Analysis

  • max time kernel
    119s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-03-2023 19:42

General

  • Target

    0f1f920aa4b3896a48e8c75e905d85bb.exe

  • Size

    1.0MB

  • MD5

    0f1f920aa4b3896a48e8c75e905d85bb

  • SHA1

    c5efbf0bafc3b7e4ad7c73fa9db56460ac847e0e

  • SHA256

    503d5319043218957ec4c22e93ea5184430cdaf4c5d0f013d347a892ea095a7c

  • SHA512

    0e3c6aeef94db8bfa3a132ce04579af8f19feaa549a6325012d75f5aa74a2fffb3b0b7b0319c6744f3d9b8dc9415e12b2dd20daa2413de433d6f6d13be9246e8

  • SSDEEP

    24576:6yDwVVyWxw79M3A0XWYGi7ln5UHNIInjy97Sry5i:BENKTMRGi7dZAu7Sry

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

C2

193.233.20.30:4125

Attributes
  • auth_value

    fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f1f920aa4b3896a48e8c75e905d85bb.exe
    "C:\Users\Admin\AppData\Local\Temp\0f1f920aa4b3896a48e8c75e905d85bb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0447.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0447.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2998.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2998.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3808
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3682.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3682.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx8538Ow.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx8538Ow.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3596
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns5647hy.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns5647hy.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4140
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1080
              6⤵
              • Program crash
              PID:1488
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1088
              6⤵
              • Program crash
              PID:4292
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py95Jq37.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py95Jq37.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4828
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 2096
            5⤵
            • Program crash
            PID:4884
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1752
            5⤵
            • Program crash
            PID:1584
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1816
            5⤵
            • Program crash
            PID:4628
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs2372Bk.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs2372Bk.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3004
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry23Ao65.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry23Ao65.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3284
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2484
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3224
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:4568
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:448
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:988
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:2352
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:3288
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:3928
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4140 -ip 4140
                1⤵
                  PID:4104
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4140 -ip 4140
                  1⤵
                    PID:2572
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4828 -ip 4828
                    1⤵
                      PID:1760
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4828 -ip 4828
                      1⤵
                        PID:4852
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4828 -ip 4828
                        1⤵
                          PID:4996
                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          1⤵
                          • Executes dropped EXE
                          PID:3768
                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          1⤵
                          • Executes dropped EXE
                          PID:3612

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Execution

                        Scheduled Task

                        1
                        T1053

                        Persistence

                        Modify Existing Service

                        1
                        T1031

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Scheduled Task

                        1
                        T1053

                        Privilege Escalation

                        Scheduled Task

                        1
                        T1053

                        Defense Evasion

                        Modify Registry

                        3
                        T1112

                        Disabling Security Tools

                        2
                        T1089

                        Credential Access

                        Credentials in Files

                        2
                        T1081

                        Discovery

                        Query Registry

                        2
                        T1012

                        System Information Discovery

                        2
                        T1082

                        Collection

                        Data from Local System

                        2
                        T1005

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry23Ao65.exe
                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry23Ao65.exe
                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0447.exe
                          Filesize

                          853KB

                          MD5

                          0a87322d7adcf0c5c180780b9c77e97c

                          SHA1

                          6b22ad5a2e1f56e34f7726d389bd1d3f028f1168

                          SHA256

                          99a7ba3044a99483a545ed2d1ee7f2843610f9a93bf3970de1973e04adcd6e4b

                          SHA512

                          59f97a1a4232fd54ae845d059c1e792befe76df23f4eb23df7ea3d6fd8436cf42b02b5a5f0e5157028f6eabbcd8015468d5761d4aa8064de672a6ed0c03e4336

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0447.exe
                          Filesize

                          853KB

                          MD5

                          0a87322d7adcf0c5c180780b9c77e97c

                          SHA1

                          6b22ad5a2e1f56e34f7726d389bd1d3f028f1168

                          SHA256

                          99a7ba3044a99483a545ed2d1ee7f2843610f9a93bf3970de1973e04adcd6e4b

                          SHA512

                          59f97a1a4232fd54ae845d059c1e792befe76df23f4eb23df7ea3d6fd8436cf42b02b5a5f0e5157028f6eabbcd8015468d5761d4aa8064de672a6ed0c03e4336

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs2372Bk.exe
                          Filesize

                          175KB

                          MD5

                          3389637c0d072121bf1b127629736d37

                          SHA1

                          300e915efdf2479bfd0d3699c0a6bc51260f9655

                          SHA256

                          2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

                          SHA512

                          a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs2372Bk.exe
                          Filesize

                          175KB

                          MD5

                          3389637c0d072121bf1b127629736d37

                          SHA1

                          300e915efdf2479bfd0d3699c0a6bc51260f9655

                          SHA256

                          2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

                          SHA512

                          a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2998.exe
                          Filesize

                          707KB

                          MD5

                          56626e6dcdeb89c9dced93c2d25d3253

                          SHA1

                          d51a854bd966ace1eef6458f652103ceddadb90b

                          SHA256

                          b80d075012ed7994631c4bbf6665222e53528ab6f9a4f399ef874c331a6642cd

                          SHA512

                          77d285b94882ea549e46cc8491ff4102a2ed9b82e78644a43429ab6817f2cc063e54a3fe15661d96111ae0f1765932beaf77a92eea8f816aa9cc003e74c27f76

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2998.exe
                          Filesize

                          707KB

                          MD5

                          56626e6dcdeb89c9dced93c2d25d3253

                          SHA1

                          d51a854bd966ace1eef6458f652103ceddadb90b

                          SHA256

                          b80d075012ed7994631c4bbf6665222e53528ab6f9a4f399ef874c331a6642cd

                          SHA512

                          77d285b94882ea549e46cc8491ff4102a2ed9b82e78644a43429ab6817f2cc063e54a3fe15661d96111ae0f1765932beaf77a92eea8f816aa9cc003e74c27f76

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py95Jq37.exe
                          Filesize

                          391KB

                          MD5

                          32900c07c552b01464a8d39369273bd0

                          SHA1

                          676c0476d2bc5ce6e91196478656cad1406f0a18

                          SHA256

                          bf0bc700193b5e784c08adb78cd742d4dc5f584d7381e66d085572e2c00c020c

                          SHA512

                          b3f8f546169f8e9d04206e59ed67f0e14a677ec9346dddb54884a55c4022a277adb862cb0b2fe3965ec5902e130a955dd9ec538e3291d2993d7aec6cd25d40b1

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py95Jq37.exe
                          Filesize

                          391KB

                          MD5

                          32900c07c552b01464a8d39369273bd0

                          SHA1

                          676c0476d2bc5ce6e91196478656cad1406f0a18

                          SHA256

                          bf0bc700193b5e784c08adb78cd742d4dc5f584d7381e66d085572e2c00c020c

                          SHA512

                          b3f8f546169f8e9d04206e59ed67f0e14a677ec9346dddb54884a55c4022a277adb862cb0b2fe3965ec5902e130a955dd9ec538e3291d2993d7aec6cd25d40b1

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3682.exe
                          Filesize

                          354KB

                          MD5

                          a201a9b752f6f94abf8956d98ea9dacf

                          SHA1

                          0c7085f081cecdb9b64c9c9e98e4ca99e1603a42

                          SHA256

                          d7ef34afe822dbae921174b407078b3ebf5d72759aa1d46dbf120be2f7c8338d

                          SHA512

                          75d70320cb23842d97b807aa833003c5359a4c19fac5edb8ef7059f99b64ef4e02372677b036372850136cb4fae3f1fcb2c696e2e278980d5a178c00af257ff5

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will3682.exe
                          Filesize

                          354KB

                          MD5

                          a201a9b752f6f94abf8956d98ea9dacf

                          SHA1

                          0c7085f081cecdb9b64c9c9e98e4ca99e1603a42

                          SHA256

                          d7ef34afe822dbae921174b407078b3ebf5d72759aa1d46dbf120be2f7c8338d

                          SHA512

                          75d70320cb23842d97b807aa833003c5359a4c19fac5edb8ef7059f99b64ef4e02372677b036372850136cb4fae3f1fcb2c696e2e278980d5a178c00af257ff5

                        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx8538Ow.exe
                          Filesize

                          11KB

                          MD5

                          7e93bacbbc33e6652e147e7fe07572a0

                          SHA1

                          421a7167da01c8da4dc4d5234ca3dd84e319e762

                          SHA256

                          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                          SHA512

                          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx8538Ow.exe
                          Filesize

                          11KB

                          MD5

                          7e93bacbbc33e6652e147e7fe07572a0

                          SHA1

                          421a7167da01c8da4dc4d5234ca3dd84e319e762

                          SHA256

                          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                          SHA512

                          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns5647hy.exe
                          Filesize

                          333KB

                          MD5

                          b1472587c13c720f9c75b9c1b31fb97d

                          SHA1

                          3c3d68962d3e814d1e27c289309b26640619131d

                          SHA256

                          5cc07c63dee40bb15e2f093103bfb797ffb44f2f9da2b74df65a2f3cb89a6d87

                          SHA512

                          c292cf6f5ee3585e509115c087affde0ef314cc16c2db2452ced2facf22796f224d6d31865c6fa1a5c2fcd65871cd815a58bf18bd5a19ad7198f17a26df7d063

                        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns5647hy.exe
                          Filesize

                          333KB

                          MD5

                          b1472587c13c720f9c75b9c1b31fb97d

                          SHA1

                          3c3d68962d3e814d1e27c289309b26640619131d

                          SHA256

                          5cc07c63dee40bb15e2f093103bfb797ffb44f2f9da2b74df65a2f3cb89a6d87

                          SHA512

                          c292cf6f5ee3585e509115c087affde0ef314cc16c2db2452ced2facf22796f224d6d31865c6fa1a5c2fcd65871cd815a58bf18bd5a19ad7198f17a26df7d063

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                          Filesize

                          235KB

                          MD5

                          5086db99de54fca268169a1c6cf26122

                          SHA1

                          003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                          SHA256

                          42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                          SHA512

                          90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                          Filesize

                          89KB

                          MD5

                          16cf28ebb6d37dbaba93f18320c6086e

                          SHA1

                          eae7d4b7a9636329065877aabe8d4f721a26ab25

                          SHA256

                          c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                          SHA512

                          f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                          Filesize

                          223B

                          MD5

                          94cbeec5d4343918fd0e48760e40539c

                          SHA1

                          a049266c5c1131f692f306c8710d7e72586ae79d

                          SHA256

                          48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                          SHA512

                          4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

                        • memory/3004-1142-0x0000000005630000-0x0000000005640000-memory.dmp
                          Filesize

                          64KB

                        • memory/3004-1141-0x0000000000900000-0x0000000000932000-memory.dmp
                          Filesize

                          200KB

                        • memory/3596-161-0x0000000000CD0000-0x0000000000CDA000-memory.dmp
                          Filesize

                          40KB

                        • memory/4140-183-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-189-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-191-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-193-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-195-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-197-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-199-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-200-0x0000000000400000-0x0000000002B03000-memory.dmp
                          Filesize

                          39.0MB

                        • memory/4140-202-0x0000000007270000-0x0000000007280000-memory.dmp
                          Filesize

                          64KB

                        • memory/4140-203-0x0000000007270000-0x0000000007280000-memory.dmp
                          Filesize

                          64KB

                        • memory/4140-204-0x0000000007270000-0x0000000007280000-memory.dmp
                          Filesize

                          64KB

                        • memory/4140-205-0x0000000000400000-0x0000000002B03000-memory.dmp
                          Filesize

                          39.0MB

                        • memory/4140-187-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-185-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-181-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-179-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-177-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-175-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-173-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-172-0x0000000004C80000-0x0000000004C92000-memory.dmp
                          Filesize

                          72KB

                        • memory/4140-171-0x0000000007270000-0x0000000007280000-memory.dmp
                          Filesize

                          64KB

                        • memory/4140-170-0x0000000007270000-0x0000000007280000-memory.dmp
                          Filesize

                          64KB

                        • memory/4140-169-0x0000000007270000-0x0000000007280000-memory.dmp
                          Filesize

                          64KB

                        • memory/4140-168-0x0000000007280000-0x0000000007824000-memory.dmp
                          Filesize

                          5.6MB

                        • memory/4140-167-0x0000000002C30000-0x0000000002C5D000-memory.dmp
                          Filesize

                          180KB

                        • memory/4828-217-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-232-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-235-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-237-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-239-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-241-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-243-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-245-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-247-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-1120-0x0000000007860000-0x0000000007E78000-memory.dmp
                          Filesize

                          6.1MB

                        • memory/4828-1121-0x0000000007F00000-0x000000000800A000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/4828-1122-0x0000000008040000-0x0000000008052000-memory.dmp
                          Filesize

                          72KB

                        • memory/4828-1123-0x0000000008060000-0x000000000809C000-memory.dmp
                          Filesize

                          240KB

                        • memory/4828-1124-0x0000000004C00000-0x0000000004C10000-memory.dmp
                          Filesize

                          64KB

                        • memory/4828-1126-0x0000000008350000-0x00000000083B6000-memory.dmp
                          Filesize

                          408KB

                        • memory/4828-1127-0x0000000008A20000-0x0000000008AB2000-memory.dmp
                          Filesize

                          584KB

                        • memory/4828-1128-0x0000000004C00000-0x0000000004C10000-memory.dmp
                          Filesize

                          64KB

                        • memory/4828-1130-0x0000000004C00000-0x0000000004C10000-memory.dmp
                          Filesize

                          64KB

                        • memory/4828-1129-0x0000000004C00000-0x0000000004C10000-memory.dmp
                          Filesize

                          64KB

                        • memory/4828-1131-0x0000000008F50000-0x0000000009112000-memory.dmp
                          Filesize

                          1.8MB

                        • memory/4828-1132-0x0000000009140000-0x000000000966C000-memory.dmp
                          Filesize

                          5.2MB

                        • memory/4828-1133-0x0000000009790000-0x0000000009806000-memory.dmp
                          Filesize

                          472KB

                        • memory/4828-233-0x0000000004C00000-0x0000000004C10000-memory.dmp
                          Filesize

                          64KB

                        • memory/4828-229-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-230-0x0000000004C00000-0x0000000004C10000-memory.dmp
                          Filesize

                          64KB

                        • memory/4828-228-0x0000000004C00000-0x0000000004C10000-memory.dmp
                          Filesize

                          64KB

                        • memory/4828-227-0x0000000002DF0000-0x0000000002E3B000-memory.dmp
                          Filesize

                          300KB

                        • memory/4828-225-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-223-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-221-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-219-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-215-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-213-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-210-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-211-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                          Filesize

                          248KB

                        • memory/4828-1134-0x0000000009830000-0x0000000009880000-memory.dmp
                          Filesize

                          320KB

                        • memory/4828-1136-0x0000000004C00000-0x0000000004C10000-memory.dmp
                          Filesize

                          64KB