Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2023 20:41
Static task
static1
Behavioral task
behavioral1
Sample
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe
Resource
win10v2004-20230220-en
General
-
Target
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe
-
Size
1.1MB
-
MD5
168fa4081fb3d96460dc64495fe0f482
-
SHA1
79fd0a38c6b6aef10f669cc88df04ef7376de1cc
-
SHA256
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652
-
SHA512
f4b71fc7ab93771c3821c7aed1390b2fca140bc36dcc7bec467e507adcc0fcbd7b47a927676f72d0c4da9b4ab3cdd1fe9e8945ca598a63bef1f98a9434a7312c
-
SSDEEP
24576:xyFXGrPNAId9oPq9qkMjkGfBjTn0dLuYSYgCULw15frDN:kk7CU9Z9+jkGfquYSYgV015jD
Malware Config
Extracted
redline
linda
185.161.248.75:4132
-
auth_value
21cdc21d041667b9c1679f88a1146770
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Signatures
-
Processes:
o2961712.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o2961712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o2961712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o2961712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o2961712.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection o2961712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o2961712.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s8808515.exelegends.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation s8808515.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation legends.exe -
Executes dropped EXE 17 IoCs
Processes:
z3586409.exez7887067.exeo2961712.exep6892042.exer6124342.exer6124342.exes8808515.exes8808515.exes8808515.exes8808515.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exepid process 1436 z3586409.exe 5048 z7887067.exe 2012 o2961712.exe 3728 p6892042.exe 2952 r6124342.exe 3212 r6124342.exe 2224 s8808515.exe 1776 s8808515.exe 1584 s8808515.exe 2464 s8808515.exe 1236 legends.exe 3836 legends.exe 3220 legends.exe 1704 legends.exe 3000 legends.exe 2012 legends.exe 1360 legends.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 5012 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o2961712.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o2961712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o2961712.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exez3586409.exez7887067.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z3586409.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3586409.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z7887067.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7887067.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
r6124342.exes8808515.exelegends.exelegends.exelegends.exedescription pid process target process PID 2952 set thread context of 3212 2952 r6124342.exe r6124342.exe PID 2224 set thread context of 2464 2224 s8808515.exe s8808515.exe PID 1236 set thread context of 3836 1236 legends.exe legends.exe PID 3220 set thread context of 3000 3220 legends.exe legends.exe PID 2012 set thread context of 1360 2012 legends.exe legends.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1652 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4800 3728 WerFault.exe p6892042.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
o2961712.exer6124342.exepid process 2012 o2961712.exe 2012 o2961712.exe 3212 r6124342.exe 3212 r6124342.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
o2961712.exer6124342.exes8808515.exer6124342.exelegends.exelegends.exelegends.exedescription pid process Token: SeDebugPrivilege 2012 o2961712.exe Token: SeDebugPrivilege 2952 r6124342.exe Token: SeDebugPrivilege 2224 s8808515.exe Token: SeDebugPrivilege 3212 r6124342.exe Token: SeDebugPrivilege 1236 legends.exe Token: SeDebugPrivilege 3220 legends.exe Token: SeDebugPrivilege 2012 legends.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s8808515.exepid process 2464 s8808515.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exez3586409.exez7887067.exer6124342.exes8808515.exes8808515.exelegends.exelegends.execmd.exedescription pid process target process PID 3656 wrote to memory of 1436 3656 1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe z3586409.exe PID 3656 wrote to memory of 1436 3656 1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe z3586409.exe PID 3656 wrote to memory of 1436 3656 1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe z3586409.exe PID 1436 wrote to memory of 5048 1436 z3586409.exe z7887067.exe PID 1436 wrote to memory of 5048 1436 z3586409.exe z7887067.exe PID 1436 wrote to memory of 5048 1436 z3586409.exe z7887067.exe PID 5048 wrote to memory of 2012 5048 z7887067.exe o2961712.exe PID 5048 wrote to memory of 2012 5048 z7887067.exe o2961712.exe PID 5048 wrote to memory of 2012 5048 z7887067.exe o2961712.exe PID 5048 wrote to memory of 3728 5048 z7887067.exe p6892042.exe PID 5048 wrote to memory of 3728 5048 z7887067.exe p6892042.exe PID 5048 wrote to memory of 3728 5048 z7887067.exe p6892042.exe PID 1436 wrote to memory of 2952 1436 z3586409.exe r6124342.exe PID 1436 wrote to memory of 2952 1436 z3586409.exe r6124342.exe PID 1436 wrote to memory of 2952 1436 z3586409.exe r6124342.exe PID 2952 wrote to memory of 3212 2952 r6124342.exe r6124342.exe PID 2952 wrote to memory of 3212 2952 r6124342.exe r6124342.exe PID 2952 wrote to memory of 3212 2952 r6124342.exe r6124342.exe PID 2952 wrote to memory of 3212 2952 r6124342.exe r6124342.exe PID 2952 wrote to memory of 3212 2952 r6124342.exe r6124342.exe PID 2952 wrote to memory of 3212 2952 r6124342.exe r6124342.exe PID 2952 wrote to memory of 3212 2952 r6124342.exe r6124342.exe PID 2952 wrote to memory of 3212 2952 r6124342.exe r6124342.exe PID 3656 wrote to memory of 2224 3656 1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe s8808515.exe PID 3656 wrote to memory of 2224 3656 1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe s8808515.exe PID 3656 wrote to memory of 2224 3656 1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe s8808515.exe PID 2224 wrote to memory of 1776 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 1776 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 1776 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 1776 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 1584 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 1584 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 1584 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 1584 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2224 wrote to memory of 2464 2224 s8808515.exe s8808515.exe PID 2464 wrote to memory of 1236 2464 s8808515.exe legends.exe PID 2464 wrote to memory of 1236 2464 s8808515.exe legends.exe PID 2464 wrote to memory of 1236 2464 s8808515.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 1236 wrote to memory of 3836 1236 legends.exe legends.exe PID 3836 wrote to memory of 3240 3836 legends.exe schtasks.exe PID 3836 wrote to memory of 3240 3836 legends.exe schtasks.exe PID 3836 wrote to memory of 3240 3836 legends.exe schtasks.exe PID 3836 wrote to memory of 3840 3836 legends.exe cmd.exe PID 3836 wrote to memory of 3840 3836 legends.exe cmd.exe PID 3836 wrote to memory of 3840 3836 legends.exe cmd.exe PID 3840 wrote to memory of 3856 3840 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe"C:\Users\Admin\AppData\Local\Temp\1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3586409.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3586409.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7887067.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7887067.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o2961712.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o2961712.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6892042.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6892042.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 9285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6124342.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6124342.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6124342.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6124342.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3728 -ip 37281⤵
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r6124342.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8808515.exeFilesize
961KB
MD540f84fce21991ad6d4f5899677807451
SHA1a2223cdfa83a63fff5575bd1f1910d2006d7ed42
SHA25642e3b9e9701b91b43b031f99865494372a8562bedf40d36e36a0ad0d5232f9b6
SHA512ef673c40baa7959cd137c754ab3f16c0feae93bfa634d90bae845ac6569d2ffd403d19614f64bef425c3dfbf9e9460897884517672f7dd00df03719c024ae02c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3586409.exeFilesize
702KB
MD57e45afbd727ae00c1167d2698ecf82fd
SHA1bf6cb31bc5f0a7bd61302ad10e9200703d29ed35
SHA256ef02e34c95961fa8d5e6a6c5a527ac6c373009f1d5b872740bf67803bb3bae25
SHA512ae3ebf9afa22475031ce44e59a58b57ed1bd9a249b635c06b9ddf4885a692528b20c1dc925017bf5d0daca2bef086be01bd35400f9e0091ef6e2c5f0030d0db1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3586409.exeFilesize
702KB
MD57e45afbd727ae00c1167d2698ecf82fd
SHA1bf6cb31bc5f0a7bd61302ad10e9200703d29ed35
SHA256ef02e34c95961fa8d5e6a6c5a527ac6c373009f1d5b872740bf67803bb3bae25
SHA512ae3ebf9afa22475031ce44e59a58b57ed1bd9a249b635c06b9ddf4885a692528b20c1dc925017bf5d0daca2bef086be01bd35400f9e0091ef6e2c5f0030d0db1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6124342.exeFilesize
903KB
MD5dba8b9ff97902d9fe7879d593bcd3369
SHA1b9c727fd3914063156cd15dbbf48eb0f8a7e0aa9
SHA256d6a611e3d7c5204ac951c6501876c34d84b9824d8bb08df192f846b94194eba5
SHA512416007b844a4a61931b2861fe2ad761cd3c7e8540d5f09820b77735fe8d78ac6ccdfb78eead29adefe6cf1a3c91752f5f4c0db0d03dbf26caf98f2afb53ce5ef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6124342.exeFilesize
903KB
MD5dba8b9ff97902d9fe7879d593bcd3369
SHA1b9c727fd3914063156cd15dbbf48eb0f8a7e0aa9
SHA256d6a611e3d7c5204ac951c6501876c34d84b9824d8bb08df192f846b94194eba5
SHA512416007b844a4a61931b2861fe2ad761cd3c7e8540d5f09820b77735fe8d78ac6ccdfb78eead29adefe6cf1a3c91752f5f4c0db0d03dbf26caf98f2afb53ce5ef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6124342.exeFilesize
903KB
MD5dba8b9ff97902d9fe7879d593bcd3369
SHA1b9c727fd3914063156cd15dbbf48eb0f8a7e0aa9
SHA256d6a611e3d7c5204ac951c6501876c34d84b9824d8bb08df192f846b94194eba5
SHA512416007b844a4a61931b2861fe2ad761cd3c7e8540d5f09820b77735fe8d78ac6ccdfb78eead29adefe6cf1a3c91752f5f4c0db0d03dbf26caf98f2afb53ce5ef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7887067.exeFilesize
305KB
MD511f26567b7056fa25c036e06f4d3f7d8
SHA1ced0ac148a1cd90c1c591a99f32dbbbdbd95bd28
SHA256e799f5edd584b12fcedb3756055d8ed013175497e7dc1ab8e8b837d8781d8a1b
SHA5128587b0dfd026254974627f23ca3ac8680adcc624c18c945fb95e141f4cb13c66e869c107d5a9250ae9d48b4e5ece630f0f0def46c9d1c3db8ce828e8f107149d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7887067.exeFilesize
305KB
MD511f26567b7056fa25c036e06f4d3f7d8
SHA1ced0ac148a1cd90c1c591a99f32dbbbdbd95bd28
SHA256e799f5edd584b12fcedb3756055d8ed013175497e7dc1ab8e8b837d8781d8a1b
SHA5128587b0dfd026254974627f23ca3ac8680adcc624c18c945fb95e141f4cb13c66e869c107d5a9250ae9d48b4e5ece630f0f0def46c9d1c3db8ce828e8f107149d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o2961712.exeFilesize
184KB
MD5981203a70a75555f877bcce0667c3e12
SHA174d43f4ac2ab2f86a8023af2099a220ea4297d37
SHA25683fcceed59618d7e82e7eb298a3589d9d09513f7ffca2c629dbad20462ea7e3e
SHA512bba8d8062a2c108a302efef1f5be052280241d7d2c74e4a4d61888532a689333e2b63c903a92d85a6d5277c9b522ae821baee47bd47ea7b1730ec55f184ea9d3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o2961712.exeFilesize
184KB
MD5981203a70a75555f877bcce0667c3e12
SHA174d43f4ac2ab2f86a8023af2099a220ea4297d37
SHA25683fcceed59618d7e82e7eb298a3589d9d09513f7ffca2c629dbad20462ea7e3e
SHA512bba8d8062a2c108a302efef1f5be052280241d7d2c74e4a4d61888532a689333e2b63c903a92d85a6d5277c9b522ae821baee47bd47ea7b1730ec55f184ea9d3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6892042.exeFilesize
145KB
MD50e13a24e10c9bf8b83cc8ce9402158dd
SHA1c4ae03c404977c0b70ac08fb3c1637d55dbe97e5
SHA256fbbd1770a4aeedb25b57ce367a3fbebee1a577229e42e869e765dbd78f5ec019
SHA512578eccb587fe7ee5656bab077efc60fa9481309c84298f914f7df4494ab380a5079aba1839eb32e4f022d8970bc424ae072532637d7009a48d68a96136f98b78
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6892042.exeFilesize
145KB
MD50e13a24e10c9bf8b83cc8ce9402158dd
SHA1c4ae03c404977c0b70ac08fb3c1637d55dbe97e5
SHA256fbbd1770a4aeedb25b57ce367a3fbebee1a577229e42e869e765dbd78f5ec019
SHA512578eccb587fe7ee5656bab077efc60fa9481309c84298f914f7df4494ab380a5079aba1839eb32e4f022d8970bc424ae072532637d7009a48d68a96136f98b78
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1236-240-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/1360-287-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1360-288-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1360-286-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2012-157-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-162-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-174-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-176-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-172-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-154-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2012-180-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-170-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-155-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2012-168-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-283-0x00000000072F0000-0x0000000007300000-memory.dmpFilesize
64KB
-
memory/2012-164-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-166-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-178-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-181-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2012-160-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-188-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2012-158-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-183-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-185-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/2012-186-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2012-156-0x0000000004BE0000-0x0000000005184000-memory.dmpFilesize
5.6MB
-
memory/2012-187-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/2224-208-0x0000000007D40000-0x0000000007D50000-memory.dmpFilesize
64KB
-
memory/2224-206-0x0000000000E30000-0x0000000000F26000-memory.dmpFilesize
984KB
-
memory/2464-217-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2464-238-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2464-223-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2464-221-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2464-220-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2952-198-0x00000000077E0000-0x00000000077F0000-memory.dmpFilesize
64KB
-
memory/2952-197-0x00000000009B0000-0x0000000000A98000-memory.dmpFilesize
928KB
-
memory/3000-279-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3000-280-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3000-281-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3212-210-0x0000000005530000-0x0000000005542000-memory.dmpFilesize
72KB
-
memory/3212-215-0x0000000005920000-0x00000000059B2000-memory.dmpFilesize
584KB
-
memory/3212-199-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3212-207-0x0000000005A80000-0x0000000006098000-memory.dmpFilesize
6.1MB
-
memory/3212-209-0x0000000005600000-0x000000000570A000-memory.dmpFilesize
1.0MB
-
memory/3212-211-0x0000000005590000-0x00000000055CC000-memory.dmpFilesize
240KB
-
memory/3212-243-0x0000000005870000-0x0000000005880000-memory.dmpFilesize
64KB
-
memory/3212-212-0x0000000005870000-0x0000000005880000-memory.dmpFilesize
64KB
-
memory/3212-242-0x0000000006E00000-0x0000000006E50000-memory.dmpFilesize
320KB
-
memory/3212-241-0x0000000006D80000-0x0000000006DF6000-memory.dmpFilesize
472KB
-
memory/3212-239-0x00000000075D0000-0x0000000007AFC000-memory.dmpFilesize
5.2MB
-
memory/3212-234-0x0000000006ED0000-0x0000000007092000-memory.dmpFilesize
1.8MB
-
memory/3212-216-0x00000000059C0000-0x0000000005A26000-memory.dmpFilesize
408KB
-
memory/3220-255-0x0000000007840000-0x0000000007850000-memory.dmpFilesize
64KB
-
memory/3728-193-0x0000000000EF0000-0x0000000000F1A000-memory.dmpFilesize
168KB
-
memory/3836-251-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3836-274-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3836-247-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3836-248-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3836-250-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB