redline | d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc

Analysis

max time kernel
109s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2023 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe
Size

1.1MB
MD5

265bdd0b2d9edbb2f8147abc172baec2
SHA1

3c2a02e9726979e10f92af270c62442baa98411e
SHA256

d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc
SHA512

360a635f062ff7c81e12eea87d66311175317b38f8635047810ad95dfd1684fc0426e3438be6d26c01ede1d2ab3f92e4394fe2cd27d571c8535f3c85c1b92400
SSDEEP

24576:SykC0XhKUVlXi9EzA7Uj/Lvbfr5GAFhgYMvNRaY:5DUhK6NXzrbLDT5GpvNR

Score

10^/10

redline larry warum discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

larry

185.161.248.75:4132

Attributes

auth_value
9039557bb7a08f5f2f60e2b71e1dee0e

Extracted

Family

redline

Botnet

warum

185.161.248.75:4132

Attributes

auth_value
0bdb2dda91dadc65f555dee088a6a2a4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o5988690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o5988690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o5988690.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o5988690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o5988690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o5988690.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	s3966503.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 14 IoCs

pid	Process
2052	z4581856.exe
2376	z9281872.exe
3752	o5988690.exe
672	p1048106.exe
1956	r4476499.exe
548	r4476499.exe
4844	s3966503.exe
744	s3966503.exe
4976	s3966503.exe
2200	legends.exe
3040	legends.exe
1680	legends.exe
368	legends.exe
1748	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
2260	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o5988690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o5988690.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9281872.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z4581856.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4581856.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z9281872.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 548	1956	r4476499.exe	89
PID 4844 set thread context of 4976	4844	s3966503.exe	93
PID 2200 set thread context of 1680	2200	legends.exe	96
PID 368 set thread context of 1748	368	legends.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3752	o5988690.exe
3752	o5988690.exe
672	p1048106.exe
672	p1048106.exe
548	r4476499.exe
548	r4476499.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	o5988690.exe
Token: SeDebugPrivilege	672	p1048106.exe
Token: SeDebugPrivilege	1956	r4476499.exe
Token: SeDebugPrivilege	4844	s3966503.exe
Token: SeDebugPrivilege	2200	legends.exe
Token: SeDebugPrivilege	548	r4476499.exe
Token: SeDebugPrivilege	368	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4976	s3966503.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2052	4656	d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe	84
PID 4656 wrote to memory of 2052	4656	d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe	84
PID 4656 wrote to memory of 2052	4656	d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe	84
PID 2052 wrote to memory of 2376	2052	z4581856.exe	85
PID 2052 wrote to memory of 2376	2052	z4581856.exe	85
PID 2052 wrote to memory of 2376	2052	z4581856.exe	85
PID 2376 wrote to memory of 3752	2376	z9281872.exe	86
PID 2376 wrote to memory of 3752	2376	z9281872.exe	86
PID 2376 wrote to memory of 3752	2376	z9281872.exe	86
PID 2376 wrote to memory of 672	2376	z9281872.exe	87
PID 2376 wrote to memory of 672	2376	z9281872.exe	87
PID 2376 wrote to memory of 672	2376	z9281872.exe	87
PID 2052 wrote to memory of 1956	2052	z4581856.exe	88
PID 2052 wrote to memory of 1956	2052	z4581856.exe	88
PID 2052 wrote to memory of 1956	2052	z4581856.exe	88
PID 1956 wrote to memory of 548	1956	r4476499.exe	89
PID 1956 wrote to memory of 548	1956	r4476499.exe	89
PID 1956 wrote to memory of 548	1956	r4476499.exe	89
PID 1956 wrote to memory of 548	1956	r4476499.exe	89
PID 1956 wrote to memory of 548	1956	r4476499.exe	89
PID 1956 wrote to memory of 548	1956	r4476499.exe	89
PID 1956 wrote to memory of 548	1956	r4476499.exe	89
PID 1956 wrote to memory of 548	1956	r4476499.exe	89
PID 4656 wrote to memory of 4844	4656	d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe	91
PID 4656 wrote to memory of 4844	4656	d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe	91
PID 4656 wrote to memory of 4844	4656	d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe	91
PID 4844 wrote to memory of 744	4844	s3966503.exe	92
PID 4844 wrote to memory of 744	4844	s3966503.exe	92
PID 4844 wrote to memory of 744	4844	s3966503.exe	92
PID 4844 wrote to memory of 744	4844	s3966503.exe	92
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4844 wrote to memory of 4976	4844	s3966503.exe	93
PID 4976 wrote to memory of 2200	4976	s3966503.exe	94
PID 4976 wrote to memory of 2200	4976	s3966503.exe	94
PID 4976 wrote to memory of 2200	4976	s3966503.exe	94
PID 2200 wrote to memory of 3040	2200	legends.exe	95
PID 2200 wrote to memory of 3040	2200	legends.exe	95
PID 2200 wrote to memory of 3040	2200	legends.exe	95
PID 2200 wrote to memory of 3040	2200	legends.exe	95
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 2200 wrote to memory of 1680	2200	legends.exe	96
PID 1680 wrote to memory of 3736	1680	legends.exe	97
PID 1680 wrote to memory of 3736	1680	legends.exe	97
PID 1680 wrote to memory of 3736	1680	legends.exe	97
PID 1680 wrote to memory of 4796	1680	legends.exe	99
PID 1680 wrote to memory of 4796	1680	legends.exe	99
PID 1680 wrote to memory of 4796	1680	legends.exe	99
PID 4796 wrote to memory of 4700	4796	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe
"C:\Users\Admin\AppData\Local\Temp\d11f80b80518c20c9e2ba3d4a09d68d8ac3ed6cb48b5a46bd17adfaa8e4587fc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4581856.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4581856.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9281872.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9281872.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5988690.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5988690.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1048106.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1048106.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:672
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4476499.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4476499.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4476499.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4476499.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:548
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe
    3⤵
    - Executes dropped EXE
    PID:744
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1680
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3736
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:4812
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:2260

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:368
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r4476499.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3966503.exe

Filesize
962KB

MD5
4de7f6013227b389ada47d5ab26a2866

SHA1
1f2ff7c4649426e1a4c50d60fd9d2789823399e4

SHA256
5879a851b9a2d6a19d7c6d7a5f4421705c5472d6bf04d26f49db09f4fe94fd6e

SHA512
bd48c9a2d0e2ab6ed916b7994be85407dc25b39ba26ae8e96523dc0ea5323f6055d542105dd30c238c743c4fc6c552fd1cac19c7fea022f749f28273e875e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4581856.exe

Filesize
700KB

MD5
4c2188349f8a9f096fb59e708525ed68

SHA1
55edce49343bbd1fa2c869dcd1bc269d2bb530e7

SHA256
9b770a5cdba5fae38feb947504c435e65c0c33f447c74fc19aee39d8560941e6

SHA512
b5f4ebaeeebea80b2874ac5a17ba22cc0e050e1f790191dfbd94ae2f7ce287a0530d5e45e5210ac4db46ee43176a4376e3d1fede3bbebcb0d4bfe14640d7ea3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4581856.exe

Filesize
700KB

MD5
4c2188349f8a9f096fb59e708525ed68

SHA1
55edce49343bbd1fa2c869dcd1bc269d2bb530e7

SHA256
9b770a5cdba5fae38feb947504c435e65c0c33f447c74fc19aee39d8560941e6

SHA512
b5f4ebaeeebea80b2874ac5a17ba22cc0e050e1f790191dfbd94ae2f7ce287a0530d5e45e5210ac4db46ee43176a4376e3d1fede3bbebcb0d4bfe14640d7ea3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4476499.exe

Filesize
903KB

MD5
978cc6645cd721696400c36e67f05fbf

SHA1
500ec8afd0b4988634c47ff9249791bd9a5525b2

SHA256
b72be4821323191b3fd42bdcf84a2728b153faca54b7c597b4d729db79a6e802

SHA512
72fc140ed1b8798667698f3d5fa8b8daf21c9729cf7a5a797254506539e2fbbe38ae75e3e3646b24b565dc16da88752bbaaa62028c3cf33849d2053c8e2d41d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4476499.exe

Filesize
903KB

MD5
978cc6645cd721696400c36e67f05fbf

SHA1
500ec8afd0b4988634c47ff9249791bd9a5525b2

SHA256
b72be4821323191b3fd42bdcf84a2728b153faca54b7c597b4d729db79a6e802

SHA512
72fc140ed1b8798667698f3d5fa8b8daf21c9729cf7a5a797254506539e2fbbe38ae75e3e3646b24b565dc16da88752bbaaa62028c3cf33849d2053c8e2d41d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4476499.exe

Filesize
903KB

MD5
978cc6645cd721696400c36e67f05fbf

SHA1
500ec8afd0b4988634c47ff9249791bd9a5525b2

SHA256
b72be4821323191b3fd42bdcf84a2728b153faca54b7c597b4d729db79a6e802

SHA512
72fc140ed1b8798667698f3d5fa8b8daf21c9729cf7a5a797254506539e2fbbe38ae75e3e3646b24b565dc16da88752bbaaa62028c3cf33849d2053c8e2d41d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9281872.exe

Filesize
305KB

MD5
0d4e9605f4d1ee144ff89768ccaeab8c

SHA1
1c96d1096a8e01a4fe1ca69db4fac0e2fa802812

SHA256
2cd8ec5a1f71f1022f6a17d6ece2aee09af9d4e1fb85e1a4de71d3ba1319f86b

SHA512
12ab7cdb59c085e3782968fb271df7c49fcb07f5372a7f0b8bff20d71bca23a29f0976cf4021b2896f69eaf8f9a2b474ecf410e22abeda4448ff142c54efcec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9281872.exe

Filesize
305KB

MD5
0d4e9605f4d1ee144ff89768ccaeab8c

SHA1
1c96d1096a8e01a4fe1ca69db4fac0e2fa802812

SHA256
2cd8ec5a1f71f1022f6a17d6ece2aee09af9d4e1fb85e1a4de71d3ba1319f86b

SHA512
12ab7cdb59c085e3782968fb271df7c49fcb07f5372a7f0b8bff20d71bca23a29f0976cf4021b2896f69eaf8f9a2b474ecf410e22abeda4448ff142c54efcec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5988690.exe

Filesize
183KB

MD5
e16479182966c8ec1cdfc776e6596289

SHA1
48ede8bacc9a4477db6a45b3d4465379f969aeba

SHA256
3c78070b5d7a9ec422de18ace41357c65bb41fadebaa9e630ddcb60f514c1331

SHA512
7b4844ab27fad62131ade87028440adc86068e655b06061180b8bd6c59ef9726de2f634b5e43321a3cb466a684fb1424c71d467ba06a3eeacf2c3a1ca9f88bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5988690.exe

Filesize
183KB

MD5
e16479182966c8ec1cdfc776e6596289

SHA1
48ede8bacc9a4477db6a45b3d4465379f969aeba

SHA256
3c78070b5d7a9ec422de18ace41357c65bb41fadebaa9e630ddcb60f514c1331

SHA512
7b4844ab27fad62131ade87028440adc86068e655b06061180b8bd6c59ef9726de2f634b5e43321a3cb466a684fb1424c71d467ba06a3eeacf2c3a1ca9f88bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1048106.exe

Filesize
145KB

MD5
24c2dce52ee80709b00cddd5f4f521fb

SHA1
bdc69ca6801170efe7b18be20e1e7704fa6b9869

SHA256
02cac10913cac3aa22601666fe8fbb4a49a9557e86bbf5645dad39efdef0c025

SHA512
aa1193d23238d22eaf854f72bdf9a4a86cd20177837d1d7b74e1a9ed5543596cfa43dfee4075d307c67a16b1bcca162f61dbf5432efd4667969f80f4e9df61bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1048106.exe

Filesize
145KB

MD5
24c2dce52ee80709b00cddd5f4f521fb

SHA1
bdc69ca6801170efe7b18be20e1e7704fa6b9869

SHA256
02cac10913cac3aa22601666fe8fbb4a49a9557e86bbf5645dad39efdef0c025

SHA512
aa1193d23238d22eaf854f72bdf9a4a86cd20177837d1d7b74e1a9ed5543596cfa43dfee4075d307c67a16b1bcca162f61dbf5432efd4667969f80f4e9df61bb

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/368-274-0x0000000006F60000-0x0000000006F70000-memory.dmp

Filesize
64KB

Download
memory/548-216-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/548-208-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/672-201-0x0000000007040000-0x0000000007090000-memory.dmp

Filesize
320KB

Download
memory/672-190-0x0000000000F90000-0x0000000000FBA000-memory.dmp

Filesize
168KB

Download
memory/672-196-0x0000000005BC0000-0x0000000005C52000-memory.dmp

Filesize
584KB

Download
memory/672-197-0x0000000006390000-0x00000000063F6000-memory.dmp

Filesize
408KB

Download
memory/672-198-0x00000000070C0000-0x0000000007282000-memory.dmp

Filesize
1.8MB

Download
memory/672-199-0x00000000077C0000-0x0000000007CEC000-memory.dmp

Filesize
5.2MB

Download
memory/672-200-0x0000000007290000-0x0000000007306000-memory.dmp

Filesize
472KB

Download
memory/672-195-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/672-191-0x0000000005D70000-0x0000000006388000-memory.dmp

Filesize
6.1MB

Download
memory/672-194-0x0000000005890000-0x00000000058CC000-memory.dmp

Filesize
240KB

Download
memory/672-192-0x00000000058F0000-0x00000000059FA000-memory.dmp

Filesize
1.0MB

Download
memory/672-193-0x0000000005820000-0x0000000005832000-memory.dmp

Filesize
72KB

Download
memory/1680-269-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1680-250-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1680-245-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1680-248-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1680-246-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1748-277-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1748-278-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1748-279-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1956-207-0x0000000006EB0000-0x0000000006EC0000-memory.dmp

Filesize
64KB

Download
memory/1956-206-0x0000000000030000-0x0000000000118000-memory.dmp

Filesize
928KB

Download
memory/2200-240-0x0000000007B10000-0x0000000007B20000-memory.dmp

Filesize
64KB

Download
memory/3752-164-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-162-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-174-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-172-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-176-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-155-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/3752-156-0x0000000004A80000-0x0000000005024000-memory.dmp

Filesize
5.6MB

Download
memory/3752-185-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/3752-184-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-182-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-180-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-178-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-154-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/3752-158-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-157-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-170-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-166-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-168-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3752-160-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/4844-215-0x00000000006F0000-0x00000000007E6000-memory.dmp

Filesize
984KB

Download
memory/4844-217-0x0000000007460000-0x0000000007470000-memory.dmp

Filesize
64KB

Download
memory/4976-223-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4976-222-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4976-227-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4976-219-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4976-239-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download