redline | 385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd

Analysis

max time kernel
124s
max time network
93s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15/05/2023, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe
Size

1.1MB
MD5

53840aef3e04376307c2bca41e1f51b2
SHA1

902c3ec9809cd79f56e8dd897c4c16aaea9d7c3b
SHA256

385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd
SHA512

776b35aca3f296a175292000c8607a42e95b0b73ff12000575b7cc50abe5870080af0c197a026afd3cc94364421e0c6ec71dd2681cb77c22225b70b2b40a8c11
SSDEEP

24576:3yTJR/SKaZa1ul0GoRd0GV/ewl4int+zxMtgPfVYrbljeQOTkosmeYalb:C9R/SKaZPl0jRd0G9JttEjVY9rYko/eY

Score

10^/10

redline horor lopuh discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lopuh

185.161.248.75:4132

Attributes

auth_value
5852b05de9da526581993068a4e7e915

Extracted

Family

redline

Botnet

horor

185.161.248.75:4132

Attributes

auth_value
b8d506fe48db15c38fb031d07f42d529

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o0972697.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o0972697.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o0972697.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o0972697.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o0972697.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 15 IoCs

pid	Process
3968	z1065920.exe
4912	z1351121.exe
2068	o0972697.exe
1096	p8544600.exe
1812	r4717518.exe
4428	r4717518.exe
3092	s9788080.exe
4456	s9788080.exe
4368	legends.exe
3684	legends.exe
5048	legends.exe
4968	legends.exe
4224	legends.exe
1448	legends.exe
1952	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
652	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o0972697.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o0972697.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1065920.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1065920.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1351121.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z1351121.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 4428	1812	r4717518.exe	72
PID 3092 set thread context of 4456	3092	s9788080.exe	74
PID 4368 set thread context of 5048	4368	legends.exe	77
PID 4968 set thread context of 4224	4968	legends.exe	89
PID 1448 set thread context of 1952	1448	legends.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2068	o0972697.exe
2068	o0972697.exe
1096	p8544600.exe
1096	p8544600.exe
4428	r4717518.exe
4428	r4717518.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	o0972697.exe
Token: SeDebugPrivilege	1096	p8544600.exe
Token: SeDebugPrivilege	1812	r4717518.exe
Token: SeDebugPrivilege	3092	s9788080.exe
Token: SeDebugPrivilege	4368	legends.exe
Token: SeDebugPrivilege	4428	r4717518.exe
Token: SeDebugPrivilege	4968	legends.exe
Token: SeDebugPrivilege	1448	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4456	s9788080.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3968	1608	385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe	66
PID 1608 wrote to memory of 3968	1608	385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe	66
PID 1608 wrote to memory of 3968	1608	385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe	66
PID 3968 wrote to memory of 4912	3968	z1065920.exe	67
PID 3968 wrote to memory of 4912	3968	z1065920.exe	67
PID 3968 wrote to memory of 4912	3968	z1065920.exe	67
PID 4912 wrote to memory of 2068	4912	z1351121.exe	68
PID 4912 wrote to memory of 2068	4912	z1351121.exe	68
PID 4912 wrote to memory of 2068	4912	z1351121.exe	68
PID 4912 wrote to memory of 1096	4912	z1351121.exe	69
PID 4912 wrote to memory of 1096	4912	z1351121.exe	69
PID 4912 wrote to memory of 1096	4912	z1351121.exe	69
PID 3968 wrote to memory of 1812	3968	z1065920.exe	71
PID 3968 wrote to memory of 1812	3968	z1065920.exe	71
PID 3968 wrote to memory of 1812	3968	z1065920.exe	71
PID 1812 wrote to memory of 4428	1812	r4717518.exe	72
PID 1812 wrote to memory of 4428	1812	r4717518.exe	72
PID 1812 wrote to memory of 4428	1812	r4717518.exe	72
PID 1812 wrote to memory of 4428	1812	r4717518.exe	72
PID 1812 wrote to memory of 4428	1812	r4717518.exe	72
PID 1812 wrote to memory of 4428	1812	r4717518.exe	72
PID 1812 wrote to memory of 4428	1812	r4717518.exe	72
PID 1812 wrote to memory of 4428	1812	r4717518.exe	72
PID 1608 wrote to memory of 3092	1608	385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe	73
PID 1608 wrote to memory of 3092	1608	385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe	73
PID 1608 wrote to memory of 3092	1608	385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe	73
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 3092 wrote to memory of 4456	3092	s9788080.exe	74
PID 4456 wrote to memory of 4368	4456	s9788080.exe	75
PID 4456 wrote to memory of 4368	4456	s9788080.exe	75
PID 4456 wrote to memory of 4368	4456	s9788080.exe	75
PID 4368 wrote to memory of 3684	4368	legends.exe	76
PID 4368 wrote to memory of 3684	4368	legends.exe	76
PID 4368 wrote to memory of 3684	4368	legends.exe	76
PID 4368 wrote to memory of 3684	4368	legends.exe	76
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 4368 wrote to memory of 5048	4368	legends.exe	77
PID 5048 wrote to memory of 3392	5048	legends.exe	78
PID 5048 wrote to memory of 3392	5048	legends.exe	78
PID 5048 wrote to memory of 3392	5048	legends.exe	78
PID 5048 wrote to memory of 3416	5048	legends.exe	80
PID 5048 wrote to memory of 3416	5048	legends.exe	80
PID 5048 wrote to memory of 3416	5048	legends.exe	80
PID 3416 wrote to memory of 3460	3416	cmd.exe	82
PID 3416 wrote to memory of 3460	3416	cmd.exe	82
PID 3416 wrote to memory of 3460	3416	cmd.exe	82
PID 3416 wrote to memory of 4260	3416	cmd.exe	83
PID 3416 wrote to memory of 4260	3416	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe
"C:\Users\Admin\AppData\Local\Temp\385ca0a8eb04784bf300f53d250af9e2907cd5e7515af1e25d0e00b41b7cebdd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1065920.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1065920.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1351121.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1351121.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0972697.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0972697.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8544600.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8544600.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1096
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4717518.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4717518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4717518.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4717518.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4428
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9788080.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9788080.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9788080.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9788080.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5048
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3392
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:5108
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:652

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4968
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:4224

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1448
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
605f809fab8c19729d39d075f7ffdb53

SHA1
c546f877c9bd53563174a90312a8337fdfc5fdd9

SHA256
6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

SHA512
82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r4717518.exe.log

Filesize
425B

MD5
605f809fab8c19729d39d075f7ffdb53

SHA1
c546f877c9bd53563174a90312a8337fdfc5fdd9

SHA256
6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

SHA512
82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9788080.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9788080.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9788080.exe

Filesize
961KB

MD5
d05e3f3786561371cb824da83bb79dbe

SHA1
b8938fba6139633bad4cdf6a539306de38383c82

SHA256
c89bf4c3ae6e41293668d103574b1e5563bb611f427d37b81669ba6d2979ced2

SHA512
850a281c82a77f7daff95d095cd75934c2a03d286398dd97658ae14fcacd72e879729d77714081476e2af33d656844ca80d41d1cb52e2ff34d6cb0c52588ff06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1065920.exe

Filesize
701KB

MD5
049deef481c9ab7636baf94bdef01628

SHA1
105b58f3570ad0782602014cb1c380c2f58a4cdc

SHA256
78bb4ea2a5487290db200948145ad264fcf86e9ebd0b5905ed35354914bcd973

SHA512
95f0ab2ffe8dab77ecdead6ed3735b72cbd0f2bcf3d77f86c7e899a39a63444818107bc05a92784cf462bb4bc8d6ebf12c1ab31d48e24a607c7bf322f387a4c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1065920.exe

Filesize
701KB

MD5
049deef481c9ab7636baf94bdef01628

SHA1
105b58f3570ad0782602014cb1c380c2f58a4cdc

SHA256
78bb4ea2a5487290db200948145ad264fcf86e9ebd0b5905ed35354914bcd973

SHA512
95f0ab2ffe8dab77ecdead6ed3735b72cbd0f2bcf3d77f86c7e899a39a63444818107bc05a92784cf462bb4bc8d6ebf12c1ab31d48e24a607c7bf322f387a4c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4717518.exe

Filesize
904KB

MD5
00603c1257138dd56c5ca7d367264c05

SHA1
c4436e4d14e304df8554c4d81ece0349f02b22d2

SHA256
27ac3af2d9e5993bb7e13664f0818d5bea2456cfac52d3fdce408e30f578dcbc

SHA512
019fa81dd5b171653f4355dc365b15cfcc746107ff301d8f1db11d7a3f56ec39d7c614cd1f53ea3a0e132d7561d82e1d7b0d989ea6657351d02d53e9ad71bd84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4717518.exe

Filesize
904KB

MD5
00603c1257138dd56c5ca7d367264c05

SHA1
c4436e4d14e304df8554c4d81ece0349f02b22d2

SHA256
27ac3af2d9e5993bb7e13664f0818d5bea2456cfac52d3fdce408e30f578dcbc

SHA512
019fa81dd5b171653f4355dc365b15cfcc746107ff301d8f1db11d7a3f56ec39d7c614cd1f53ea3a0e132d7561d82e1d7b0d989ea6657351d02d53e9ad71bd84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4717518.exe

Filesize
904KB

MD5
00603c1257138dd56c5ca7d367264c05

SHA1
c4436e4d14e304df8554c4d81ece0349f02b22d2

SHA256
27ac3af2d9e5993bb7e13664f0818d5bea2456cfac52d3fdce408e30f578dcbc

SHA512
019fa81dd5b171653f4355dc365b15cfcc746107ff301d8f1db11d7a3f56ec39d7c614cd1f53ea3a0e132d7561d82e1d7b0d989ea6657351d02d53e9ad71bd84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1351121.exe

Filesize
305KB

MD5
17df74b9da4038bb767cd055d44cf3bc

SHA1
c2cd3f611a0518039b8631ad41ecafda9820776a

SHA256
02c1b6a0ed4e014fb24dd1670481fcbca4907f86f2f935f0833a667c765d3a41

SHA512
fe82017ed6c69dbc8c9d4c4ce11e6f868fab0ea7f2f516c666799eee114bd12859095e7c44bc1b8f86e5ee3f6ac001f3f2ddfce897068d85addebc356edadd1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1351121.exe

Filesize
305KB

MD5
17df74b9da4038bb767cd055d44cf3bc

SHA1
c2cd3f611a0518039b8631ad41ecafda9820776a

SHA256
02c1b6a0ed4e014fb24dd1670481fcbca4907f86f2f935f0833a667c765d3a41

SHA512
fe82017ed6c69dbc8c9d4c4ce11e6f868fab0ea7f2f516c666799eee114bd12859095e7c44bc1b8f86e5ee3f6ac001f3f2ddfce897068d85addebc356edadd1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0972697.exe

Filesize
184KB

MD5
83df2f8779a9d2ccceb2434b903620ac

SHA1
72cd37580e20c93376b645e24abf59c916f73ff4

SHA256
f5ade272c0e33ebf9e201fd0fff664d41a319f16c2fabe62b83c6557305b9259

SHA512
53fbd502786dd4728ae625d0f1b42fb60bf5b34c6dcfd1a301488bc52d01baa39d7f4c95e0f2d9217fd7a16f5a511a23c98ae2577b057ab0210993e46417e4aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0972697.exe

Filesize
184KB

MD5
83df2f8779a9d2ccceb2434b903620ac

SHA1
72cd37580e20c93376b645e24abf59c916f73ff4

SHA256
f5ade272c0e33ebf9e201fd0fff664d41a319f16c2fabe62b83c6557305b9259

SHA512
53fbd502786dd4728ae625d0f1b42fb60bf5b34c6dcfd1a301488bc52d01baa39d7f4c95e0f2d9217fd7a16f5a511a23c98ae2577b057ab0210993e46417e4aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8544600.exe

Filesize
145KB

MD5
23b54ce74c283628cc40070dd3ad41b0

SHA1
179c9e7f7c9a2e89b83beca51a061acfde59b495

SHA256
652fc7c92e7c04b3ea54fad3eb7009869ef819123f215f5d8d9e29651f6ec21e

SHA512
d7d1c571222ec290faf5029569ee168df0a035393fc9278b67b01e1bf34588268f873c41c197ea4492fa20b598c017aa1f7536c614b06295438c3461b57a06ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8544600.exe

Filesize
145KB

MD5
23b54ce74c283628cc40070dd3ad41b0

SHA1
179c9e7f7c9a2e89b83beca51a061acfde59b495

SHA256
652fc7c92e7c04b3ea54fad3eb7009869ef819123f215f5d8d9e29651f6ec21e

SHA512
d7d1c571222ec290faf5029569ee168df0a035393fc9278b67b01e1bf34588268f873c41c197ea4492fa20b598c017aa1f7536c614b06295438c3461b57a06ea

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
memory/1096-182-0x0000000005110000-0x0000000005122000-memory.dmp

Filesize
72KB

Download
memory/1096-188-0x0000000006380000-0x0000000006542000-memory.dmp

Filesize
1.8MB

Download
memory/1096-181-0x00000000051E0000-0x00000000052EA000-memory.dmp

Filesize
1.0MB

Download
memory/1096-179-0x0000000000780000-0x00000000007AA000-memory.dmp

Filesize
168KB

Download
memory/1096-183-0x0000000005170000-0x00000000051AE000-memory.dmp

Filesize
248KB

Download
memory/1096-184-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/1096-185-0x00000000052F0000-0x000000000533B000-memory.dmp

Filesize
300KB

Download
memory/1096-186-0x00000000054A0000-0x0000000005506000-memory.dmp

Filesize
408KB

Download
memory/1096-187-0x0000000006000000-0x0000000006092000-memory.dmp

Filesize
584KB

Download
memory/1096-180-0x0000000005650000-0x0000000005C56000-memory.dmp

Filesize
6.0MB

Download
memory/1096-189-0x0000000006FD0000-0x00000000074FC000-memory.dmp

Filesize
5.2MB

Download
memory/1096-190-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/1096-191-0x0000000006B20000-0x0000000006B96000-memory.dmp

Filesize
472KB

Download
memory/1096-192-0x0000000006550000-0x00000000065A0000-memory.dmp

Filesize
320KB

Download
memory/1448-264-0x0000000007C00000-0x0000000007C10000-memory.dmp

Filesize
64KB

Download
memory/1812-197-0x0000000000760000-0x0000000000848000-memory.dmp

Filesize
928KB

Download
memory/1812-198-0x0000000007670000-0x0000000007680000-memory.dmp

Filesize
64KB

Download
memory/1952-267-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1952-268-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1952-269-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2068-149-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-141-0x0000000000820000-0x000000000083E000-memory.dmp

Filesize
120KB

Download
memory/2068-151-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-159-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-157-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-153-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-161-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-147-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-163-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-165-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-155-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-146-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-143-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2068-167-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-144-0x0000000002410000-0x000000000242C000-memory.dmp

Filesize
112KB

Download
memory/2068-174-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2068-145-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2068-142-0x0000000004A30000-0x0000000004F2E000-memory.dmp

Filesize
5.0MB

Download
memory/2068-169-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-171-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/2068-173-0x0000000002410000-0x0000000002426000-memory.dmp

Filesize
88KB

Download
memory/3092-206-0x0000000000A00000-0x0000000000AF6000-memory.dmp

Filesize
984KB

Download
memory/3092-208-0x0000000007950000-0x0000000007960000-memory.dmp

Filesize
64KB

Download
memory/4224-240-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4224-241-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4224-242-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4368-224-0x0000000007840000-0x0000000007850000-memory.dmp

Filesize
64KB

Download
memory/4428-207-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/4428-199-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4456-215-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4456-222-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4456-213-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4456-212-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4456-209-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4968-237-0x00000000075C0000-0x00000000075D0000-memory.dmp

Filesize
64KB

Download
memory/5048-260-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5048-233-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5048-232-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5048-230-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5048-229-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download