Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2023, 00:09

General

  • Target

    d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe

  • Size

    1.0MB

  • MD5

    b0263760bf5ff8a38db7cc401763d269

  • SHA1

    7518df3da9c6b396e758ee790722ba6cc6148437

  • SHA256

    d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55

  • SHA512

    b4c7a456a7a63f0795441162977377c286d512c04a745b4bad0fe6390b3e076a5103b0f6ae201da38771e29a0466a3aff55e944732fe308699649f4d998eedff

  • SSDEEP

    12288:/MrDy90max4mx1CqdMI8Wum8gOs0SL1/+VZqMNQKxwAUL/0eWpC/DiN/27ncp+8O:Uy9ax/mNtW30K1/+/qMN/xwv0eU2rsO

Malware Config

Extracted

Family

redline

Botnet

lupa

C2

83.97.73.126:19046

Attributes
  • auth_value

    6a764aa41830c77712442516d143bc9c

Extracted

Family

redline

Botnet

metro

C2

83.97.73.126:19046

Attributes
  • auth_value

    f7fd4aa816bdbaad933b45b51d9b6b1a

Extracted

Family

vidar

Version

4.1

Botnet

c784f88cbd0064e2b88a2354266d33ad

C2

https://steamcommunity.com/profiles/76561199510444991

https://t.me/task4manager

Attributes
  • profile_id_v2

    c784f88cbd0064e2b88a2354266d33ad

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 16 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe
    "C:\Users\Admin\AppData\Local\Temp\d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4829718.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4829718.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7431170.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7431170.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3002181.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3002181.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1092
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1952
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9536417.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9536417.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4384
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9080284.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9080284.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4104
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4788
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe
        3⤵
        • Executes dropped EXE
        PID:1312
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
          "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3236
          • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3196
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4908
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:884
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:1980
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "legends.exe" /P "Admin:N"
                  7⤵
                    PID:2092
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "legends.exe" /P "Admin:R" /E
                    7⤵
                      PID:1596
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:1548
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\41bde21dc7" /P "Admin:N"
                        7⤵
                          PID:4456
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\41bde21dc7" /P "Admin:R" /E
                          7⤵
                            PID:4280
                        • C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:3012
                          • C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe"
                            7⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2824
                        • C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4152
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                            7⤵
                            • Loads dropped DLL
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4348
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 1920
                              8⤵
                              • Program crash
                              PID:1696
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:2952
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4348 -ip 4348
                1⤵
                  PID:3656
                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4732
                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                    C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                    2⤵
                    • Executes dropped EXE
                    PID:4996
                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2104
                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                    C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                    2⤵
                    • Executes dropped EXE
                    PID:1900

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\mozglue.dll

                  Filesize

                  593KB

                  MD5

                  c8fd9be83bc728cc04beffafc2907fe9

                  SHA1

                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                  SHA256

                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                  SHA512

                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                • C:\ProgramData\nss3.dll

                  Filesize

                  2.0MB

                  MD5

                  1cc453cdf74f31e4d913ff9c10acdde2

                  SHA1

                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                  SHA256

                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                  SHA512

                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                  Filesize

                  226B

                  MD5

                  916851e072fbabc4796d8916c5131092

                  SHA1

                  d48a602229a690c512d5fdaf4c8d77547a88e7a2

                  SHA256

                  7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                  SHA512

                  07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

                  Filesize

                  425B

                  MD5

                  4eaca4566b22b01cd3bc115b9b0b2196

                  SHA1

                  e743e0792c19f71740416e7b3c061d9f1336bf94

                  SHA256

                  34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                  SHA512

                  bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

                • C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe

                  Filesize

                  369KB

                  MD5

                  8072726bf6f29230d619ec971b3d2a29

                  SHA1

                  d1ae1b4ed834bf26d5ac06f01d55bbac8297e0b5

                  SHA256

                  afbd589d3c919482f8d1e3b52c5fe9031522d20ed918362fc36796f1afe2822d

                  SHA512

                  d20f66b8a1534076efc25977dd55a3badc7eaf7b9c4ccaca4915554247877927a3bb9ef20ad5d80fa60a550c5198c5b637c06acf899300c30504e52ec0145fa2

                • C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe

                  Filesize

                  369KB

                  MD5

                  8072726bf6f29230d619ec971b3d2a29

                  SHA1

                  d1ae1b4ed834bf26d5ac06f01d55bbac8297e0b5

                  SHA256

                  afbd589d3c919482f8d1e3b52c5fe9031522d20ed918362fc36796f1afe2822d

                  SHA512

                  d20f66b8a1534076efc25977dd55a3badc7eaf7b9c4ccaca4915554247877927a3bb9ef20ad5d80fa60a550c5198c5b637c06acf899300c30504e52ec0145fa2

                • C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe

                  Filesize

                  369KB

                  MD5

                  8072726bf6f29230d619ec971b3d2a29

                  SHA1

                  d1ae1b4ed834bf26d5ac06f01d55bbac8297e0b5

                  SHA256

                  afbd589d3c919482f8d1e3b52c5fe9031522d20ed918362fc36796f1afe2822d

                  SHA512

                  d20f66b8a1534076efc25977dd55a3badc7eaf7b9c4ccaca4915554247877927a3bb9ef20ad5d80fa60a550c5198c5b637c06acf899300c30504e52ec0145fa2

                • C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe

                  Filesize

                  369KB

                  MD5

                  8072726bf6f29230d619ec971b3d2a29

                  SHA1

                  d1ae1b4ed834bf26d5ac06f01d55bbac8297e0b5

                  SHA256

                  afbd589d3c919482f8d1e3b52c5fe9031522d20ed918362fc36796f1afe2822d

                  SHA512

                  d20f66b8a1534076efc25977dd55a3badc7eaf7b9c4ccaca4915554247877927a3bb9ef20ad5d80fa60a550c5198c5b637c06acf899300c30504e52ec0145fa2

                • C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

                  Filesize

                  483KB

                  MD5

                  0a7b50db665086a9588887b8d19f0ba5

                  SHA1

                  2d88b48091de92899a6c8d565f05d1587b2d2257

                  SHA256

                  c100171736d5bc04a75a3570b7a32f9027290b593de87acf90fb01d48faab4bf

                  SHA512

                  30a0fa9c52e6bf932b87c4fbf3edeac274d7503c1e325b8c5960d02f018e7ba1dc1cb20a0502765e508073a66bbe1f6c993e2a98bb523237a776b6d8c82fc965

                • C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

                  Filesize

                  483KB

                  MD5

                  0a7b50db665086a9588887b8d19f0ba5

                  SHA1

                  2d88b48091de92899a6c8d565f05d1587b2d2257

                  SHA256

                  c100171736d5bc04a75a3570b7a32f9027290b593de87acf90fb01d48faab4bf

                  SHA512

                  30a0fa9c52e6bf932b87c4fbf3edeac274d7503c1e325b8c5960d02f018e7ba1dc1cb20a0502765e508073a66bbe1f6c993e2a98bb523237a776b6d8c82fc965

                • C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

                  Filesize

                  483KB

                  MD5

                  0a7b50db665086a9588887b8d19f0ba5

                  SHA1

                  2d88b48091de92899a6c8d565f05d1587b2d2257

                  SHA256

                  c100171736d5bc04a75a3570b7a32f9027290b593de87acf90fb01d48faab4bf

                  SHA512

                  30a0fa9c52e6bf932b87c4fbf3edeac274d7503c1e325b8c5960d02f018e7ba1dc1cb20a0502765e508073a66bbe1f6c993e2a98bb523237a776b6d8c82fc965

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe

                  Filesize

                  965KB

                  MD5

                  0f0118725f7159936d4894499ffda94d

                  SHA1

                  d380025750758ab8195c13c4a242bdffda68c8d6

                  SHA256

                  705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448

                  SHA512

                  9ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4829718.exe

                  Filesize

                  621KB

                  MD5

                  627958df7cbd2d98bf845b3e44bd5401

                  SHA1

                  5f921603afc325a97f5a79a4411a78e02f9ff4fc

                  SHA256

                  8968d7edf4c3e66f71fb44fe041982d6b4860b9fbd7a54ff2d055a3fb84b7a8c

                  SHA512

                  906d42df23e877df665f759fdf2e25251811343dc0b01f4cc3b9864cdfc3baee974fc98c9b6fbd15b8c7f5b161199f86d89e91f183ab413c0966b00b6c38eb0e

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4829718.exe

                  Filesize

                  621KB

                  MD5

                  627958df7cbd2d98bf845b3e44bd5401

                  SHA1

                  5f921603afc325a97f5a79a4411a78e02f9ff4fc

                  SHA256

                  8968d7edf4c3e66f71fb44fe041982d6b4860b9fbd7a54ff2d055a3fb84b7a8c

                  SHA512

                  906d42df23e877df665f759fdf2e25251811343dc0b01f4cc3b9864cdfc3baee974fc98c9b6fbd15b8c7f5b161199f86d89e91f183ab413c0966b00b6c38eb0e

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9080284.exe

                  Filesize

                  322KB

                  MD5

                  31ba5b37f8b7f8a9cee8db5b63b6434f

                  SHA1

                  114f4832c1316f00d27b898ce53568069cf6b413

                  SHA256

                  8def11fd0af79539f6162c8bea9efefa6f4c41440a2ab08fd16cd419c383ca4b

                  SHA512

                  179ec43acc454d1e5f27e0f01bb74815562b4c01b8b52e816230c23907614f3930ebb2b947ccd41693df6c3cf650f0fcccd2be9aaec81c0a45ed2acbe3ed4f72

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9080284.exe

                  Filesize

                  322KB

                  MD5

                  31ba5b37f8b7f8a9cee8db5b63b6434f

                  SHA1

                  114f4832c1316f00d27b898ce53568069cf6b413

                  SHA256

                  8def11fd0af79539f6162c8bea9efefa6f4c41440a2ab08fd16cd419c383ca4b

                  SHA512

                  179ec43acc454d1e5f27e0f01bb74815562b4c01b8b52e816230c23907614f3930ebb2b947ccd41693df6c3cf650f0fcccd2be9aaec81c0a45ed2acbe3ed4f72

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7431170.exe

                  Filesize

                  283KB

                  MD5

                  91950f99edae34dab07face52368856e

                  SHA1

                  243057137c16bb258880d0c5c858b1fdf09e2534

                  SHA256

                  a1630456ec9c03b508379807249c53bbfd550b39ff23b8f3e1567ee74a208ce0

                  SHA512

                  ae147086ec93f07211df1dc1208441098050dc86aa8baccf5b6dafb4d5f48d4d0970a404e1dbec5ea2279d2651a7cd1c4689b964aac39b9247c195d56aa0fb9e

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7431170.exe

                  Filesize

                  283KB

                  MD5

                  91950f99edae34dab07face52368856e

                  SHA1

                  243057137c16bb258880d0c5c858b1fdf09e2534

                  SHA256

                  a1630456ec9c03b508379807249c53bbfd550b39ff23b8f3e1567ee74a208ce0

                  SHA512

                  ae147086ec93f07211df1dc1208441098050dc86aa8baccf5b6dafb4d5f48d4d0970a404e1dbec5ea2279d2651a7cd1c4689b964aac39b9247c195d56aa0fb9e

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3002181.exe

                  Filesize

                  166KB

                  MD5

                  cb9d5bc5d0a9b24561c27ff22a2cbace

                  SHA1

                  3ca7048486c7e16a70be9fe2d634f1d1b57f0e22

                  SHA256

                  0094504c03bfb4d8290368de7672e228e4790884390e4e88aa8f3184f900579d

                  SHA512

                  271eee0d80751686eecb8f7f613c3ef7e0ae67c19dae8fcb19809fc1ad40b2e6d926b49ac4eecb8664cdb9aed9fbf81f99888dc3685a9ddcb0eb1850aa4d5284

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3002181.exe

                  Filesize

                  166KB

                  MD5

                  cb9d5bc5d0a9b24561c27ff22a2cbace

                  SHA1

                  3ca7048486c7e16a70be9fe2d634f1d1b57f0e22

                  SHA256

                  0094504c03bfb4d8290368de7672e228e4790884390e4e88aa8f3184f900579d

                  SHA512

                  271eee0d80751686eecb8f7f613c3ef7e0ae67c19dae8fcb19809fc1ad40b2e6d926b49ac4eecb8664cdb9aed9fbf81f99888dc3685a9ddcb0eb1850aa4d5284

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9536417.exe

                  Filesize

                  168KB

                  MD5

                  d8dadb5e9fc02553b2d6496ceb87f9ff

                  SHA1

                  a80d109075b5814a22df91b65f1361c3788bac92

                  SHA256

                  ac166525df3cd85fbf4487bf894b6d78574e8de85ea03bc8f8b20bbb55c4ccec

                  SHA512

                  a96b9810fb6490f0b1ff74ea9a47b83175e2b537b828c2a9aeb14b3969f0b129a253947a4ed6ace647b1f1efd0180c2415cff9d99eca2e836ee929b61f92aae7

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9536417.exe

                  Filesize

                  168KB

                  MD5

                  d8dadb5e9fc02553b2d6496ceb87f9ff

                  SHA1

                  a80d109075b5814a22df91b65f1361c3788bac92

                  SHA256

                  ac166525df3cd85fbf4487bf894b6d78574e8de85ea03bc8f8b20bbb55c4ccec

                  SHA512

                  a96b9810fb6490f0b1ff74ea9a47b83175e2b537b828c2a9aeb14b3969f0b129a253947a4ed6ace647b1f1efd0180c2415cff9d99eca2e836ee929b61f92aae7

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  73c0c85e39b9a63b42f6c4ff6d634f8b

                  SHA1

                  efb047b4177ad78268f6fc8bf959f58f1123eb51

                  SHA256

                  477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                  SHA512

                  ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  73c0c85e39b9a63b42f6c4ff6d634f8b

                  SHA1

                  efb047b4177ad78268f6fc8bf959f58f1123eb51

                  SHA256

                  477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                  SHA512

                  ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  73c0c85e39b9a63b42f6c4ff6d634f8b

                  SHA1

                  efb047b4177ad78268f6fc8bf959f58f1123eb51

                  SHA256

                  477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                  SHA512

                  ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/1900-1425-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1952-154-0x0000000000390000-0x000000000039A000-memory.dmp

                  Filesize

                  40KB

                • memory/2104-1420-0x0000000007890000-0x00000000078A0000-memory.dmp

                  Filesize

                  64KB

                • memory/2824-244-0x0000000000400000-0x000000000044C000-memory.dmp

                  Filesize

                  304KB

                • memory/2824-286-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-1398-0x0000000000400000-0x000000000044C000-memory.dmp

                  Filesize

                  304KB

                • memory/2824-1394-0x00000000020B0000-0x00000000020C0000-memory.dmp

                  Filesize

                  64KB

                • memory/2824-1393-0x00000000020B0000-0x00000000020C0000-memory.dmp

                  Filesize

                  64KB

                • memory/2824-1392-0x00000000020B0000-0x00000000020C0000-memory.dmp

                  Filesize

                  64KB

                • memory/2824-1382-0x00000000020B0000-0x00000000020C0000-memory.dmp

                  Filesize

                  64KB

                • memory/2824-310-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-307-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-303-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-294-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-298-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-297-0x00000000020B0000-0x00000000020C0000-memory.dmp

                  Filesize

                  64KB

                • memory/2824-295-0x00000000020B0000-0x00000000020C0000-memory.dmp

                  Filesize

                  64KB

                • memory/2824-293-0x00000000020B0000-0x00000000020C0000-memory.dmp

                  Filesize

                  64KB

                • memory/2824-247-0x0000000000400000-0x000000000044C000-memory.dmp

                  Filesize

                  304KB

                • memory/2824-290-0x0000000000400000-0x000000000044C000-memory.dmp

                  Filesize

                  304KB

                • memory/2824-248-0x0000000000400000-0x000000000044C000-memory.dmp

                  Filesize

                  304KB

                • memory/2824-291-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-288-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-269-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-284-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-270-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-281-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-273-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-275-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-277-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/2824-279-0x0000000004F70000-0x0000000004FB2000-memory.dmp

                  Filesize

                  264KB

                • memory/3012-246-0x00000000006E0000-0x000000000072A000-memory.dmp

                  Filesize

                  296KB

                • memory/3196-222-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3196-234-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3196-219-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3196-259-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3196-220-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3196-268-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3196-241-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3196-223-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3236-215-0x00000000075B0000-0x00000000075C0000-memory.dmp

                  Filesize

                  64KB

                • memory/4228-190-0x00000000005F0000-0x00000000006E8000-memory.dmp

                  Filesize

                  992KB

                • memory/4228-191-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

                  Filesize

                  64KB

                • memory/4348-299-0x0000000000400000-0x000000000046A000-memory.dmp

                  Filesize

                  424KB

                • memory/4384-166-0x00000000056E0000-0x00000000056F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4384-171-0x000000000B950000-0x000000000B9B6000-memory.dmp

                  Filesize

                  408KB

                • memory/4384-164-0x000000000ADB0000-0x000000000AEBA000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4384-175-0x000000000C680000-0x000000000C842000-memory.dmp

                  Filesize

                  1.8MB

                • memory/4384-163-0x000000000B290000-0x000000000B8A8000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4384-167-0x000000000AD40000-0x000000000AD7C000-memory.dmp

                  Filesize

                  240KB

                • memory/4384-173-0x00000000056E0000-0x00000000056F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4384-165-0x000000000ACE0000-0x000000000ACF2000-memory.dmp

                  Filesize

                  72KB

                • memory/4384-168-0x000000000B150000-0x000000000B1C6000-memory.dmp

                  Filesize

                  472KB

                • memory/4384-170-0x000000000BF00000-0x000000000C4A4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4384-169-0x000000000B8B0000-0x000000000B942000-memory.dmp

                  Filesize

                  584KB

                • memory/4384-176-0x000000000CD80000-0x000000000D2AC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/4384-162-0x0000000000E30000-0x0000000000E5E000-memory.dmp

                  Filesize

                  184KB

                • memory/4384-174-0x000000000BEA0000-0x000000000BEF0000-memory.dmp

                  Filesize

                  320KB

                • memory/4700-203-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/4700-198-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/4700-196-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/4700-194-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/4700-214-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/4732-1385-0x0000000007510000-0x0000000007520000-memory.dmp

                  Filesize

                  64KB

                • memory/4788-181-0x0000000000400000-0x000000000042E000-memory.dmp

                  Filesize

                  184KB

                • memory/4788-192-0x00000000050F0000-0x0000000005100000-memory.dmp

                  Filesize

                  64KB

                • memory/4996-1391-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB