5f4efd695a686d5b9cbcaef95c44d1816
SHA15e2124ffdf088cae68a41e3f5c04d7f8bb9740bc
SHA256471671135770ede3bfdda2f3ba461b42d32eeb5bd9ff53cf5be5e1c1ed2f0840
SHA5128a280f4d2faaf435a58a278fadcee1e89569a77cabdce931b4a47e1618cb9abe73d3804a8642aefd4dd204a795c5edfab2ee0868f9140e0edcdafe6b5eda8a8e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7625939.exeFilesize
1.0MB
MD5666f78d526d61112d4e51accae7110aa
SHA14f749e6dc6c86a2e0cc7d52fd9612ee008077dd4
SHA256decbb90d91e55b7b532472ffdd236dd6d1a578a9e1f6bed354951f0edb53c0bb
SHA51226e60a86a2e1839599c2fa4f2fc2c51d4af0c2d971f44c418f137f33184768f704b3f685c0f377197a9ed4d078be7512fd8b77e5d47337402fed613dfd8aae09
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7625939.exeFilesize
1.0MB
MD5666f78d526d61112d4e51accae7110aa
SHA14f749e6dc6c86a2e0cc7d52fd9612ee008077dd4
SHA256decbb90d91e55b7b532472ffdd236dd6d1a578a9e1f6bed354951f0edb53c0bb
SHA51226e60a86a2e1839599c2fa4f2fc2c51d4af0c2d971f44c418f137f33184768f704b3f685c0f377197a9ed4d078be7512fd8b77e5d47337402fed613dfd8aae09
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2218442.exeFilesize
494KB
MD5cbccc619a74a283565196d2b8cd6bd0a
SHA1bc991e53832849642776e032bde934f87c3b102b
SHA2562d260acd7593b8382ca2d78589f6b06804949abede8c54088f61f4bbfb5400a5
SHA51232fe035ba407a15148d3921208f78f51a0d41135850d0c0ec47083b546ebde0a0ad215aae7e70227bcd9f11c38a62b9f3f80e6278ee424cedfcec8e54d7efff4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2218442.exeFilesize
494KB
MD5cbccc619a74a283565196d2b8cd6bd0a
SHA1bc991e53832849642776e032bde934f87c3b102b
SHA2562d260acd7593b8382ca2d78589f6b06804949abede8c54088f61f4bbfb5400a5
SHA51232fe035ba407a15148d3921208f78f51a0d41135850d0c0ec47083b546ebde0a0ad215aae7e70227bcd9f11c38a62b9f3f80e6278ee424cedfcec8e54d7efff4
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2187209.exeFilesize
860KB
MD5426a7991d4da3ccbeb5374118f9200bd
SHA19c7d9be33c3c12e2c488455f7c12f89544f3bea4
SHA2565d5bf6486e49ce0a196afbd60e365ff3a34cba5b9ba538ff2375e153f886f964
SHA5125d7373ca4e69c1b8ff6c538ef4fca93591963fe51372114a68fe92b72d0cc8cd4bde3eb77c866316bdb327e8bb25ceeca01c0bfd0d37cf28f2770d44fc01daaa
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2187209.exeFilesize
860KB
MD5426a7991d4da3ccbeb5374118f9200bd
SHA19c7d9be33c3c12e2c488455f7c12f89544f3bea4
SHA2565d5bf6486e49ce0a196afbd60e365ff3a34cba5b9ba538ff2375e153f886f964
SHA5125d7373ca4e69c1b8ff6c538ef4fca93591963fe51372114a68fe92b72d0cc8cd4bde3eb77c866316bdb327e8bb25ceeca01c0bfd0d37cf28f2770d44fc01daaa
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4623595.exeFilesize
1016KB
MD5be6101c689029e637ea23174827cec03
SHA1e01125d84554a9e080bd5c20f69fd1ab391ffecf
SHA256d81ed0fcbab7e706e6aa4067cdc99bebf43254d2c7e52d5b9dcabb060a68651a
SHA51220b01aa5635783232917c9fa3dde4f5772b6c2dbec2c4192ae5bdad03fb46425b78f270279de88304836a766612770a402b077487a06daae5910ee3c13ea7e18
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4623595.exeFilesize
1016KB
MD5be6101c689029e637ea23174827cec03
SHA1e01125d84554a9e080bd5c20f69fd1ab391ffecf
SHA256d81ed0fcbab7e706e6aa4067cdc99bebf43254d2c7e52d5b9dcabb060a68651a
SHA51220b01aa5635783232917c9fa3dde4f5772b6c2dbec2c4192ae5bdad03fb46425b78f270279de88304836a766612770a402b077487a06daae5910ee3c13ea7e18
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/4592-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4592-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4592-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4592-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4596-37-0x0000000073D50000-0x0000000074500000-memory.dmpFilesize
7.7MB
-
memory/4596-86-0x0000000073D50000-0x0000000074500000-memory.dmpFilesize
7.7MB
-
memory/4596-36-0x0000000073D50000-0x0000000074500000-memory.dmpFilesize
7.7MB
-
memory/4596-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4856-90-0x00000000058C0000-0x00000000058D0000-memory.dmpFilesize
64KB
-
memory/4856-89-0x0000000073D50000-0x0000000074500000-memory.dmpFilesize
7.7MB
-
memory/4856-49-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4856-51-0x0000000073D50000-0x0000000074500000-memory.dmpFilesize
7.7MB
-
memory/4856-50-0x0000000005820000-0x0000000005826000-memory.dmpFilesize
24KB
-
memory/4856-65-0x0000000005A60000-0x0000000005A9C000-memory.dmpFilesize
240KB
-
memory/4856-61-0x0000000005A00000-0x0000000005A12000-memory.dmpFilesize
72KB
-
memory/4856-59-0x00000000058C0000-0x00000000058D0000-memory.dmpFilesize
64KB
-
memory/4856-58-0x0000000005AE0000-0x0000000005BEA000-memory.dmpFilesize
1.0MB
-
memory/4856-74-0x0000000005BF0000-0x0000000005C3C000-memory.dmpFilesize
304KB
-
memory/4856-57-0x0000000005FF0000-0x0000000006608000-memory.dmpFilesize
6.1MB