redline | be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2023, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe
Size

1.1MB
MD5

47f93fc511264f2ce81bd39ebbcfd134
SHA1

55bb471d491022e9f1a503a9c31782d39e2b8ad5
SHA256

be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b
SHA512

acf5e9d642bb8e2cb84b6b653358c9428d99e7775328a29fe4e295d7223761cad62d0b145cf642a7bb9a61f91e7205b77f082e213d7e3e7517f75f77f14cafdd
SSDEEP

24576:ryXrcJ6Sc+wUB8HQ0GWqEef/4NJaGOTS9cqxhc1HUx8s/w8T56:ebcJ6SEUCQHtf/IJaGOTNqx83s/w8T

Score

10^/10

redline luka terra discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

luka

185.161.248.75:4132

Attributes

auth_value
44560bcd37d6bf076da309730fdb519a

Extracted

Family

redline

Botnet

terra

185.161.248.75:4132

Attributes

auth_value
60df3f535f8aa4e264f78041983592d2

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o1667725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o1667725.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o1667725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o1667725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o1667725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o1667725.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	s1166059.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 19 IoCs

pid	Process
1880	z5709279.exe
2252	z2909516.exe
3968	o1667725.exe
2352	p6347866.exe
544	r7960338.exe
2876	r7960338.exe
4576	s1166059.exe
2856	s1166059.exe
1756	s1166059.exe
3704	legends.exe
4136	legends.exe
4064	legends.exe
3760	legends.exe
2656	legends.exe
3160	legends.exe
1252	legends.exe
2456	legends.exe
372	legends.exe
2056	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
4508	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o1667725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o1667725.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z5709279.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5709279.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z2909516.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2909516.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 544 set thread context of 2876	544	r7960338.exe	90
PID 4576 set thread context of 1756	4576	s1166059.exe	94
PID 3704 set thread context of 4136	3704	legends.exe	96
PID 4064 set thread context of 3760	4064	legends.exe	108
PID 2656 set thread context of 2056	2656	legends.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
768	2352	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3968	o1667725.exe
3968	o1667725.exe
2876	r7960338.exe
2876	r7960338.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	o1667725.exe
Token: SeDebugPrivilege	544	r7960338.exe
Token: SeDebugPrivilege	4576	s1166059.exe
Token: SeDebugPrivilege	3704	legends.exe
Token: SeDebugPrivilege	2876	r7960338.exe
Token: SeDebugPrivilege	4064	legends.exe
Token: SeDebugPrivilege	2656	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1756	s1166059.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1880	1488	be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe	83
PID 1488 wrote to memory of 1880	1488	be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe	83
PID 1488 wrote to memory of 1880	1488	be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe	83
PID 1880 wrote to memory of 2252	1880	z5709279.exe	84
PID 1880 wrote to memory of 2252	1880	z5709279.exe	84
PID 1880 wrote to memory of 2252	1880	z5709279.exe	84
PID 2252 wrote to memory of 3968	2252	z2909516.exe	85
PID 2252 wrote to memory of 3968	2252	z2909516.exe	85
PID 2252 wrote to memory of 3968	2252	z2909516.exe	85
PID 2252 wrote to memory of 2352	2252	z2909516.exe	86
PID 2252 wrote to memory of 2352	2252	z2909516.exe	86
PID 2252 wrote to memory of 2352	2252	z2909516.exe	86
PID 1880 wrote to memory of 544	1880	z5709279.exe	89
PID 1880 wrote to memory of 544	1880	z5709279.exe	89
PID 1880 wrote to memory of 544	1880	z5709279.exe	89
PID 544 wrote to memory of 2876	544	r7960338.exe	90
PID 544 wrote to memory of 2876	544	r7960338.exe	90
PID 544 wrote to memory of 2876	544	r7960338.exe	90
PID 544 wrote to memory of 2876	544	r7960338.exe	90
PID 544 wrote to memory of 2876	544	r7960338.exe	90
PID 544 wrote to memory of 2876	544	r7960338.exe	90
PID 544 wrote to memory of 2876	544	r7960338.exe	90
PID 544 wrote to memory of 2876	544	r7960338.exe	90
PID 1488 wrote to memory of 4576	1488	be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe	91
PID 1488 wrote to memory of 4576	1488	be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe	91
PID 1488 wrote to memory of 4576	1488	be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe	91
PID 4576 wrote to memory of 2856	4576	s1166059.exe	92
PID 4576 wrote to memory of 2856	4576	s1166059.exe	92
PID 4576 wrote to memory of 2856	4576	s1166059.exe	92
PID 4576 wrote to memory of 2856	4576	s1166059.exe	92
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 4576 wrote to memory of 1756	4576	s1166059.exe	94
PID 1756 wrote to memory of 3704	1756	s1166059.exe	95
PID 1756 wrote to memory of 3704	1756	s1166059.exe	95
PID 1756 wrote to memory of 3704	1756	s1166059.exe	95
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 3704 wrote to memory of 4136	3704	legends.exe	96
PID 4136 wrote to memory of 2176	4136	legends.exe	97
PID 4136 wrote to memory of 2176	4136	legends.exe	97
PID 4136 wrote to memory of 2176	4136	legends.exe	97
PID 4136 wrote to memory of 3972	4136	legends.exe	99
PID 4136 wrote to memory of 3972	4136	legends.exe	99
PID 4136 wrote to memory of 3972	4136	legends.exe	99
PID 3972 wrote to memory of 2060	3972	cmd.exe	101
PID 3972 wrote to memory of 2060	3972	cmd.exe	101
PID 3972 wrote to memory of 2060	3972	cmd.exe	101
PID 3972 wrote to memory of 2140	3972	cmd.exe	102
PID 3972 wrote to memory of 2140	3972	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe
"C:\Users\Admin\AppData\Local\Temp\be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5709279.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5709279.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2909516.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2909516.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1667725.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1667725.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6347866.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6347866.exe
      4⤵
      Executes dropped EXE
      PID:2352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 928
        5⤵
        Program crash
        
        PID:768
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7960338.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7960338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7960338.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7960338.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe
    3⤵
    - Executes dropped EXE
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4136
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2176
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:2964
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2352 -ip 2352
1⤵
PID:2600

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4064
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:3760

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2656
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:2056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r7960338.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1166059.exe

Filesize
961KB

MD5
30939ef3a201c9ff2637df5b8b1efd0a

SHA1
e952e3af373f3a6156f06826b08e69fd47f2a4a3

SHA256
75848e8f24b662dfbb8e59ade5eb2ad51755094bff4f69204dc5440d78330428

SHA512
e5ca1dcd91b26686600562a2e607db52ec718aba68e55758643ce548c17cf4b2dde45f65c9c3249be790a0e490bb8e2faa63a3950c1ccd7bbb2f0b870c9765cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5709279.exe

Filesize
701KB

MD5
5147b665247277b8c784ebefc071a83d

SHA1
312bcbb58d257283db9db9cf4fadcd64292e21d1

SHA256
51bcaead677fb45ff69325db328775f52872fad1c486d8030179716d54fe375f

SHA512
d5f470692ef4793a4ef7037e5206e5743ce03b2f074b8776965327ccc59abc12a1a8e98a265a60dfcd6f6133b15dd0f076fe3b26150f85d480ef3d0dcf83e1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5709279.exe

Filesize
701KB

MD5
5147b665247277b8c784ebefc071a83d

SHA1
312bcbb58d257283db9db9cf4fadcd64292e21d1

SHA256
51bcaead677fb45ff69325db328775f52872fad1c486d8030179716d54fe375f

SHA512
d5f470692ef4793a4ef7037e5206e5743ce03b2f074b8776965327ccc59abc12a1a8e98a265a60dfcd6f6133b15dd0f076fe3b26150f85d480ef3d0dcf83e1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7960338.exe

Filesize
905KB

MD5
713a053457fd7100288b7e6d51f2abda

SHA1
ad4b2241da246e2bdd134dcdb4f779fee3bf32c3

SHA256
9b7bddf66d3291d73a42924eeba670dc4d09ceb38659d95e86433e681b7cc41b

SHA512
dbbe70577ca3649f6666af50cce56f8f918ef540a0553dcb786ed66f03d3818bab646ba668c784a7376b93b1448a4df43713d5a2fa3114ed7a5d75e07407489c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7960338.exe

Filesize
905KB

MD5
713a053457fd7100288b7e6d51f2abda

SHA1
ad4b2241da246e2bdd134dcdb4f779fee3bf32c3

SHA256
9b7bddf66d3291d73a42924eeba670dc4d09ceb38659d95e86433e681b7cc41b

SHA512
dbbe70577ca3649f6666af50cce56f8f918ef540a0553dcb786ed66f03d3818bab646ba668c784a7376b93b1448a4df43713d5a2fa3114ed7a5d75e07407489c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7960338.exe

Filesize
905KB

MD5
713a053457fd7100288b7e6d51f2abda

SHA1
ad4b2241da246e2bdd134dcdb4f779fee3bf32c3

SHA256
9b7bddf66d3291d73a42924eeba670dc4d09ceb38659d95e86433e681b7cc41b

SHA512
dbbe70577ca3649f6666af50cce56f8f918ef540a0553dcb786ed66f03d3818bab646ba668c784a7376b93b1448a4df43713d5a2fa3114ed7a5d75e07407489c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2909516.exe

Filesize
306KB

MD5
6b75c7c1fed4d69c49fb13c9620cdded

SHA1
f5dc0a0738b2fafcaee26302c7a193b2a0442aa9

SHA256
1f1b97b07a10c71b1f4a97c43b62740cf43374950ed53aebfa0942cbd9c1ed54

SHA512
f2c5a1b2fc71e6360a307c9aff8b4f2db1f43b0f9af590f87a3ca2ee6b7653dd049642f6fabf7602372c9c400e99b333198aab7829b00c05e2605ff544df858b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2909516.exe

Filesize
306KB

MD5
6b75c7c1fed4d69c49fb13c9620cdded

SHA1
f5dc0a0738b2fafcaee26302c7a193b2a0442aa9

SHA256
1f1b97b07a10c71b1f4a97c43b62740cf43374950ed53aebfa0942cbd9c1ed54

SHA512
f2c5a1b2fc71e6360a307c9aff8b4f2db1f43b0f9af590f87a3ca2ee6b7653dd049642f6fabf7602372c9c400e99b333198aab7829b00c05e2605ff544df858b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1667725.exe

Filesize
185KB

MD5
e3094d8f708df4277d502eed71b32916

SHA1
f1ae269435cb41ef3d8fee3a85e53e86fd87b386

SHA256
2bac4f151a32f52ffd022ffb4758a7ff74f096c72960be1521097e1a18ffe05e

SHA512
a7e3de7729ad304d58286b999084b6ccc534dcfc03d37dcb7e90b11ad218888a98bfde66e2e4ce98a87e82c10400a03d42bd93207ff340caba30f6aed46548cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1667725.exe

Filesize
185KB

MD5
e3094d8f708df4277d502eed71b32916

SHA1
f1ae269435cb41ef3d8fee3a85e53e86fd87b386

SHA256
2bac4f151a32f52ffd022ffb4758a7ff74f096c72960be1521097e1a18ffe05e

SHA512
a7e3de7729ad304d58286b999084b6ccc534dcfc03d37dcb7e90b11ad218888a98bfde66e2e4ce98a87e82c10400a03d42bd93207ff340caba30f6aed46548cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6347866.exe

Filesize
145KB

MD5
37c6ec29e1b5f3ee59c65d4b701487df

SHA1
ca6d47fdb4ef45fcd63de086fbcbd91ee41849a4

SHA256
699f404cc908eff7edb9b01fd6e068f0021ec606509adb8e9ce547f1887c2b7e

SHA512
098df1c563e6196c898e44a67acfa77209a8ff79397551c550f8ce944d7037de82caf3ec183134ae241c94278f15b7aad57b206ccb7873e3cbd1e4ca4d905bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6347866.exe

Filesize
145KB

MD5
37c6ec29e1b5f3ee59c65d4b701487df

SHA1
ca6d47fdb4ef45fcd63de086fbcbd91ee41849a4

SHA256
699f404cc908eff7edb9b01fd6e068f0021ec606509adb8e9ce547f1887c2b7e

SHA512
098df1c563e6196c898e44a67acfa77209a8ff79397551c550f8ce944d7037de82caf3ec183134ae241c94278f15b7aad57b206ccb7873e3cbd1e4ca4d905bcf

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/544-194-0x0000000000A30000-0x0000000000B18000-memory.dmp

Filesize
928KB

Download
memory/544-195-0x0000000007930000-0x0000000007940000-memory.dmp

Filesize
64KB

Download
memory/1756-217-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-232-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-215-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-214-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-211-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2056-286-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2056-287-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2056-288-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2352-190-0x00000000006B0000-0x00000000006DA000-memory.dmp

Filesize
168KB

Download
memory/2656-282-0x0000000007620000-0x0000000007630000-memory.dmp

Filesize
64KB

Download
memory/2656-278-0x0000000007620000-0x0000000007630000-memory.dmp

Filesize
64KB

Download
memory/2876-206-0x00000000055F0000-0x00000000056FA000-memory.dmp

Filesize
1.0MB

Download
memory/2876-233-0x0000000006180000-0x00000000061E6000-memory.dmp

Filesize
408KB

Download
memory/2876-208-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/2876-207-0x0000000005520000-0x0000000005532000-memory.dmp

Filesize
72KB

Download
memory/2876-205-0x0000000005AF0000-0x0000000006108000-memory.dmp

Filesize
6.1MB

Download
memory/2876-228-0x0000000005A20000-0x0000000005AB2000-memory.dmp

Filesize
584KB

Download
memory/2876-196-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2876-239-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/2876-238-0x0000000006E40000-0x0000000006E90000-memory.dmp

Filesize
320KB

Download
memory/2876-209-0x0000000005580000-0x00000000055BC000-memory.dmp

Filesize
240KB

Download
memory/2876-234-0x0000000006C70000-0x0000000006E32000-memory.dmp

Filesize
1.8MB

Download
memory/2876-235-0x0000000007370000-0x000000000789C000-memory.dmp

Filesize
5.2MB

Download
memory/2876-237-0x0000000006EC0000-0x0000000006F36000-memory.dmp

Filesize
472KB

Download
memory/3704-236-0x0000000006F90000-0x0000000006FA0000-memory.dmp

Filesize
64KB

Download
memory/3760-255-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3760-254-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3760-256-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3968-182-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-184-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-154-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/3968-155-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/3968-156-0x00000000049B0000-0x0000000004F54000-memory.dmp

Filesize
5.6MB

Download
memory/3968-157-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-164-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-158-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-185-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/3968-162-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-180-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-178-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-176-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-160-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-174-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-172-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-170-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-168-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/3968-166-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4064-251-0x0000000007280000-0x0000000007290000-memory.dmp

Filesize
64KB

Download
memory/4136-274-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4136-244-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4136-243-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4136-247-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4136-246-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4576-203-0x0000000000900000-0x00000000009F6000-memory.dmp

Filesize
984KB

Download
memory/4576-204-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download