Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2023 09:07
Static task
static1
Behavioral task
behavioral1
Sample
2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe
Resource
win10v2004-20230220-en
General
-
Target
2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe
-
Size
1.1MB
-
MD5
29fe2ebe57df3f304a862ae3f3cdd33c
-
SHA1
9969cecbe5a1a894e3f815b4be28fcbd3bb38096
-
SHA256
2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2
-
SHA512
b7165869947125a829dfaa044918b050d0fcd6256c78bb22bafcc316625e0ab9c963d93469dda26b9dc5a277d059bddaeec60f65f4657fc842f6c406758780ba
-
SSDEEP
24576:Ay3JUbUk2/wrIL3KQDnqkXpMkF0Eu+bOoWEiBjPIfne/O:H5CN24rIL3K6pPjSl3Rg
Malware Config
Extracted
redline
luka
185.161.248.75:4132
-
auth_value
44560bcd37d6bf076da309730fdb519a
Extracted
redline
terra
185.161.248.75:4132
-
auth_value
60df3f535f8aa4e264f78041983592d2
Signatures
-
Processes:
o6151795.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o6151795.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection o6151795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o6151795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o6151795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o6151795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o6151795.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s1366524.exelegends.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation s1366524.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation legends.exe -
Executes dropped EXE 16 IoCs
Processes:
z3258138.exez8493519.exeo6151795.exep7260743.exer5579046.exer5579046.exes1366524.exes1366524.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exepid process 1912 z3258138.exe 2660 z8493519.exe 1876 o6151795.exe 220 p7260743.exe 552 r5579046.exe 2712 r5579046.exe 4400 s1366524.exe 1992 s1366524.exe 3420 legends.exe 624 legends.exe 3604 legends.exe 4300 legends.exe 4740 legends.exe 2760 legends.exe 2272 legends.exe 4028 legends.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3504 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o6151795.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o6151795.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o6151795.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
z3258138.exez8493519.exe2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3258138.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z8493519.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z8493519.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z3258138.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
r5579046.exes1366524.exelegends.exelegends.exelegends.exedescription pid process target process PID 552 set thread context of 2712 552 r5579046.exe r5579046.exe PID 4400 set thread context of 1992 4400 s1366524.exe s1366524.exe PID 3420 set thread context of 624 3420 legends.exe legends.exe PID 3604 set thread context of 4300 3604 legends.exe legends.exe PID 4740 set thread context of 2272 4740 legends.exe legends.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2012 220 WerFault.exe p7260743.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
o6151795.exer5579046.exepid process 1876 o6151795.exe 1876 o6151795.exe 2712 r5579046.exe 2712 r5579046.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
o6151795.exer5579046.exes1366524.exelegends.exer5579046.exelegends.exelegends.exelegends.exedescription pid process Token: SeDebugPrivilege 1876 o6151795.exe Token: SeDebugPrivilege 552 r5579046.exe Token: SeDebugPrivilege 4400 s1366524.exe Token: SeDebugPrivilege 3420 legends.exe Token: SeDebugPrivilege 2712 r5579046.exe Token: SeDebugPrivilege 3604 legends.exe Token: SeDebugPrivilege 4740 legends.exe Token: SeDebugPrivilege 4028 legends.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s1366524.exepid process 1992 s1366524.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exez3258138.exez8493519.exer5579046.exes1366524.exes1366524.exelegends.exelegends.execmd.exedescription pid process target process PID 2512 wrote to memory of 1912 2512 2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe z3258138.exe PID 2512 wrote to memory of 1912 2512 2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe z3258138.exe PID 2512 wrote to memory of 1912 2512 2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe z3258138.exe PID 1912 wrote to memory of 2660 1912 z3258138.exe z8493519.exe PID 1912 wrote to memory of 2660 1912 z3258138.exe z8493519.exe PID 1912 wrote to memory of 2660 1912 z3258138.exe z8493519.exe PID 2660 wrote to memory of 1876 2660 z8493519.exe o6151795.exe PID 2660 wrote to memory of 1876 2660 z8493519.exe o6151795.exe PID 2660 wrote to memory of 1876 2660 z8493519.exe o6151795.exe PID 2660 wrote to memory of 220 2660 z8493519.exe p7260743.exe PID 2660 wrote to memory of 220 2660 z8493519.exe p7260743.exe PID 2660 wrote to memory of 220 2660 z8493519.exe p7260743.exe PID 1912 wrote to memory of 552 1912 z3258138.exe r5579046.exe PID 1912 wrote to memory of 552 1912 z3258138.exe r5579046.exe PID 1912 wrote to memory of 552 1912 z3258138.exe r5579046.exe PID 552 wrote to memory of 2712 552 r5579046.exe r5579046.exe PID 552 wrote to memory of 2712 552 r5579046.exe r5579046.exe PID 552 wrote to memory of 2712 552 r5579046.exe r5579046.exe PID 552 wrote to memory of 2712 552 r5579046.exe r5579046.exe PID 552 wrote to memory of 2712 552 r5579046.exe r5579046.exe PID 552 wrote to memory of 2712 552 r5579046.exe r5579046.exe PID 552 wrote to memory of 2712 552 r5579046.exe r5579046.exe PID 552 wrote to memory of 2712 552 r5579046.exe r5579046.exe PID 2512 wrote to memory of 4400 2512 2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe s1366524.exe PID 2512 wrote to memory of 4400 2512 2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe s1366524.exe PID 2512 wrote to memory of 4400 2512 2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 4400 wrote to memory of 1992 4400 s1366524.exe s1366524.exe PID 1992 wrote to memory of 3420 1992 s1366524.exe legends.exe PID 1992 wrote to memory of 3420 1992 s1366524.exe legends.exe PID 1992 wrote to memory of 3420 1992 s1366524.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 3420 wrote to memory of 624 3420 legends.exe legends.exe PID 624 wrote to memory of 3272 624 legends.exe schtasks.exe PID 624 wrote to memory of 3272 624 legends.exe schtasks.exe PID 624 wrote to memory of 3272 624 legends.exe schtasks.exe PID 624 wrote to memory of 632 624 legends.exe cmd.exe PID 624 wrote to memory of 632 624 legends.exe cmd.exe PID 624 wrote to memory of 632 624 legends.exe cmd.exe PID 632 wrote to memory of 2584 632 cmd.exe cmd.exe PID 632 wrote to memory of 2584 632 cmd.exe cmd.exe PID 632 wrote to memory of 2584 632 cmd.exe cmd.exe PID 632 wrote to memory of 1800 632 cmd.exe cacls.exe PID 632 wrote to memory of 1800 632 cmd.exe cacls.exe PID 632 wrote to memory of 1800 632 cmd.exe cacls.exe PID 632 wrote to memory of 1736 632 cmd.exe cacls.exe PID 632 wrote to memory of 1736 632 cmd.exe cacls.exe PID 632 wrote to memory of 1736 632 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe"C:\Users\Admin\AppData\Local\Temp\2d4dac16a12248fb8cfad404739480251b6c9560acc5017443f734d7cde55fd2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3258138.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3258138.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8493519.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8493519.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6151795.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6151795.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7260743.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7260743.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 9285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5579046.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5579046.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5579046.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5579046.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1366524.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1366524.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1366524.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1366524.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 220 -ip 2201⤵
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r5579046.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1366524.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1366524.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1366524.exeFilesize
961KB
MD583d8aba708daa855ea3a7a6cef7b0a45
SHA154430072f20150cd832be2caefdfd646a1904395
SHA2568cf3eba1d50e51a142db21ec55625c83398e8c7c21cad0dbd96ca387e57d867f
SHA5129ab7b89c2841159fe257335984dc94927edc5326c7acb1c50f54f494ca7a7609180272ace708d0fd554f360f454dbe2301025a57fd6272c2d0a93ec9b1f9160f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3258138.exeFilesize
703KB
MD5267bcb44ef0430e98ea0b5a2a9d8e190
SHA170e47c487909abc9bf2266233ce6beac7f672e69
SHA256f766a910f6d13caff2a12883dd8bacec112c7af205d3a7adc504e911127c13f4
SHA5120f76b1574c0b4207254eea7133ea78118315fadae7a5cd8038e8519151c003b0603cc111fb6ddea83ae458669f1b7d9614ce629f8cfaf9d4b438080896889422
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3258138.exeFilesize
703KB
MD5267bcb44ef0430e98ea0b5a2a9d8e190
SHA170e47c487909abc9bf2266233ce6beac7f672e69
SHA256f766a910f6d13caff2a12883dd8bacec112c7af205d3a7adc504e911127c13f4
SHA5120f76b1574c0b4207254eea7133ea78118315fadae7a5cd8038e8519151c003b0603cc111fb6ddea83ae458669f1b7d9614ce629f8cfaf9d4b438080896889422
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5579046.exeFilesize
905KB
MD5ced86edc213ee6e64ded5c7ce11fd4c7
SHA11ec1fd84e344df8e99ccb8e81a0702668b4bb190
SHA25623a53c1b1c0bb6e4f3b80a21afc6efa2f07840e69546a058ec31158ad0430e73
SHA512c2211a21b246167a8929c1b8519a2c6fee02418198f14c19e73a93154ac751414100d16440158141fe036a9c9f1e556203e9ed80d2e0e5bf1bfe31062af14f30
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5579046.exeFilesize
905KB
MD5ced86edc213ee6e64ded5c7ce11fd4c7
SHA11ec1fd84e344df8e99ccb8e81a0702668b4bb190
SHA25623a53c1b1c0bb6e4f3b80a21afc6efa2f07840e69546a058ec31158ad0430e73
SHA512c2211a21b246167a8929c1b8519a2c6fee02418198f14c19e73a93154ac751414100d16440158141fe036a9c9f1e556203e9ed80d2e0e5bf1bfe31062af14f30
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5579046.exeFilesize
905KB
MD5ced86edc213ee6e64ded5c7ce11fd4c7
SHA11ec1fd84e344df8e99ccb8e81a0702668b4bb190
SHA25623a53c1b1c0bb6e4f3b80a21afc6efa2f07840e69546a058ec31158ad0430e73
SHA512c2211a21b246167a8929c1b8519a2c6fee02418198f14c19e73a93154ac751414100d16440158141fe036a9c9f1e556203e9ed80d2e0e5bf1bfe31062af14f30
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8493519.exeFilesize
306KB
MD5726205b48f599551a419544d5a5dd62e
SHA16c86e3ca8dbbb2f4184f2709dc703b273ec57ec3
SHA25679403462b6b76b5ddbf5fe0424508f5571a6bd6642d20cd95a9f951493ab7ca9
SHA512b7990d8aa58bb2ec2e38abdd11b42301c31be4238471ee3046ea323257468940dd35f64de078df67deafd17843d83d290a7c52c35adeca33590cd153fef5e0c5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8493519.exeFilesize
306KB
MD5726205b48f599551a419544d5a5dd62e
SHA16c86e3ca8dbbb2f4184f2709dc703b273ec57ec3
SHA25679403462b6b76b5ddbf5fe0424508f5571a6bd6642d20cd95a9f951493ab7ca9
SHA512b7990d8aa58bb2ec2e38abdd11b42301c31be4238471ee3046ea323257468940dd35f64de078df67deafd17843d83d290a7c52c35adeca33590cd153fef5e0c5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6151795.exeFilesize
185KB
MD5ba11046ab314c77e1229b3c27c4192ae
SHA1e16e76319d1a11c5cd5082ec9c7512131ccb31be
SHA256d81193c30702546fb67d6548bcac60130b70d351e97a14dc5bdffad32566dcfa
SHA512fcf7bd627453439b5bd9a44c972a268e029b96e34362277c5d4e4a45ba1577d3bdcd4dc4e93650ca2dbe35221206380f2c157735ed9b632e026aec0afac264cf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o6151795.exeFilesize
185KB
MD5ba11046ab314c77e1229b3c27c4192ae
SHA1e16e76319d1a11c5cd5082ec9c7512131ccb31be
SHA256d81193c30702546fb67d6548bcac60130b70d351e97a14dc5bdffad32566dcfa
SHA512fcf7bd627453439b5bd9a44c972a268e029b96e34362277c5d4e4a45ba1577d3bdcd4dc4e93650ca2dbe35221206380f2c157735ed9b632e026aec0afac264cf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7260743.exeFilesize
145KB
MD5d09fc6f64208ef02b798c7771248da07
SHA1e29941670cf9d4074ef553a7ce4db718d30631ef
SHA256888c66f9df73ebca278fbd8167edc44982698819cf8e54b3cff4c86c76dc2e1a
SHA512e399f780e4962de5966e854d6ec51284abde62a11d1ad7a029f53942a50651a575693bf040f4bba8efe03fce16cb77233fc011875421b5d146342838daf01527
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7260743.exeFilesize
145KB
MD5d09fc6f64208ef02b798c7771248da07
SHA1e29941670cf9d4074ef553a7ce4db718d30631ef
SHA256888c66f9df73ebca278fbd8167edc44982698819cf8e54b3cff4c86c76dc2e1a
SHA512e399f780e4962de5966e854d6ec51284abde62a11d1ad7a029f53942a50651a575693bf040f4bba8efe03fce16cb77233fc011875421b5d146342838daf01527
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/220-188-0x0000000000A30000-0x0000000000A5A000-memory.dmpFilesize
168KB
-
memory/552-192-0x0000000000C10000-0x0000000000CF8000-memory.dmpFilesize
928KB
-
memory/552-193-0x0000000007970000-0x0000000007980000-memory.dmpFilesize
64KB
-
memory/624-235-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/624-240-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/624-271-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/624-236-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/624-241-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1876-179-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-183-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-154-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/1876-155-0x0000000004CB0000-0x0000000005254000-memory.dmpFilesize
5.6MB
-
memory/1876-156-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-157-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-159-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-161-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-163-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-165-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-167-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-169-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-171-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-175-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-173-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-177-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1876-181-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1992-228-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-214-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-208-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-211-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-212-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2272-280-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2272-279-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2272-278-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2712-244-0x00000000066A0000-0x00000000066F0000-memory.dmpFilesize
320KB
-
memory/2712-204-0x0000000005470000-0x0000000005482000-memory.dmpFilesize
72KB
-
memory/2712-206-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/2712-238-0x0000000006E50000-0x0000000007012000-memory.dmpFilesize
1.8MB
-
memory/2712-239-0x0000000007550000-0x0000000007A7C000-memory.dmpFilesize
5.2MB
-
memory/2712-231-0x00000000063D0000-0x0000000006462000-memory.dmpFilesize
584KB
-
memory/2712-207-0x0000000005490000-0x00000000054CC000-memory.dmpFilesize
240KB
-
memory/2712-230-0x00000000057C0000-0x0000000005826000-memory.dmpFilesize
408KB
-
memory/2712-202-0x0000000005A90000-0x00000000060A8000-memory.dmpFilesize
6.1MB
-
memory/2712-203-0x0000000005580000-0x000000000568A000-memory.dmpFilesize
1.0MB
-
memory/2712-245-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/2712-194-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2712-243-0x0000000006620000-0x0000000006696000-memory.dmpFilesize
472KB
-
memory/3420-229-0x0000000007760000-0x0000000007770000-memory.dmpFilesize
64KB
-
memory/3604-248-0x0000000007230000-0x0000000007240000-memory.dmpFilesize
64KB
-
memory/4300-253-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4300-252-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4300-251-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4400-201-0x0000000000880000-0x0000000000976000-memory.dmpFilesize
984KB
-
memory/4400-205-0x0000000007670000-0x0000000007680000-memory.dmpFilesize
64KB