Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2023 18:39
Static task
static1
Behavioral task
behavioral1
Sample
f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe
Resource
win10v2004-20230220-en
General
-
Target
f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe
-
Size
1.1MB
-
MD5
27f6a420825eb778525b492c814b7f6c
-
SHA1
9d15cc44c47d68c49ad1034493992ed022cac6f5
-
SHA256
f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd
-
SHA512
5f223446f89de5fbfa5326390355606985c34c95bd338e5d0fad74927187f46dfd12b6623f3773e9f16460e30f1fd5512517da3a86bd5362badabbd9e3d0b418
-
SSDEEP
24576:tykAo3sHbKvmobmW8Cm/LpfBd3jUP7GMkGhxyrqEL:IkAosqmoKRCm/FfrjUSf
Malware Config
Extracted
redline
luka
185.161.248.75:4132
-
auth_value
44560bcd37d6bf076da309730fdb519a
Extracted
redline
terra
185.161.248.75:4132
-
auth_value
60df3f535f8aa4e264f78041983592d2
Signatures
-
Processes:
o1719475.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection o1719475.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o1719475.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o1719475.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o1719475.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o1719475.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o1719475.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s9797957.exelegends.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation s9797957.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation legends.exe -
Executes dropped EXE 17 IoCs
Processes:
z3925116.exez1256546.exeo1719475.exep5083793.exer9182367.exer9182367.exes9797957.exes9797957.exes9797957.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exepid process 4436 z3925116.exe 4564 z1256546.exe 1508 o1719475.exe 3328 p5083793.exe 4756 r9182367.exe 3960 r9182367.exe 4520 s9797957.exe 4244 s9797957.exe 1160 s9797957.exe 4828 legends.exe 3752 legends.exe 4364 legends.exe 4432 legends.exe 5060 legends.exe 2500 legends.exe 1644 legends.exe 1420 legends.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2256 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o1719475.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o1719475.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o1719475.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exez3925116.exez1256546.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z3925116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3925116.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z1256546.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z1256546.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
r9182367.exes9797957.exelegends.exelegends.exelegends.exedescription pid process target process PID 4756 set thread context of 3960 4756 r9182367.exe r9182367.exe PID 4520 set thread context of 1160 4520 s9797957.exe s9797957.exe PID 4828 set thread context of 4364 4828 legends.exe legends.exe PID 4432 set thread context of 5060 4432 legends.exe legends.exe PID 2500 set thread context of 1420 2500 legends.exe legends.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2796 3328 WerFault.exe p5083793.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
o1719475.exer9182367.exepid process 1508 o1719475.exe 1508 o1719475.exe 3960 r9182367.exe 3960 r9182367.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
o1719475.exer9182367.exes9797957.exelegends.exer9182367.exelegends.exelegends.exedescription pid process Token: SeDebugPrivilege 1508 o1719475.exe Token: SeDebugPrivilege 4756 r9182367.exe Token: SeDebugPrivilege 4520 s9797957.exe Token: SeDebugPrivilege 4828 legends.exe Token: SeDebugPrivilege 3960 r9182367.exe Token: SeDebugPrivilege 4432 legends.exe Token: SeDebugPrivilege 2500 legends.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s9797957.exepid process 1160 s9797957.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exez3925116.exez1256546.exer9182367.exes9797957.exes9797957.exelegends.exelegends.execmd.exedescription pid process target process PID 2144 wrote to memory of 4436 2144 f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe z3925116.exe PID 2144 wrote to memory of 4436 2144 f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe z3925116.exe PID 2144 wrote to memory of 4436 2144 f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe z3925116.exe PID 4436 wrote to memory of 4564 4436 z3925116.exe z1256546.exe PID 4436 wrote to memory of 4564 4436 z3925116.exe z1256546.exe PID 4436 wrote to memory of 4564 4436 z3925116.exe z1256546.exe PID 4564 wrote to memory of 1508 4564 z1256546.exe o1719475.exe PID 4564 wrote to memory of 1508 4564 z1256546.exe o1719475.exe PID 4564 wrote to memory of 1508 4564 z1256546.exe o1719475.exe PID 4564 wrote to memory of 3328 4564 z1256546.exe p5083793.exe PID 4564 wrote to memory of 3328 4564 z1256546.exe p5083793.exe PID 4564 wrote to memory of 3328 4564 z1256546.exe p5083793.exe PID 4436 wrote to memory of 4756 4436 z3925116.exe r9182367.exe PID 4436 wrote to memory of 4756 4436 z3925116.exe r9182367.exe PID 4436 wrote to memory of 4756 4436 z3925116.exe r9182367.exe PID 4756 wrote to memory of 3960 4756 r9182367.exe r9182367.exe PID 4756 wrote to memory of 3960 4756 r9182367.exe r9182367.exe PID 4756 wrote to memory of 3960 4756 r9182367.exe r9182367.exe PID 4756 wrote to memory of 3960 4756 r9182367.exe r9182367.exe PID 4756 wrote to memory of 3960 4756 r9182367.exe r9182367.exe PID 4756 wrote to memory of 3960 4756 r9182367.exe r9182367.exe PID 4756 wrote to memory of 3960 4756 r9182367.exe r9182367.exe PID 4756 wrote to memory of 3960 4756 r9182367.exe r9182367.exe PID 2144 wrote to memory of 4520 2144 f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe s9797957.exe PID 2144 wrote to memory of 4520 2144 f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe s9797957.exe PID 2144 wrote to memory of 4520 2144 f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe s9797957.exe PID 4520 wrote to memory of 4244 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 4244 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 4244 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 4244 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 4520 wrote to memory of 1160 4520 s9797957.exe s9797957.exe PID 1160 wrote to memory of 4828 1160 s9797957.exe legends.exe PID 1160 wrote to memory of 4828 1160 s9797957.exe legends.exe PID 1160 wrote to memory of 4828 1160 s9797957.exe legends.exe PID 4828 wrote to memory of 3752 4828 legends.exe legends.exe PID 4828 wrote to memory of 3752 4828 legends.exe legends.exe PID 4828 wrote to memory of 3752 4828 legends.exe legends.exe PID 4828 wrote to memory of 3752 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4828 wrote to memory of 4364 4828 legends.exe legends.exe PID 4364 wrote to memory of 3652 4364 legends.exe schtasks.exe PID 4364 wrote to memory of 3652 4364 legends.exe schtasks.exe PID 4364 wrote to memory of 3652 4364 legends.exe schtasks.exe PID 4364 wrote to memory of 3972 4364 legends.exe cmd.exe PID 4364 wrote to memory of 3972 4364 legends.exe cmd.exe PID 4364 wrote to memory of 3972 4364 legends.exe cmd.exe PID 3972 wrote to memory of 780 3972 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe"C:\Users\Admin\AppData\Local\Temp\f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3925116.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3925116.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1256546.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1256546.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1719475.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1719475.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5083793.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5083793.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 9285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9182367.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9182367.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9182367.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9182367.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3328 -ip 33281⤵
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r9182367.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9797957.exeFilesize
961KB
MD539d7c8308aff0d2a43a7a3c199363373
SHA10ce4480dea83a3022ce01af30e6b8f5661432e7c
SHA2566d7d8b750d404e184b7a861c62bc8c5ba94e03964ed8452d8253a731a87282c8
SHA51299c676f3a0702f3ebbda261d9958f38535c97d134551736a8d554c709bdaa52107e6fe525e5526c3c9ca200d239dad9c5573f112f52dede7006e254e703eaa4a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3925116.exeFilesize
703KB
MD5044ac1c71e465a24f0c518be86edcea5
SHA128f605fa822e9713fa3955081beb27374790c40d
SHA2569d02fe913ca65228d8ded0edc735dde82d96e28daafbf4c7684989cae86e6086
SHA51224c88f9022f7d8dfaa74321540b99296629b5311342e2971a7d039315e10efa19b19196f7a876e8d07920a1eabd39092b75ca294e09742e14be930459f2d0880
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3925116.exeFilesize
703KB
MD5044ac1c71e465a24f0c518be86edcea5
SHA128f605fa822e9713fa3955081beb27374790c40d
SHA2569d02fe913ca65228d8ded0edc735dde82d96e28daafbf4c7684989cae86e6086
SHA51224c88f9022f7d8dfaa74321540b99296629b5311342e2971a7d039315e10efa19b19196f7a876e8d07920a1eabd39092b75ca294e09742e14be930459f2d0880
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9182367.exeFilesize
905KB
MD50a00cbf078d07af8ef193f9c5fcb5f55
SHA17febf0a8d65f97b5a562bb0ef4d3ab2d370fe4e4
SHA25617084dcbb8af9bdf918c776d0986e99d0c07ac9cd862d974a160c586f3262fb7
SHA512ca0a3d34366deec9b57c56b0c708b20cc1d008f82836c03cff43914a50963e3783412017331967be1ab7904dffa1bce90fb3c8d4965d7d186dfaf2d083245805
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9182367.exeFilesize
905KB
MD50a00cbf078d07af8ef193f9c5fcb5f55
SHA17febf0a8d65f97b5a562bb0ef4d3ab2d370fe4e4
SHA25617084dcbb8af9bdf918c776d0986e99d0c07ac9cd862d974a160c586f3262fb7
SHA512ca0a3d34366deec9b57c56b0c708b20cc1d008f82836c03cff43914a50963e3783412017331967be1ab7904dffa1bce90fb3c8d4965d7d186dfaf2d083245805
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9182367.exeFilesize
905KB
MD50a00cbf078d07af8ef193f9c5fcb5f55
SHA17febf0a8d65f97b5a562bb0ef4d3ab2d370fe4e4
SHA25617084dcbb8af9bdf918c776d0986e99d0c07ac9cd862d974a160c586f3262fb7
SHA512ca0a3d34366deec9b57c56b0c708b20cc1d008f82836c03cff43914a50963e3783412017331967be1ab7904dffa1bce90fb3c8d4965d7d186dfaf2d083245805
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1256546.exeFilesize
306KB
MD56ee86188c546b8467e140e3bb558096a
SHA1ddf90ef2408b28874f8a3607f5af90717189e1bb
SHA256fc2ae058c330ac79d4e561f2b872bc11afb4fae48a1b1ae671ff207f543a0209
SHA5126e501fa1be5b97273815029273c199a433276424e5b0f337cee644944d824a1ad4c23b52c8e51dc0e3d30649191375fb83b2116d6072eb852fa95458009cf3d5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1256546.exeFilesize
306KB
MD56ee86188c546b8467e140e3bb558096a
SHA1ddf90ef2408b28874f8a3607f5af90717189e1bb
SHA256fc2ae058c330ac79d4e561f2b872bc11afb4fae48a1b1ae671ff207f543a0209
SHA5126e501fa1be5b97273815029273c199a433276424e5b0f337cee644944d824a1ad4c23b52c8e51dc0e3d30649191375fb83b2116d6072eb852fa95458009cf3d5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1719475.exeFilesize
185KB
MD5376321d11029f7c4b74f6da229b62de4
SHA1d4d966a737abdd70b5b466dad4a6b10d253d94e2
SHA256b908dce3c85240cf72c32bef241c78a75dc236e90a3dfa5b98fec110bdcc0877
SHA512045de2a5825b13bbc471affa34f4f67873aa89992c4dce142eb1a7ef12f127dc74ce0aeb7d0dba798acdfb9aac36bb7f8190963b738a1500e6935e53f4d6364c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1719475.exeFilesize
185KB
MD5376321d11029f7c4b74f6da229b62de4
SHA1d4d966a737abdd70b5b466dad4a6b10d253d94e2
SHA256b908dce3c85240cf72c32bef241c78a75dc236e90a3dfa5b98fec110bdcc0877
SHA512045de2a5825b13bbc471affa34f4f67873aa89992c4dce142eb1a7ef12f127dc74ce0aeb7d0dba798acdfb9aac36bb7f8190963b738a1500e6935e53f4d6364c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5083793.exeFilesize
145KB
MD5bbd198eac7f32361c2888559aace20f0
SHA106d203b8a05134ea4520fbcf217aa0c3b5e1b404
SHA256893829fb3c982062904c401df2723d014b30313544195a662a2c306facc97438
SHA512d8437b42726d8c544d6bf94cdb6e18bdee9191f15bb0d52df8335efdc18985eba43083676587acf4eb89dcc5272f89a92fd983e877a8fa4b9b5991cef5e2f962
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5083793.exeFilesize
145KB
MD5bbd198eac7f32361c2888559aace20f0
SHA106d203b8a05134ea4520fbcf217aa0c3b5e1b404
SHA256893829fb3c982062904c401df2723d014b30313544195a662a2c306facc97438
SHA512d8437b42726d8c544d6bf94cdb6e18bdee9191f15bb0d52df8335efdc18985eba43083676587acf4eb89dcc5272f89a92fd983e877a8fa4b9b5991cef5e2f962
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1160-220-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1160-217-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1160-235-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1160-216-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1160-213-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-287-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-286-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-285-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1508-175-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-176-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/1508-180-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-163-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-167-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-169-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-161-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-159-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-171-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-157-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-173-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-165-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-178-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-156-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-182-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/1508-187-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/1508-155-0x00000000049D0000-0x0000000004F74000-memory.dmpFilesize
5.6MB
-
memory/1508-154-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/1508-186-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/1508-185-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/1508-184-0x0000000002220000-0x0000000002236000-memory.dmpFilesize
88KB
-
memory/2500-281-0x0000000006FB0000-0x0000000006FC0000-memory.dmpFilesize
64KB
-
memory/3328-192-0x0000000000860000-0x000000000088A000-memory.dmpFilesize
168KB
-
memory/3960-211-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/3960-224-0x0000000006530000-0x00000000065C2000-memory.dmpFilesize
584KB
-
memory/3960-198-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3960-206-0x0000000005B70000-0x0000000006188000-memory.dmpFilesize
6.1MB
-
memory/3960-207-0x00000000056D0000-0x00000000057DA000-memory.dmpFilesize
1.0MB
-
memory/3960-248-0x0000000006AE0000-0x0000000006B56000-memory.dmpFilesize
472KB
-
memory/3960-249-0x0000000006890000-0x00000000068E0000-memory.dmpFilesize
320KB
-
memory/3960-240-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/3960-208-0x0000000005600000-0x0000000005612000-memory.dmpFilesize
72KB
-
memory/3960-237-0x0000000007660000-0x0000000007B8C000-memory.dmpFilesize
5.2MB
-
memory/3960-209-0x0000000005670000-0x00000000056AC000-memory.dmpFilesize
240KB
-
memory/3960-236-0x0000000006910000-0x0000000006AD2000-memory.dmpFilesize
1.8MB
-
memory/3960-219-0x0000000005970000-0x00000000059D6000-memory.dmpFilesize
408KB
-
memory/4364-250-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4364-243-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4364-244-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4364-277-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4364-246-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4432-254-0x0000000007B60000-0x0000000007B70000-memory.dmpFilesize
64KB
-
memory/4520-205-0x0000000000160000-0x0000000000256000-memory.dmpFilesize
984KB
-
memory/4520-210-0x0000000006FC0000-0x0000000006FD0000-memory.dmpFilesize
64KB
-
memory/4756-197-0x0000000007940000-0x0000000007950000-memory.dmpFilesize
64KB
-
memory/4756-196-0x0000000000AD0000-0x0000000000BB8000-memory.dmpFilesize
928KB
-
memory/4828-238-0x0000000007230000-0x0000000007240000-memory.dmpFilesize
64KB
-
memory/5060-257-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/5060-259-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/5060-258-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB