redline | 5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2023 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe
Size

1.1MB
MD5

8629d4c23ae53df1cc16f1527229dae4
SHA1

b49a1842163688a2768fa599f8a2529e0e84c356
SHA256

5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d
SHA512

3228e0478c0000cb30935e364220f36c1b66c2a44da250a4b73013b5a43f9943b83789fe18a4cf4140c4664775de9626716e685a1f1bba05c1261b4eee6a57fe
SSDEEP

24576:uyXLr3MPeaTlstp2lNHVNCRzUKzZrj1yPPREwTEjmt:9X3MXT+tp2lZCRzUKRj6JEwTE

Score

10^/10

redline luka terra discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

luka

185.161.248.75:4132

Attributes

auth_value
44560bcd37d6bf076da309730fdb519a

Extracted

Family

redline

Botnet

terra

185.161.248.75:4132

Attributes

auth_value
60df3f535f8aa4e264f78041983592d2

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o3532759.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	s4728570.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 14 IoCs

pid	Process
4252	z7728160.exe
552	z1047074.exe
1436	o3532759.exe
824	p6151635.exe
908	r6319465.exe
4152	r6319465.exe
2180	s4728570.exe
4360	s4728570.exe
2244	legends.exe
3752	legends.exe
4436	legends.exe
1144	legends.exe
2700	legends.exe
3872	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o3532759.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z7728160.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1047074.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z1047074.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z7728160.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 4152	908	r6319465.exe	94
PID 2180 set thread context of 4360	2180	s4728570.exe	96
PID 2244 set thread context of 3752	2244	legends.exe	98
PID 4436 set thread context of 1144	4436	legends.exe	111
PID 2700 set thread context of 3872	2700	legends.exe	118

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1752	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	824	WerFault.exe	90

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1436	o3532759.exe
1436	o3532759.exe
4152	r6319465.exe
4152	r6319465.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	o3532759.exe
Token: SeDebugPrivilege	908	r6319465.exe
Token: SeDebugPrivilege	2180	s4728570.exe
Token: SeDebugPrivilege	2244	legends.exe
Token: SeDebugPrivilege	4152	r6319465.exe
Token: SeDebugPrivilege	4436	legends.exe
Token: SeDebugPrivilege	2700	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4360	s4728570.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4252	4432	5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe	84
PID 4432 wrote to memory of 4252	4432	5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe	84
PID 4432 wrote to memory of 4252	4432	5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe	84
PID 4252 wrote to memory of 552	4252	z7728160.exe	85
PID 4252 wrote to memory of 552	4252	z7728160.exe	85
PID 4252 wrote to memory of 552	4252	z7728160.exe	85
PID 552 wrote to memory of 1436	552	z1047074.exe	86
PID 552 wrote to memory of 1436	552	z1047074.exe	86
PID 552 wrote to memory of 1436	552	z1047074.exe	86
PID 552 wrote to memory of 824	552	z1047074.exe	90
PID 552 wrote to memory of 824	552	z1047074.exe	90
PID 552 wrote to memory of 824	552	z1047074.exe	90
PID 4252 wrote to memory of 908	4252	z7728160.exe	93
PID 4252 wrote to memory of 908	4252	z7728160.exe	93
PID 4252 wrote to memory of 908	4252	z7728160.exe	93
PID 908 wrote to memory of 4152	908	r6319465.exe	94
PID 908 wrote to memory of 4152	908	r6319465.exe	94
PID 908 wrote to memory of 4152	908	r6319465.exe	94
PID 908 wrote to memory of 4152	908	r6319465.exe	94
PID 908 wrote to memory of 4152	908	r6319465.exe	94
PID 908 wrote to memory of 4152	908	r6319465.exe	94
PID 908 wrote to memory of 4152	908	r6319465.exe	94
PID 908 wrote to memory of 4152	908	r6319465.exe	94
PID 4432 wrote to memory of 2180	4432	5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe	95
PID 4432 wrote to memory of 2180	4432	5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe	95
PID 4432 wrote to memory of 2180	4432	5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe	95
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 2180 wrote to memory of 4360	2180	s4728570.exe	96
PID 4360 wrote to memory of 2244	4360	s4728570.exe	97
PID 4360 wrote to memory of 2244	4360	s4728570.exe	97
PID 4360 wrote to memory of 2244	4360	s4728570.exe	97
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 2244 wrote to memory of 3752	2244	legends.exe	98
PID 3752 wrote to memory of 3032	3752	legends.exe	99
PID 3752 wrote to memory of 3032	3752	legends.exe	99
PID 3752 wrote to memory of 3032	3752	legends.exe	99
PID 3752 wrote to memory of 5076	3752	legends.exe	101
PID 3752 wrote to memory of 5076	3752	legends.exe	101
PID 3752 wrote to memory of 5076	3752	legends.exe	101
PID 5076 wrote to memory of 1468	5076	cmd.exe	103
PID 5076 wrote to memory of 1468	5076	cmd.exe	103
PID 5076 wrote to memory of 1468	5076	cmd.exe	103
PID 5076 wrote to memory of 1456	5076	cmd.exe	104
PID 5076 wrote to memory of 1456	5076	cmd.exe	104
PID 5076 wrote to memory of 1456	5076	cmd.exe	104
PID 5076 wrote to memory of 4460	5076	cmd.exe	105
PID 5076 wrote to memory of 4460	5076	cmd.exe	105
PID 5076 wrote to memory of 4460	5076	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe
"C:\Users\Admin\AppData\Local\Temp\5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7728160.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7728160.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1047074.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1047074.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3532759.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3532759.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6151635.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6151635.exe
      4⤵
      Executes dropped EXE
      PID:824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 928
        5⤵
        Program crash
        
        PID:1788
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4152
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3752
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3032
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:3380
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 824 -ip 824
1⤵
PID:3668

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4436
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1144

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2700
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:3872

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r6319465.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe

Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7728160.exe

Filesize
702KB

MD5
0141ad7dfa70e816b84e68c88093417f

SHA1
13f77f55e258392c9b78249948726b99f43a6cda

SHA256
257acb31a0e51dc8845e2fcfbf63fcc538055cbfda954a1a796c2bf3c6b52890

SHA512
c8fac4616b82172bee1b30426d46328d66c243fdd378a00ed88e3f076845916b7495e326c56271604be96e0b86f224c4bd273105c6557b41eb1bc17ea250d31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7728160.exe

Filesize
702KB

MD5
0141ad7dfa70e816b84e68c88093417f

SHA1
13f77f55e258392c9b78249948726b99f43a6cda

SHA256
257acb31a0e51dc8845e2fcfbf63fcc538055cbfda954a1a796c2bf3c6b52890

SHA512
c8fac4616b82172bee1b30426d46328d66c243fdd378a00ed88e3f076845916b7495e326c56271604be96e0b86f224c4bd273105c6557b41eb1bc17ea250d31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe

Filesize
904KB

MD5
a4ef686d5c3855c68a37b14e0e466760

SHA1
16182064bf82125a16550a1d22a58ed4ef4790d0

SHA256
bafac1e8b6532849f8aaabdf0ae371cf4dc658e220a97cf318c91c980411a019

SHA512
4ba04ac690ba6ab28a3166cba8e7f566a80456c6e07002bc069dc2a1573979c908266c8f1e9cab05b52078990c91b7e5b4ed390649e73afbfb9742e1a040c917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe

Filesize
904KB

MD5
a4ef686d5c3855c68a37b14e0e466760

SHA1
16182064bf82125a16550a1d22a58ed4ef4790d0

SHA256
bafac1e8b6532849f8aaabdf0ae371cf4dc658e220a97cf318c91c980411a019

SHA512
4ba04ac690ba6ab28a3166cba8e7f566a80456c6e07002bc069dc2a1573979c908266c8f1e9cab05b52078990c91b7e5b4ed390649e73afbfb9742e1a040c917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe

Filesize
904KB

MD5
a4ef686d5c3855c68a37b14e0e466760

SHA1
16182064bf82125a16550a1d22a58ed4ef4790d0

SHA256
bafac1e8b6532849f8aaabdf0ae371cf4dc658e220a97cf318c91c980411a019

SHA512
4ba04ac690ba6ab28a3166cba8e7f566a80456c6e07002bc069dc2a1573979c908266c8f1e9cab05b52078990c91b7e5b4ed390649e73afbfb9742e1a040c917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1047074.exe

Filesize
306KB

MD5
67ef9b80b249e283648b89f99aaeb59c

SHA1
431324e9e5bb88ee609050b0c3a9c30619ebca0a

SHA256
beb00edef8970de92844ac880e10a62357976f07318c239f1e302fd48e99e038

SHA512
c6fbb2b25b8e3e8a3ac2540f8e0e93412d69174897fa2f60e19f19371e9cef7d50f0fb9f01955c5b87004a3bb6e0e3feb30e22110af704698fe3ec476a7fd4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1047074.exe

Filesize
306KB

MD5
67ef9b80b249e283648b89f99aaeb59c

SHA1
431324e9e5bb88ee609050b0c3a9c30619ebca0a

SHA256
beb00edef8970de92844ac880e10a62357976f07318c239f1e302fd48e99e038

SHA512
c6fbb2b25b8e3e8a3ac2540f8e0e93412d69174897fa2f60e19f19371e9cef7d50f0fb9f01955c5b87004a3bb6e0e3feb30e22110af704698fe3ec476a7fd4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3532759.exe

Filesize
185KB

MD5
53072b5766d2c6d88c28308e07375f78

SHA1
67d7c5fd787a57bd1d5aea3906ba404ffdd0159e

SHA256
b5381e89d497ec5c6f52fee1117366ab6cf5c71da7c0bfe4903e44e768f62161

SHA512
78f29bb9314d1cecf5493d2444e7603cdfac9c8428c447ab1ec867fc26e13556bc2640915058e9f45bf765f5c2c5dc2a471b031e208bdfaf967e0640a8b7ff8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3532759.exe

Filesize
185KB

MD5
53072b5766d2c6d88c28308e07375f78

SHA1
67d7c5fd787a57bd1d5aea3906ba404ffdd0159e

SHA256
b5381e89d497ec5c6f52fee1117366ab6cf5c71da7c0bfe4903e44e768f62161

SHA512
78f29bb9314d1cecf5493d2444e7603cdfac9c8428c447ab1ec867fc26e13556bc2640915058e9f45bf765f5c2c5dc2a471b031e208bdfaf967e0640a8b7ff8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6151635.exe

Filesize
145KB

MD5
3bd293f5ee0b3ae7a4b5fd3bb5800ca3

SHA1
253b2dcf1d180ea00f7e065a35d28cd5eadd439a

SHA256
33e068a88673ad01e03ef2fb6bc63241a11acf5785402a6697cb9518266503a7

SHA512
2350d4d2bdbb1b1b74b3d10077d178d450b7cf5e7e9583bcc4b65cb130fbbfc181ce8b186a5fe062243eb43ea1f7b57d3dbb2c02560e5d853d174e57f7ee6e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6151635.exe

Filesize
145KB

MD5
3bd293f5ee0b3ae7a4b5fd3bb5800ca3

SHA1
253b2dcf1d180ea00f7e065a35d28cd5eadd439a

SHA256
33e068a88673ad01e03ef2fb6bc63241a11acf5785402a6697cb9518266503a7

SHA512
2350d4d2bdbb1b1b74b3d10077d178d450b7cf5e7e9583bcc4b65cb130fbbfc181ce8b186a5fe062243eb43ea1f7b57d3dbb2c02560e5d853d174e57f7ee6e6d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/824-192-0x0000000000090000-0x00000000000BA000-memory.dmp

Filesize
168KB

Download
memory/908-196-0x0000000000A90000-0x0000000000B78000-memory.dmp

Filesize
928KB

Download
memory/908-197-0x0000000007840000-0x0000000007850000-memory.dmp

Filesize
64KB

Download
memory/1144-256-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1144-255-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1144-254-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1436-162-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-169-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/1436-187-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/1436-186-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/1436-185-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/1436-160-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-154-0x0000000004A40000-0x0000000004FE4000-memory.dmp

Filesize
5.6MB

Download
memory/1436-164-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-184-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-155-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-182-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-166-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-180-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-178-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-176-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-174-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-158-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-172-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-167-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/1436-156-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/1436-170-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/2180-207-0x0000000007C60000-0x0000000007C70000-memory.dmp

Filesize
64KB

Download
memory/2180-205-0x0000000000E90000-0x0000000000F86000-memory.dmp

Filesize
984KB

Download
memory/2244-233-0x0000000007A70000-0x0000000007A80000-memory.dmp

Filesize
64KB

Download
memory/2700-278-0x00000000070F0000-0x0000000007100000-memory.dmp

Filesize
64KB

Download
memory/3752-239-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3752-240-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3752-242-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3752-243-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3752-274-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3872-283-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3872-281-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3872-282-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4152-208-0x0000000005360000-0x000000000546A000-memory.dmp

Filesize
1.0MB

Download
memory/4152-211-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/4152-198-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4152-247-0x0000000006DB0000-0x0000000006F72000-memory.dmp

Filesize
1.8MB

Download
memory/4152-246-0x00000000063D0000-0x0000000006420000-memory.dmp

Filesize
320KB

Download
memory/4152-245-0x0000000006450000-0x00000000064C6000-memory.dmp

Filesize
472KB

Download
memory/4152-235-0x00000000061B0000-0x0000000006242000-memory.dmp

Filesize
584KB

Download
memory/4152-234-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/4152-206-0x00000000057E0000-0x0000000005DF8000-memory.dmp

Filesize
6.1MB

Download
memory/4152-209-0x0000000005290000-0x00000000052A2000-memory.dmp

Filesize
72KB

Download
memory/4152-210-0x00000000052F0000-0x000000000532C000-memory.dmp

Filesize
240KB

Download
memory/4152-248-0x00000000074B0000-0x00000000079DC000-memory.dmp

Filesize
5.2MB

Download
memory/4360-212-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4360-215-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4360-216-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4360-218-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4360-232-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4436-251-0x0000000006E10000-0x0000000006E20000-memory.dmp

Filesize
64KB

Download