Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18/05/2023, 21:22

General

  • Target

    074c9964f9485771bce6a7f945297ef2.exe

  • Size

    1021KB

  • MD5

    074c9964f9485771bce6a7f945297ef2

  • SHA1

    bff9faa86c1f22d1b58487762a20e2f6f224ff0d

  • SHA256

    2ed81c8a70821f622a4032f6fefc00a25c4cce03df139afe47f3d0d4209dc972

  • SHA512

    05366d213ae54c547412a45e014cb943f18770664fe2f9986c73acc6a9807910b4c2acb47419d545bf50f4c2d46915d87eb572e425090c5f84398558347595b6

  • SSDEEP

    24576:DyJr1oGVE1N5G5suTW15qY7QQ0VLfzut4c:W51o6E1NPu4X0VLLu

Malware Config

Extracted

Family

redline

Botnet

laxak

C2

77.91.68.253:41783

Attributes
  • auth_value

    9f2cf0f93f412b5c2e152400023c0fc3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 23 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\074c9964f9485771bce6a7f945297ef2.exe
    "C:\Users\Admin\AppData\Local\Temp\074c9964f9485771bce6a7f945297ef2.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4039459.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4039459.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8859044.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8859044.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o4325422.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o4325422.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1340
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5448888.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5448888.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7301676.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7301676.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1184
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
          "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:108
          • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1608
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:1680
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
              6⤵
                PID:468
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  7⤵
                    PID:576
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "legends.exe" /P "Admin:N"
                    7⤵
                      PID:1648
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "legends.exe" /P "Admin:R" /E
                      7⤵
                        PID:1528
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        7⤵
                          PID:1520
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\41bde21dc7" /P "Admin:N"
                          7⤵
                            PID:588
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\41bde21dc7" /P "Admin:R" /E
                            7⤵
                              PID:984
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                            6⤵
                            • Loads dropped DLL
                            PID:1804
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {7EA72E72-112B-462C-B013-78B79E865E84} S-1-5-21-2961826002-3968192592-354541192-1000:HVMHZIYD\Admin:Interactive:[1]
                  1⤵
                    PID:2032
                    • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                      C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1580
                      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                        3⤵
                        • Executes dropped EXE
                        PID:1572
                    • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                      C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:752
                      • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                        3⤵
                        • Executes dropped EXE
                        PID:1256

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4039459.exe

                    Filesize

                    577KB

                    MD5

                    7c7fc07578998b098977f0f3b7998efc

                    SHA1

                    54564fa7af94d73a539645167d24935437e17081

                    SHA256

                    cac6b2512f304842fbaa38442e0bed8e0df2ac67ef8d85da38a5f985444736ca

                    SHA512

                    9fa0aa2e52dadb4f56bb233b7755d1ef823c72c0fc98225ae783e549c4554d8d06c3c5e06ef03a402d33eac111602c5fc11c515ed15b2ff71d944bca9b24908a

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4039459.exe

                    Filesize

                    577KB

                    MD5

                    7c7fc07578998b098977f0f3b7998efc

                    SHA1

                    54564fa7af94d73a539645167d24935437e17081

                    SHA256

                    cac6b2512f304842fbaa38442e0bed8e0df2ac67ef8d85da38a5f985444736ca

                    SHA512

                    9fa0aa2e52dadb4f56bb233b7755d1ef823c72c0fc98225ae783e549c4554d8d06c3c5e06ef03a402d33eac111602c5fc11c515ed15b2ff71d944bca9b24908a

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7301676.exe

                    Filesize

                    284KB

                    MD5

                    8d321b35d4913bac92cb1fc3fbdfdc45

                    SHA1

                    99a2dfc66e8be30cfd5127d23ee0c05a83d15794

                    SHA256

                    3c77d11eebb934b7241dd4a463bb6739873f4e1b871abc6913d9798370e72871

                    SHA512

                    c4feb2e48382c051ac6df7fbe085c24f358f647a38528364b5feebf266e49dabd8a23c9f43d826d67d7f54e0fe2743069153c1f6b5d58c3708f30cc62f4adef8

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7301676.exe

                    Filesize

                    284KB

                    MD5

                    8d321b35d4913bac92cb1fc3fbdfdc45

                    SHA1

                    99a2dfc66e8be30cfd5127d23ee0c05a83d15794

                    SHA256

                    3c77d11eebb934b7241dd4a463bb6739873f4e1b871abc6913d9798370e72871

                    SHA512

                    c4feb2e48382c051ac6df7fbe085c24f358f647a38528364b5feebf266e49dabd8a23c9f43d826d67d7f54e0fe2743069153c1f6b5d58c3708f30cc62f4adef8

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8859044.exe

                    Filesize

                    305KB

                    MD5

                    b18053081a4de84a17564981c2ff2ff9

                    SHA1

                    b6a55ae23f65ee9a8006bef8b46b0bc45b2390f0

                    SHA256

                    79d21acf9a1dcf1a5f0c3b95931b5cb11b9a2c452a3057a1d517cb6e656c9b44

                    SHA512

                    faca98350267ffeee59543fa25c2a63d8c10a9430a27f423c874f467886ca6026a20e5fb12fd61789ff4579c0a5aba37073ec5311e5d7a0456fc3b833ad49da8

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8859044.exe

                    Filesize

                    305KB

                    MD5

                    b18053081a4de84a17564981c2ff2ff9

                    SHA1

                    b6a55ae23f65ee9a8006bef8b46b0bc45b2390f0

                    SHA256

                    79d21acf9a1dcf1a5f0c3b95931b5cb11b9a2c452a3057a1d517cb6e656c9b44

                    SHA512

                    faca98350267ffeee59543fa25c2a63d8c10a9430a27f423c874f467886ca6026a20e5fb12fd61789ff4579c0a5aba37073ec5311e5d7a0456fc3b833ad49da8

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o4325422.exe

                    Filesize

                    184KB

                    MD5

                    4c94e0df16c58143287479c74f3e54e7

                    SHA1

                    f93129b20ac587e95b91f611d4c58b3005b140a9

                    SHA256

                    c55f04038db70d84fe431937ecf878573a31f0777ea612ad482f76c9a9968a2f

                    SHA512

                    72d63fafde9940b14b6ffcad664c287adadee194d8bd3cd685916814ab2b6be4fee82cd6af2035433a1ec39609d2a4ca74cffa414a92182c06ccd4d86b085f09

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o4325422.exe

                    Filesize

                    184KB

                    MD5

                    4c94e0df16c58143287479c74f3e54e7

                    SHA1

                    f93129b20ac587e95b91f611d4c58b3005b140a9

                    SHA256

                    c55f04038db70d84fe431937ecf878573a31f0777ea612ad482f76c9a9968a2f

                    SHA512

                    72d63fafde9940b14b6ffcad664c287adadee194d8bd3cd685916814ab2b6be4fee82cd6af2035433a1ec39609d2a4ca74cffa414a92182c06ccd4d86b085f09

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5448888.exe

                    Filesize

                    145KB

                    MD5

                    174f736c365ae0bdb7ac0a58a1e252e7

                    SHA1

                    aeb1cc3cd50191f7ef3e80ad0b2a0ca498d7e248

                    SHA256

                    3de4c1ce66385b32055eb098057bba0432486c50974ce09ba99437344fd61307

                    SHA512

                    79c90fa883f63ca81400d5a31ade7465e65a76f03f5b5856c69876d174ede059373c663b8aca20338c7cd9d4b08067c0f4a7eacd7141362c0e85b720a53089dc

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5448888.exe

                    Filesize

                    145KB

                    MD5

                    174f736c365ae0bdb7ac0a58a1e252e7

                    SHA1

                    aeb1cc3cd50191f7ef3e80ad0b2a0ca498d7e248

                    SHA256

                    3de4c1ce66385b32055eb098057bba0432486c50974ce09ba99437344fd61307

                    SHA512

                    79c90fa883f63ca81400d5a31ade7465e65a76f03f5b5856c69876d174ede059373c663b8aca20338c7cd9d4b08067c0f4a7eacd7141362c0e85b720a53089dc

                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                    Filesize

                    89KB

                    MD5

                    73c0c85e39b9a63b42f6c4ff6d634f8b

                    SHA1

                    efb047b4177ad78268f6fc8bf959f58f1123eb51

                    SHA256

                    477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                    SHA512

                    ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                    Filesize

                    89KB

                    MD5

                    73c0c85e39b9a63b42f6c4ff6d634f8b

                    SHA1

                    efb047b4177ad78268f6fc8bf959f58f1123eb51

                    SHA256

                    477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                    SHA512

                    ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                    Filesize

                    162B

                    MD5

                    1b7c22a214949975556626d7217e9a39

                    SHA1

                    d01c97e2944166ed23e47e4a62ff471ab8fa031f

                    SHA256

                    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                    SHA512

                    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                  • \Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\s1395067.exe

                    Filesize

                    962KB

                    MD5

                    eecc636f198842d7caf4009d3580f7a1

                    SHA1

                    9f11c4effb73f1a8e158c4a1ff90864ba1eec53e

                    SHA256

                    86744994cabb8bf9695d5f1d1d87a15be913890fd755f8a830a2c997b82ba8b9

                    SHA512

                    d3ba940fb23d314c588c8508b7ac67577ea4e9f29717d957321cdcfaf164a4abce118f1100490f816332e8a24883977df334b3cd319b5133e105ff808621ffd6

                  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z4039459.exe

                    Filesize

                    577KB

                    MD5

                    7c7fc07578998b098977f0f3b7998efc

                    SHA1

                    54564fa7af94d73a539645167d24935437e17081

                    SHA256

                    cac6b2512f304842fbaa38442e0bed8e0df2ac67ef8d85da38a5f985444736ca

                    SHA512

                    9fa0aa2e52dadb4f56bb233b7755d1ef823c72c0fc98225ae783e549c4554d8d06c3c5e06ef03a402d33eac111602c5fc11c515ed15b2ff71d944bca9b24908a

                  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z4039459.exe

                    Filesize

                    577KB

                    MD5

                    7c7fc07578998b098977f0f3b7998efc

                    SHA1

                    54564fa7af94d73a539645167d24935437e17081

                    SHA256

                    cac6b2512f304842fbaa38442e0bed8e0df2ac67ef8d85da38a5f985444736ca

                    SHA512

                    9fa0aa2e52dadb4f56bb233b7755d1ef823c72c0fc98225ae783e549c4554d8d06c3c5e06ef03a402d33eac111602c5fc11c515ed15b2ff71d944bca9b24908a

                  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\r7301676.exe

                    Filesize

                    284KB

                    MD5

                    8d321b35d4913bac92cb1fc3fbdfdc45

                    SHA1

                    99a2dfc66e8be30cfd5127d23ee0c05a83d15794

                    SHA256

                    3c77d11eebb934b7241dd4a463bb6739873f4e1b871abc6913d9798370e72871

                    SHA512

                    c4feb2e48382c051ac6df7fbe085c24f358f647a38528364b5feebf266e49dabd8a23c9f43d826d67d7f54e0fe2743069153c1f6b5d58c3708f30cc62f4adef8

                  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\r7301676.exe

                    Filesize

                    284KB

                    MD5

                    8d321b35d4913bac92cb1fc3fbdfdc45

                    SHA1

                    99a2dfc66e8be30cfd5127d23ee0c05a83d15794

                    SHA256

                    3c77d11eebb934b7241dd4a463bb6739873f4e1b871abc6913d9798370e72871

                    SHA512

                    c4feb2e48382c051ac6df7fbe085c24f358f647a38528364b5feebf266e49dabd8a23c9f43d826d67d7f54e0fe2743069153c1f6b5d58c3708f30cc62f4adef8

                  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z8859044.exe

                    Filesize

                    305KB

                    MD5

                    b18053081a4de84a17564981c2ff2ff9

                    SHA1

                    b6a55ae23f65ee9a8006bef8b46b0bc45b2390f0

                    SHA256

                    79d21acf9a1dcf1a5f0c3b95931b5cb11b9a2c452a3057a1d517cb6e656c9b44

                    SHA512

                    faca98350267ffeee59543fa25c2a63d8c10a9430a27f423c874f467886ca6026a20e5fb12fd61789ff4579c0a5aba37073ec5311e5d7a0456fc3b833ad49da8

                  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z8859044.exe

                    Filesize

                    305KB

                    MD5

                    b18053081a4de84a17564981c2ff2ff9

                    SHA1

                    b6a55ae23f65ee9a8006bef8b46b0bc45b2390f0

                    SHA256

                    79d21acf9a1dcf1a5f0c3b95931b5cb11b9a2c452a3057a1d517cb6e656c9b44

                    SHA512

                    faca98350267ffeee59543fa25c2a63d8c10a9430a27f423c874f467886ca6026a20e5fb12fd61789ff4579c0a5aba37073ec5311e5d7a0456fc3b833ad49da8

                  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\o4325422.exe

                    Filesize

                    184KB

                    MD5

                    4c94e0df16c58143287479c74f3e54e7

                    SHA1

                    f93129b20ac587e95b91f611d4c58b3005b140a9

                    SHA256

                    c55f04038db70d84fe431937ecf878573a31f0777ea612ad482f76c9a9968a2f

                    SHA512

                    72d63fafde9940b14b6ffcad664c287adadee194d8bd3cd685916814ab2b6be4fee82cd6af2035433a1ec39609d2a4ca74cffa414a92182c06ccd4d86b085f09

                  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\o4325422.exe

                    Filesize

                    184KB

                    MD5

                    4c94e0df16c58143287479c74f3e54e7

                    SHA1

                    f93129b20ac587e95b91f611d4c58b3005b140a9

                    SHA256

                    c55f04038db70d84fe431937ecf878573a31f0777ea612ad482f76c9a9968a2f

                    SHA512

                    72d63fafde9940b14b6ffcad664c287adadee194d8bd3cd685916814ab2b6be4fee82cd6af2035433a1ec39609d2a4ca74cffa414a92182c06ccd4d86b085f09

                  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p5448888.exe

                    Filesize

                    145KB

                    MD5

                    174f736c365ae0bdb7ac0a58a1e252e7

                    SHA1

                    aeb1cc3cd50191f7ef3e80ad0b2a0ca498d7e248

                    SHA256

                    3de4c1ce66385b32055eb098057bba0432486c50974ce09ba99437344fd61307

                    SHA512

                    79c90fa883f63ca81400d5a31ade7465e65a76f03f5b5856c69876d174ede059373c663b8aca20338c7cd9d4b08067c0f4a7eacd7141362c0e85b720a53089dc

                  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\p5448888.exe

                    Filesize

                    145KB

                    MD5

                    174f736c365ae0bdb7ac0a58a1e252e7

                    SHA1

                    aeb1cc3cd50191f7ef3e80ad0b2a0ca498d7e248

                    SHA256

                    3de4c1ce66385b32055eb098057bba0432486c50974ce09ba99437344fd61307

                    SHA512

                    79c90fa883f63ca81400d5a31ade7465e65a76f03f5b5856c69876d174ede059373c663b8aca20338c7cd9d4b08067c0f4a7eacd7141362c0e85b720a53089dc

                  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                    Filesize

                    89KB

                    MD5

                    73c0c85e39b9a63b42f6c4ff6d634f8b

                    SHA1

                    efb047b4177ad78268f6fc8bf959f58f1123eb51

                    SHA256

                    477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                    SHA512

                    ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                    Filesize

                    89KB

                    MD5

                    73c0c85e39b9a63b42f6c4ff6d634f8b

                    SHA1

                    efb047b4177ad78268f6fc8bf959f58f1123eb51

                    SHA256

                    477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                    SHA512

                    ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                    Filesize

                    89KB

                    MD5

                    73c0c85e39b9a63b42f6c4ff6d634f8b

                    SHA1

                    efb047b4177ad78268f6fc8bf959f58f1123eb51

                    SHA256

                    477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                    SHA512

                    ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                    Filesize

                    89KB

                    MD5

                    73c0c85e39b9a63b42f6c4ff6d634f8b

                    SHA1

                    efb047b4177ad78268f6fc8bf959f58f1123eb51

                    SHA256

                    477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                    SHA512

                    ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                  • memory/108-1077-0x0000000000B80000-0x0000000000C78000-memory.dmp

                    Filesize

                    992KB

                  • memory/108-1079-0x00000000072A0000-0x00000000072E0000-memory.dmp

                    Filesize

                    256KB

                  • memory/752-1124-0x0000000000B00000-0x0000000000B40000-memory.dmp

                    Filesize

                    256KB

                  • memory/752-1123-0x0000000000B80000-0x0000000000C78000-memory.dmp

                    Filesize

                    992KB

                  • memory/824-1053-0x0000000007140000-0x0000000007180000-memory.dmp

                    Filesize

                    256KB

                  • memory/824-1052-0x0000000000FA0000-0x0000000001098000-memory.dmp

                    Filesize

                    992KB

                  • memory/1184-153-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-147-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-161-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-163-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-165-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-167-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-469-0x0000000000B50000-0x0000000000B90000-memory.dmp

                    Filesize

                    256KB

                  • memory/1184-470-0x0000000000B50000-0x0000000000B90000-memory.dmp

                    Filesize

                    256KB

                  • memory/1184-1042-0x0000000000B50000-0x0000000000B90000-memory.dmp

                    Filesize

                    256KB

                  • memory/1184-157-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-155-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-151-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-149-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-130-0x0000000002160000-0x00000000021A4000-memory.dmp

                    Filesize

                    272KB

                  • memory/1184-145-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-143-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-141-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-139-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-137-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-135-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-131-0x00000000021A0000-0x00000000021E0000-memory.dmp

                    Filesize

                    256KB

                  • memory/1184-159-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-133-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1184-132-0x00000000021A0000-0x00000000021DC000-memory.dmp

                    Filesize

                    240KB

                  • memory/1256-1130-0x0000000000400000-0x0000000000438000-memory.dmp

                    Filesize

                    224KB

                  • memory/1340-84-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

                    Filesize

                    256KB

                  • memory/1340-85-0x0000000000350000-0x000000000036E000-memory.dmp

                    Filesize

                    120KB

                  • memory/1340-86-0x0000000000840000-0x000000000085C000-memory.dmp

                    Filesize

                    112KB

                  • memory/1340-87-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-115-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

                    Filesize

                    256KB

                  • memory/1340-114-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-112-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-110-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-88-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-108-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-92-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-106-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-90-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-104-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-96-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-94-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-102-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-100-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1340-98-0x0000000000840000-0x0000000000856000-memory.dmp

                    Filesize

                    88KB

                  • memory/1572-1097-0x0000000000400000-0x0000000000438000-memory.dmp

                    Filesize

                    224KB

                  • memory/1580-1092-0x00000000070D0000-0x0000000007110000-memory.dmp

                    Filesize

                    256KB

                  • memory/1580-1090-0x0000000000B80000-0x0000000000C78000-memory.dmp

                    Filesize

                    992KB

                  • memory/1608-1098-0x0000000000400000-0x0000000000438000-memory.dmp

                    Filesize

                    224KB

                  • memory/1608-1086-0x0000000000400000-0x0000000000438000-memory.dmp

                    Filesize

                    224KB

                  • memory/1644-1074-0x0000000000400000-0x0000000000438000-memory.dmp

                    Filesize

                    224KB

                  • memory/1644-1061-0x0000000000400000-0x0000000000438000-memory.dmp

                    Filesize

                    224KB

                  • memory/1644-1062-0x0000000000320000-0x0000000000321000-memory.dmp

                    Filesize

                    4KB

                  • memory/2044-122-0x0000000000950000-0x000000000097A000-memory.dmp

                    Filesize

                    168KB

                  • memory/2044-123-0x0000000004740000-0x0000000004780000-memory.dmp

                    Filesize

                    256KB