Analysis
-
max time kernel
109s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23-03-2023 03:47
Static task
static1
Behavioral task
behavioral1
Sample
1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe
Resource
win10-20230220-en
General
-
Target
1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe
-
Size
1012KB
-
MD5
65190b7360b9c184d8ba5c2f552c0e46
-
SHA1
796c4a54ca43a2e521c84a8ec5f54529729e7cb7
-
SHA256
1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169
-
SHA512
b30b836e0101870aac8dff34db19769414e26e4c3b68fc682e4d2fc809d760091bce87b64ab6e02ddf6b532199243bdfc298ca2bdc496f2e4847d80f60ae578d
-
SSDEEP
24576:tyBzMFIJeniEdyJvDs5ryPtG134s1DBgyC:IBAKJe2DswPtGRJ3
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
lown
193.233.20.31:4125
-
auth_value
4cf836e062bcdc2a4fdbf410f5747ec7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
@REDLINEVIPCHAT Cloud (TG: @FATHEROFCARDERS)
151.80.89.234:19388
-
auth_value
56af49c3278d982f9a41ef2abb7c4d09
Signatures
-
Processes:
v9048IT.exetz0861.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v9048IT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz0861.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz0861.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz0861.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v9048IT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v9048IT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v9048IT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v9048IT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz0861.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz0861.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3928-200-0x0000000004B80000-0x0000000004BC6000-memory.dmp family_redline behavioral1/memory/3928-201-0x0000000007620000-0x0000000007664000-memory.dmp family_redline behavioral1/memory/3928-202-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-203-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-205-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-209-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-207-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-211-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-213-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-219-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-215-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-225-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-222-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-227-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-229-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-231-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-237-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-235-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-233-0x0000000007620000-0x000000000765E000-memory.dmp family_redline behavioral1/memory/3928-239-0x0000000007620000-0x000000000765E000-memory.dmp family_redline -
Downloads MZ/PE file
-
.NET Reactor proctector 6 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe net_reactor C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe net_reactor C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe net_reactor behavioral1/memory/2168-1224-0x00000000009F0000-0x0000000000F64000-memory.dmp net_reactor behavioral1/memory/2168-1226-0x00000000058C0000-0x000000000594E000-memory.dmp net_reactor C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe net_reactor -
Executes dropped EXE 16 IoCs
Processes:
zap1809.exezap9793.exezap2859.exetz0861.exev9048IT.exew75pD77.exexishF64.exey52gx15.exelegenda.exe10MIL.exess47.exess47.exeComPlusMethone.exeGood.exeGood.exelegenda.exepid process 2520 zap1809.exe 2904 zap9793.exe 3812 zap2859.exe 4252 tz0861.exe 2812 v9048IT.exe 3928 w75pD77.exe 1540 xishF64.exe 4736 y52gx15.exe 2080 legenda.exe 4844 10MIL.exe 5028 ss47.exe 1804 ss47.exe 1800 ComPlusMethone.exe 2168 Good.exe 3344 Good.exe 2504 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4248 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
v9048IT.exetz0861.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v9048IT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v9048IT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz0861.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
zap9793.exezap2859.exe1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exezap1809.exeGood.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap9793.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap2859.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap1809.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap1809.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap9793.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap2859.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyTestApplication = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000138001\\Good.exe" Good.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ComPlusMethone.exeGood.exedescription pid process target process PID 1800 set thread context of 4092 1800 ComPlusMethone.exe InstallUtil.exe PID 2168 set thread context of 3344 2168 Good.exe Good.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 InstallUtil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
tz0861.exev9048IT.exew75pD77.exexishF64.exe10MIL.exeInstallUtil.exepid process 4252 tz0861.exe 4252 tz0861.exe 2812 v9048IT.exe 2812 v9048IT.exe 3928 w75pD77.exe 3928 w75pD77.exe 1540 xishF64.exe 1540 xishF64.exe 4844 10MIL.exe 4844 10MIL.exe 4092 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
tz0861.exev9048IT.exew75pD77.exexishF64.exeComPlusMethone.exe10MIL.exeGood.exeInstallUtil.exeGood.exedescription pid process Token: SeDebugPrivilege 4252 tz0861.exe Token: SeDebugPrivilege 2812 v9048IT.exe Token: SeDebugPrivilege 3928 w75pD77.exe Token: SeDebugPrivilege 1540 xishF64.exe Token: SeDebugPrivilege 1800 ComPlusMethone.exe Token: SeDebugPrivilege 4844 10MIL.exe Token: SeDebugPrivilege 2168 Good.exe Token: SeDebugPrivilege 4092 InstallUtil.exe Token: SeDebugPrivilege 3344 Good.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exezap1809.exezap9793.exezap2859.exey52gx15.exelegenda.execmd.exeComPlusMethone.exedescription pid process target process PID 2284 wrote to memory of 2520 2284 1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe zap1809.exe PID 2284 wrote to memory of 2520 2284 1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe zap1809.exe PID 2284 wrote to memory of 2520 2284 1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe zap1809.exe PID 2520 wrote to memory of 2904 2520 zap1809.exe zap9793.exe PID 2520 wrote to memory of 2904 2520 zap1809.exe zap9793.exe PID 2520 wrote to memory of 2904 2520 zap1809.exe zap9793.exe PID 2904 wrote to memory of 3812 2904 zap9793.exe zap2859.exe PID 2904 wrote to memory of 3812 2904 zap9793.exe zap2859.exe PID 2904 wrote to memory of 3812 2904 zap9793.exe zap2859.exe PID 3812 wrote to memory of 4252 3812 zap2859.exe tz0861.exe PID 3812 wrote to memory of 4252 3812 zap2859.exe tz0861.exe PID 3812 wrote to memory of 2812 3812 zap2859.exe v9048IT.exe PID 3812 wrote to memory of 2812 3812 zap2859.exe v9048IT.exe PID 3812 wrote to memory of 2812 3812 zap2859.exe v9048IT.exe PID 2904 wrote to memory of 3928 2904 zap9793.exe w75pD77.exe PID 2904 wrote to memory of 3928 2904 zap9793.exe w75pD77.exe PID 2904 wrote to memory of 3928 2904 zap9793.exe w75pD77.exe PID 2520 wrote to memory of 1540 2520 zap1809.exe xishF64.exe PID 2520 wrote to memory of 1540 2520 zap1809.exe xishF64.exe PID 2520 wrote to memory of 1540 2520 zap1809.exe xishF64.exe PID 2284 wrote to memory of 4736 2284 1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe y52gx15.exe PID 2284 wrote to memory of 4736 2284 1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe y52gx15.exe PID 2284 wrote to memory of 4736 2284 1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe y52gx15.exe PID 4736 wrote to memory of 2080 4736 y52gx15.exe legenda.exe PID 4736 wrote to memory of 2080 4736 y52gx15.exe legenda.exe PID 4736 wrote to memory of 2080 4736 y52gx15.exe legenda.exe PID 2080 wrote to memory of 440 2080 legenda.exe schtasks.exe PID 2080 wrote to memory of 440 2080 legenda.exe schtasks.exe PID 2080 wrote to memory of 440 2080 legenda.exe schtasks.exe PID 2080 wrote to memory of 784 2080 legenda.exe cmd.exe PID 2080 wrote to memory of 784 2080 legenda.exe cmd.exe PID 2080 wrote to memory of 784 2080 legenda.exe cmd.exe PID 784 wrote to memory of 4392 784 cmd.exe cmd.exe PID 784 wrote to memory of 4392 784 cmd.exe cmd.exe PID 784 wrote to memory of 4392 784 cmd.exe cmd.exe PID 784 wrote to memory of 4376 784 cmd.exe cacls.exe PID 784 wrote to memory of 4376 784 cmd.exe cacls.exe PID 784 wrote to memory of 4376 784 cmd.exe cacls.exe PID 784 wrote to memory of 5092 784 cmd.exe cacls.exe PID 784 wrote to memory of 5092 784 cmd.exe cacls.exe PID 784 wrote to memory of 5092 784 cmd.exe cacls.exe PID 784 wrote to memory of 5088 784 cmd.exe cmd.exe PID 784 wrote to memory of 5088 784 cmd.exe cmd.exe PID 784 wrote to memory of 5088 784 cmd.exe cmd.exe PID 784 wrote to memory of 4448 784 cmd.exe cacls.exe PID 784 wrote to memory of 4448 784 cmd.exe cacls.exe PID 784 wrote to memory of 4448 784 cmd.exe cacls.exe PID 784 wrote to memory of 4900 784 cmd.exe cacls.exe PID 784 wrote to memory of 4900 784 cmd.exe cacls.exe PID 784 wrote to memory of 4900 784 cmd.exe cacls.exe PID 2080 wrote to memory of 4844 2080 legenda.exe 10MIL.exe PID 2080 wrote to memory of 4844 2080 legenda.exe 10MIL.exe PID 2080 wrote to memory of 4844 2080 legenda.exe 10MIL.exe PID 2080 wrote to memory of 5028 2080 legenda.exe ss47.exe PID 2080 wrote to memory of 5028 2080 legenda.exe ss47.exe PID 2080 wrote to memory of 1804 2080 legenda.exe ss47.exe PID 2080 wrote to memory of 1804 2080 legenda.exe ss47.exe PID 2080 wrote to memory of 1800 2080 legenda.exe ComPlusMethone.exe PID 2080 wrote to memory of 1800 2080 legenda.exe ComPlusMethone.exe PID 2080 wrote to memory of 2168 2080 legenda.exe Good.exe PID 2080 wrote to memory of 2168 2080 legenda.exe Good.exe PID 2080 wrote to memory of 2168 2080 legenda.exe Good.exe PID 1800 wrote to memory of 4092 1800 ComPlusMethone.exe InstallUtil.exe PID 1800 wrote to memory of 4092 1800 ComPlusMethone.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe"C:\Users\Admin\AppData\Local\Temp\1fa191205a43c5fd98b734b93ca4f83cc6aebfc2721053113a9b118756a9f169.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1809.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1809.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9793.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9793.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2859.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2859.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0861.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0861.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9048IT.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9048IT.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75pD77.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75pD77.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xishF64.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xishF64.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y52gx15.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y52gx15.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exe"C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000135001\ss47.exe"C:\Users\Admin\AppData\Local\Temp\1000135001\ss47.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000136001\ss47.exe"C:\Users\Admin\AppData\Local\Temp\1000136001\ss47.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000137001\ComPlusMethone.exe"C:\Users\Admin\AppData\Local\Temp\1000137001\ComPlusMethone.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"5⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr All7⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile name="65001" key=clear7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr Key7⤵
-
C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe"C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe"C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exe"6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.17⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Good.exe.logFilesize
321B
MD5076d7c48064de4effadfe36d1857322d
SHA1273f4d3f67c4ec0a637317ce2a536e52cc1c2090
SHA2567cdcfb48cb249895caa7d3b5ce9ad53c7185d426f0f5669fe79bc5e047ff29ed
SHA512e540c14a5093a1607dd47b0cdf96e21957d1b70aae24dcd99cdb3e3292451222760e8106b1e6e6091928b9998a6d307709e39081565a5e49d85c64e03bc55abf
-
C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exeFilesize
175KB
MD5ff7f91fa0ee41b37bb8196d9bb44070c
SHA1b332b64d585e605dddc0c6d88a47323d8c3fc4d1
SHA25604a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e
SHA51258346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35
-
C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exeFilesize
175KB
MD5ff7f91fa0ee41b37bb8196d9bb44070c
SHA1b332b64d585e605dddc0c6d88a47323d8c3fc4d1
SHA25604a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e
SHA51258346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35
-
C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exeFilesize
175KB
MD5ff7f91fa0ee41b37bb8196d9bb44070c
SHA1b332b64d585e605dddc0c6d88a47323d8c3fc4d1
SHA25604a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e
SHA51258346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35
-
C:\Users\Admin\AppData\Local\Temp\1000135001\ss47.exeFilesize
866KB
MD544d59cf2b7e4700b703e95eaa7fdbdc7
SHA1879ad987dfd297aa23626ff824da3fd43a09f32f
SHA25643e4574bbe757104766b7299c8ebf76026f0932b079e6a0ecd4325f6c0ddb36f
SHA512a6ac926bafb1aae6e0c135b18fe1b4e86a73710ba7dda15950adf13ac2a67f7d0d7128d22175985eefbd1341c210448b1a48019f5590d09be23898969b4f0049
-
C:\Users\Admin\AppData\Local\Temp\1000135001\ss47.exeFilesize
866KB
MD544d59cf2b7e4700b703e95eaa7fdbdc7
SHA1879ad987dfd297aa23626ff824da3fd43a09f32f
SHA25643e4574bbe757104766b7299c8ebf76026f0932b079e6a0ecd4325f6c0ddb36f
SHA512a6ac926bafb1aae6e0c135b18fe1b4e86a73710ba7dda15950adf13ac2a67f7d0d7128d22175985eefbd1341c210448b1a48019f5590d09be23898969b4f0049
-
C:\Users\Admin\AppData\Local\Temp\1000135001\ss47.exeFilesize
866KB
MD544d59cf2b7e4700b703e95eaa7fdbdc7
SHA1879ad987dfd297aa23626ff824da3fd43a09f32f
SHA25643e4574bbe757104766b7299c8ebf76026f0932b079e6a0ecd4325f6c0ddb36f
SHA512a6ac926bafb1aae6e0c135b18fe1b4e86a73710ba7dda15950adf13ac2a67f7d0d7128d22175985eefbd1341c210448b1a48019f5590d09be23898969b4f0049
-
C:\Users\Admin\AppData\Local\Temp\1000136001\ss47.exeFilesize
866KB
MD544d59cf2b7e4700b703e95eaa7fdbdc7
SHA1879ad987dfd297aa23626ff824da3fd43a09f32f
SHA25643e4574bbe757104766b7299c8ebf76026f0932b079e6a0ecd4325f6c0ddb36f
SHA512a6ac926bafb1aae6e0c135b18fe1b4e86a73710ba7dda15950adf13ac2a67f7d0d7128d22175985eefbd1341c210448b1a48019f5590d09be23898969b4f0049
-
C:\Users\Admin\AppData\Local\Temp\1000136001\ss47.exeFilesize
866KB
MD544d59cf2b7e4700b703e95eaa7fdbdc7
SHA1879ad987dfd297aa23626ff824da3fd43a09f32f
SHA25643e4574bbe757104766b7299c8ebf76026f0932b079e6a0ecd4325f6c0ddb36f
SHA512a6ac926bafb1aae6e0c135b18fe1b4e86a73710ba7dda15950adf13ac2a67f7d0d7128d22175985eefbd1341c210448b1a48019f5590d09be23898969b4f0049
-
C:\Users\Admin\AppData\Local\Temp\1000137001\ComPlusMethone.exeFilesize
6.9MB
MD5cf52142e72a8cae6f9f667b19d098459
SHA1c2923e5a5f9aefebb037faf7841e777e6e81dfaf
SHA2565b30b08d05b34a4eb195a704e40efa8555e1985fab9886840c5f336a2e572671
SHA512c104213e0278fa18171a5235d0f1625029149410d6ace0eca2824d108bd1a7097cd931d81bc957bc03f431d93355f07f0e7719c0da181287104b8aeb5fdf82d6
-
C:\Users\Admin\AppData\Local\Temp\1000137001\ComPlusMethone.exeFilesize
6.9MB
MD5cf52142e72a8cae6f9f667b19d098459
SHA1c2923e5a5f9aefebb037faf7841e777e6e81dfaf
SHA2565b30b08d05b34a4eb195a704e40efa8555e1985fab9886840c5f336a2e572671
SHA512c104213e0278fa18171a5235d0f1625029149410d6ace0eca2824d108bd1a7097cd931d81bc957bc03f431d93355f07f0e7719c0da181287104b8aeb5fdf82d6
-
C:\Users\Admin\AppData\Local\Temp\1000137001\ComPlusMethone.exeFilesize
6.9MB
MD5cf52142e72a8cae6f9f667b19d098459
SHA1c2923e5a5f9aefebb037faf7841e777e6e81dfaf
SHA2565b30b08d05b34a4eb195a704e40efa8555e1985fab9886840c5f336a2e572671
SHA512c104213e0278fa18171a5235d0f1625029149410d6ace0eca2824d108bd1a7097cd931d81bc957bc03f431d93355f07f0e7719c0da181287104b8aeb5fdf82d6
-
C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exeFilesize
5.4MB
MD59086ff963ae98510ea0eb9abad045939
SHA1e9999c73e07daf9ba223fbf796d56ae762b748fa
SHA256138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f
SHA512f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee
-
C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exeFilesize
5.4MB
MD59086ff963ae98510ea0eb9abad045939
SHA1e9999c73e07daf9ba223fbf796d56ae762b748fa
SHA256138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f
SHA512f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee
-
C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exeFilesize
5.4MB
MD59086ff963ae98510ea0eb9abad045939
SHA1e9999c73e07daf9ba223fbf796d56ae762b748fa
SHA256138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f
SHA512f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee
-
C:\Users\Admin\AppData\Local\Temp\1000138001\Good.exeFilesize
5.4MB
MD59086ff963ae98510ea0eb9abad045939
SHA1e9999c73e07daf9ba223fbf796d56ae762b748fa
SHA256138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f
SHA512f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y52gx15.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y52gx15.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1809.exeFilesize
827KB
MD578e1f85ed84e8cf3dcb3f25e1e033e0e
SHA1b50232e3e1fc6ee2e5eacf477d2562454ef22eb7
SHA2563929423916d1b418bf1233b1e1ed8b417f7da87cd42efa36e1b8fbe3f74b6590
SHA512aa6c404fec5aaabd7024dfd30df86e50d0fa1efb201f30664b4576a8ae15a0405737659a37202cd03dce5de878bc18042584cf4ac3effd73ab0d835d243ed656
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1809.exeFilesize
827KB
MD578e1f85ed84e8cf3dcb3f25e1e033e0e
SHA1b50232e3e1fc6ee2e5eacf477d2562454ef22eb7
SHA2563929423916d1b418bf1233b1e1ed8b417f7da87cd42efa36e1b8fbe3f74b6590
SHA512aa6c404fec5aaabd7024dfd30df86e50d0fa1efb201f30664b4576a8ae15a0405737659a37202cd03dce5de878bc18042584cf4ac3effd73ab0d835d243ed656
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xishF64.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xishF64.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9793.exeFilesize
685KB
MD5075723e949f459bf183f2c7f50973589
SHA1c1f14ae63471da225bd849df4484ad1473a9b05d
SHA2560886797e3e8f9b59dc2f1b45aed7ff436e5d972f0c8ddf4bf84c9ce1df5f6200
SHA512371a6207ef23bae422e9238572dee24b0e5c194b20ed295449755c7b8f6cef0ad62c97e2d83b07f80de3b8b937615d6350670c16c09edf3ffd8c1c9c68f0a281
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9793.exeFilesize
685KB
MD5075723e949f459bf183f2c7f50973589
SHA1c1f14ae63471da225bd849df4484ad1473a9b05d
SHA2560886797e3e8f9b59dc2f1b45aed7ff436e5d972f0c8ddf4bf84c9ce1df5f6200
SHA512371a6207ef23bae422e9238572dee24b0e5c194b20ed295449755c7b8f6cef0ad62c97e2d83b07f80de3b8b937615d6350670c16c09edf3ffd8c1c9c68f0a281
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75pD77.exeFilesize
357KB
MD5ba6a17f2fd8bd4632579d470cc137179
SHA16d12f42c7659644abef5f48900b17c828b6cf6cf
SHA256498ac509677ec4cd72ef3842e0b2f3a33e673e5bed547b060674d308f2fea3b1
SHA512e97894475b56265d1c3e0af70daea585c7c227158a82ff4ead7cbbf9cbb0c2a3698aa35a8ac8f2ec314574c7b7e3e7cd8fd70e6569cb3454bf29452e38a35c33
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75pD77.exeFilesize
357KB
MD5ba6a17f2fd8bd4632579d470cc137179
SHA16d12f42c7659644abef5f48900b17c828b6cf6cf
SHA256498ac509677ec4cd72ef3842e0b2f3a33e673e5bed547b060674d308f2fea3b1
SHA512e97894475b56265d1c3e0af70daea585c7c227158a82ff4ead7cbbf9cbb0c2a3698aa35a8ac8f2ec314574c7b7e3e7cd8fd70e6569cb3454bf29452e38a35c33
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2859.exeFilesize
340KB
MD54526eae4d60c48067fc0d8b575c9fb62
SHA14868257c1b5d4e8da5c71fc2c03ae9d0f2f5a7de
SHA2561ea4a435f9ea23ea9dada800eb01d1b9e4590485b26d2a8368735c548ad2f1c6
SHA512037501e08be6c0b4d2ffa123043f10374a6c3446d481e3e86e1bfbca3de95bc2ba8be3af994c4f3c624e0f324438f5b636fef104cd8e3a3121db6eed1f18502a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2859.exeFilesize
340KB
MD54526eae4d60c48067fc0d8b575c9fb62
SHA14868257c1b5d4e8da5c71fc2c03ae9d0f2f5a7de
SHA2561ea4a435f9ea23ea9dada800eb01d1b9e4590485b26d2a8368735c548ad2f1c6
SHA512037501e08be6c0b4d2ffa123043f10374a6c3446d481e3e86e1bfbca3de95bc2ba8be3af994c4f3c624e0f324438f5b636fef104cd8e3a3121db6eed1f18502a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0861.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0861.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9048IT.exeFilesize
300KB
MD5d4959b664174cc353d5f70af04a09303
SHA1abce32c5a6075e3c0ddb5986213ea489ddb0d703
SHA256a88ece7b114b7f3d8224358d645c1be6238e3c821224d7aac04a597c2c675ca7
SHA5128f6191aa2b929fb2f977297387a6be82c46c983c1f8ba2a83a0de57f911e61138e06cde380239b68d868364df0b6ff29ccd5fc7c728852dbf2e214023cebd9f2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9048IT.exeFilesize
300KB
MD5d4959b664174cc353d5f70af04a09303
SHA1abce32c5a6075e3c0ddb5986213ea489ddb0d703
SHA256a88ece7b114b7f3d8224358d645c1be6238e3c821224d7aac04a597c2c675ca7
SHA5128f6191aa2b929fb2f977297387a6be82c46c983c1f8ba2a83a0de57f911e61138e06cde380239b68d868364df0b6ff29ccd5fc7c728852dbf2e214023cebd9f2
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
memory/1540-1133-0x00000000004E0000-0x0000000000512000-memory.dmpFilesize
200KB
-
memory/1540-1134-0x0000000004F20000-0x0000000004F6B000-memory.dmpFilesize
300KB
-
memory/1540-1135-0x0000000005020000-0x0000000005030000-memory.dmpFilesize
64KB
-
memory/1800-1208-0x0000000000970000-0x0000000001052000-memory.dmpFilesize
6.9MB
-
memory/1800-1210-0x0000000001690000-0x0000000001691000-memory.dmpFilesize
4KB
-
memory/1800-1225-0x000000001BD80000-0x000000001C000000-memory.dmpFilesize
2.5MB
-
memory/1800-1209-0x000000001BD70000-0x000000001BD80000-memory.dmpFilesize
64KB
-
memory/1804-1771-0x000002B512A90000-0x000002B512BC4000-memory.dmpFilesize
1.2MB
-
memory/1804-1194-0x000002B512A90000-0x000002B512BC4000-memory.dmpFilesize
1.2MB
-
memory/2168-1224-0x00000000009F0000-0x0000000000F64000-memory.dmpFilesize
5.5MB
-
memory/2168-1226-0x00000000058C0000-0x000000000594E000-memory.dmpFilesize
568KB
-
memory/2168-1259-0x00000000058B0000-0x00000000058C0000-memory.dmpFilesize
64KB
-
memory/2168-1260-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/2168-2618-0x00000000058B0000-0x00000000058C0000-memory.dmpFilesize
64KB
-
memory/2812-190-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/2812-169-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-155-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2812-156-0x0000000002EB0000-0x0000000002ECA000-memory.dmpFilesize
104KB
-
memory/2812-157-0x0000000007140000-0x000000000763E000-memory.dmpFilesize
5.0MB
-
memory/2812-158-0x00000000070A0000-0x00000000070B8000-memory.dmpFilesize
96KB
-
memory/2812-193-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2812-191-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2812-159-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2812-160-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2812-161-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/2812-162-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-163-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-165-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-167-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-195-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/2812-171-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-173-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-175-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-177-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-179-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-181-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-183-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-185-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-187-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-189-0x00000000070A0000-0x00000000070B2000-memory.dmpFilesize
72KB
-
memory/2812-192-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/3344-2706-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3344-2708-0x0000000005B00000-0x0000000005B10000-memory.dmpFilesize
64KB
-
memory/3928-1123-0x0000000008A00000-0x0000000008A76000-memory.dmpFilesize
472KB
-
memory/3928-225-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-213-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-211-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-207-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-209-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-205-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-203-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-202-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-222-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-227-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-201-0x0000000007620000-0x0000000007664000-memory.dmpFilesize
272KB
-
memory/3928-229-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-200-0x0000000004B80000-0x0000000004BC6000-memory.dmpFilesize
280KB
-
memory/3928-218-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/3928-219-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-220-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/3928-231-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-237-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-215-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-223-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/3928-1127-0x0000000008CE0000-0x000000000920C000-memory.dmpFilesize
5.2MB
-
memory/3928-1126-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/3928-1125-0x0000000008B10000-0x0000000008CD2000-memory.dmpFilesize
1.8MB
-
memory/3928-1124-0x0000000008A80000-0x0000000008AD0000-memory.dmpFilesize
320KB
-
memory/3928-216-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/3928-1122-0x0000000008830000-0x00000000088C2000-memory.dmpFilesize
584KB
-
memory/3928-1121-0x0000000008170000-0x00000000081D6000-memory.dmpFilesize
408KB
-
memory/3928-1120-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/3928-1119-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/3928-1117-0x0000000008020000-0x000000000806B000-memory.dmpFilesize
300KB
-
memory/3928-1116-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/3928-1115-0x0000000007E90000-0x0000000007ECE000-memory.dmpFilesize
248KB
-
memory/3928-1114-0x0000000007E70000-0x0000000007E82000-memory.dmpFilesize
72KB
-
memory/3928-235-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-233-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-239-0x0000000007620000-0x000000000765E000-memory.dmpFilesize
248KB
-
memory/3928-1112-0x00000000076A0000-0x0000000007CA6000-memory.dmpFilesize
6.0MB
-
memory/3928-1113-0x0000000007D30000-0x0000000007E3A000-memory.dmpFilesize
1.0MB
-
memory/4092-1464-0x0000000006390000-0x000000000642C000-memory.dmpFilesize
624KB
-
memory/4092-1329-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4092-1302-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4092-2707-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4252-149-0x0000000000B50000-0x0000000000B5A000-memory.dmpFilesize
40KB
-
memory/4844-1170-0x00000000048A0000-0x00000000048B0000-memory.dmpFilesize
64KB
-
memory/4844-1160-0x0000000005380000-0x00000000053CB000-memory.dmpFilesize
300KB
-
memory/4844-1159-0x0000000000040000-0x0000000000072000-memory.dmpFilesize
200KB
-
memory/5028-1769-0x000001E5A9DB0000-0x000001E5A9EE4000-memory.dmpFilesize
1.2MB
-
memory/5028-1193-0x000001E5A9DB0000-0x000001E5A9EE4000-memory.dmpFilesize
1.2MB
-
memory/5028-1192-0x000001E5A9C30000-0x000001E5A9DA3000-memory.dmpFilesize
1.4MB