redline | 9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2023, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe
Size

1.1MB
MD5

85a56a92f9dd024ed1d2cc8b9b25adb1
SHA1

0681dc99f70abee0b8e612eca612d94724e743d6
SHA256

9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981
SHA512

f7a20b132fb2301f933e23bcfa3bf6ee1881398a8e8f0b06cdfe9c023632f565353cfb05ffa353c68a30673e8bda96bc0cae4173f127f366d31efcb1f6a356b9
SSDEEP

24576:yyKgX4yO/OCt9fSQF9jcjjDBdSniRO7QGvgnTpnw/Ccv:ZkVbfSq6V4iRzGvWw/C

Score

10^/10

redline lays manka discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lays

185.161.248.75:4132

Attributes

auth_value
239cb507c4bb32e630b1bee63365fe29

Extracted

Family

redline

Botnet

manka

185.161.248.75:4132

Attributes

auth_value
d94715c55e1c02ef0aa67081d47a0c1f

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o1381575.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o1381575.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o1381575.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o1381575.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o1381575.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o1381575.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	s0025701.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 16 IoCs

pid	Process
628	z3386019.exe
4956	z6524023.exe
4940	o1381575.exe
1568	p6007165.exe
1676	r3480478.exe
2596	r3480478.exe
4452	s0025701.exe
4600	s0025701.exe
4180	legends.exe
4044	legends.exe
1060	legends.exe
212	legends.exe
2668	legends.exe
1488	legends.exe
4408	legends.exe
1896	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
728	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o1381575.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o1381575.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z3386019.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z3386019.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z6524023.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z6524023.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 2596	1676	r3480478.exe	92
PID 4452 set thread context of 4600	4452	s0025701.exe	94
PID 4180 set thread context of 4044	4180	legends.exe	97
PID 1060 set thread context of 1488	1060	legends.exe	115
PID 4408 set thread context of 1896	4408	legends.exe	118

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4940	o1381575.exe
4940	o1381575.exe
1568	p6007165.exe
1568	p6007165.exe
2596	r3480478.exe
2596	r3480478.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	o1381575.exe
Token: SeDebugPrivilege	1568	p6007165.exe
Token: SeDebugPrivilege	1676	r3480478.exe
Token: SeDebugPrivilege	4452	s0025701.exe
Token: SeDebugPrivilege	4180	legends.exe
Token: SeDebugPrivilege	2596	r3480478.exe
Token: SeDebugPrivilege	1060	legends.exe
Token: SeDebugPrivilege	4408	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4600	s0025701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 628	4280	9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe	84
PID 4280 wrote to memory of 628	4280	9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe	84
PID 4280 wrote to memory of 628	4280	9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe	84
PID 628 wrote to memory of 4956	628	z3386019.exe	85
PID 628 wrote to memory of 4956	628	z3386019.exe	85
PID 628 wrote to memory of 4956	628	z3386019.exe	85
PID 4956 wrote to memory of 4940	4956	z6524023.exe	86
PID 4956 wrote to memory of 4940	4956	z6524023.exe	86
PID 4956 wrote to memory of 4940	4956	z6524023.exe	86
PID 4956 wrote to memory of 1568	4956	z6524023.exe	90
PID 4956 wrote to memory of 1568	4956	z6524023.exe	90
PID 4956 wrote to memory of 1568	4956	z6524023.exe	90
PID 628 wrote to memory of 1676	628	z3386019.exe	91
PID 628 wrote to memory of 1676	628	z3386019.exe	91
PID 628 wrote to memory of 1676	628	z3386019.exe	91
PID 1676 wrote to memory of 2596	1676	r3480478.exe	92
PID 1676 wrote to memory of 2596	1676	r3480478.exe	92
PID 1676 wrote to memory of 2596	1676	r3480478.exe	92
PID 1676 wrote to memory of 2596	1676	r3480478.exe	92
PID 1676 wrote to memory of 2596	1676	r3480478.exe	92
PID 1676 wrote to memory of 2596	1676	r3480478.exe	92
PID 1676 wrote to memory of 2596	1676	r3480478.exe	92
PID 1676 wrote to memory of 2596	1676	r3480478.exe	92
PID 4280 wrote to memory of 4452	4280	9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe	93
PID 4280 wrote to memory of 4452	4280	9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe	93
PID 4280 wrote to memory of 4452	4280	9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe	93
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4452 wrote to memory of 4600	4452	s0025701.exe	94
PID 4600 wrote to memory of 4180	4600	s0025701.exe	96
PID 4600 wrote to memory of 4180	4600	s0025701.exe	96
PID 4600 wrote to memory of 4180	4600	s0025701.exe	96
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4180 wrote to memory of 4044	4180	legends.exe	97
PID 4044 wrote to memory of 1004	4044	legends.exe	99
PID 4044 wrote to memory of 1004	4044	legends.exe	99
PID 4044 wrote to memory of 1004	4044	legends.exe	99
PID 4044 wrote to memory of 1572	4044	legends.exe	101
PID 4044 wrote to memory of 1572	4044	legends.exe	101
PID 4044 wrote to memory of 1572	4044	legends.exe	101
PID 1572 wrote to memory of 4444	1572	cmd.exe	103
PID 1572 wrote to memory of 4444	1572	cmd.exe	103
PID 1572 wrote to memory of 4444	1572	cmd.exe	103
PID 1572 wrote to memory of 4524	1572	cmd.exe	104
PID 1572 wrote to memory of 4524	1572	cmd.exe	104
PID 1572 wrote to memory of 4524	1572	cmd.exe	104
PID 1572 wrote to memory of 3160	1572	cmd.exe	105
PID 1572 wrote to memory of 3160	1572	cmd.exe	105
PID 1572 wrote to memory of 3160	1572	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe
"C:\Users\Admin\AppData\Local\Temp\9c048ce18b0977204dd263c68241101f187d72e12db7603deae7646fbc4b1981.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3386019.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3386019.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6524023.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6524023.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1381575.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1381575.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6007165.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6007165.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1568
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3480478.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3480478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3480478.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3480478.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0025701.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0025701.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0025701.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0025701.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4044
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1004
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:4404
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:728

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1060
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1488

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4408
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r3480478.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0025701.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0025701.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0025701.exe

Filesize
963KB

MD5
845ac1a6208fc76e271a1cddd1b2781e

SHA1
de410503c1ba90f18fe0153355e587c0adf52dc2

SHA256
f5070a6c86c3bf02bb65430dcc41ef442cd6cc6e2eef198dd4a68d97c7269034

SHA512
0ca3b9c1252fdf707035d0a692b47bab0676f42792d0bb747297a676210bd0a5972d2df11ae69c208a0b7c5a305fade5e0607a94fd8adbc4ef1439112a4b8911

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3386019.exe

Filesize
703KB

MD5
d1699c9a31939ae479820a0e8803c988

SHA1
1666bc8476614c05c04ee0dc7f35508b380bb9ca

SHA256
6407c117ded77ef0f80ff087023316378d1198a4609a0c41d538cafdf9b0039c

SHA512
bda2a575744b53dea6f9a0d6198fe8be799758d2f48440fd60d5c05177fb8530348a74243a870e4afdd6c3a1ae6d6c9cd1da27582006f5001f13965a81543357

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3386019.exe

Filesize
703KB

MD5
d1699c9a31939ae479820a0e8803c988

SHA1
1666bc8476614c05c04ee0dc7f35508b380bb9ca

SHA256
6407c117ded77ef0f80ff087023316378d1198a4609a0c41d538cafdf9b0039c

SHA512
bda2a575744b53dea6f9a0d6198fe8be799758d2f48440fd60d5c05177fb8530348a74243a870e4afdd6c3a1ae6d6c9cd1da27582006f5001f13965a81543357

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3480478.exe

Filesize
904KB

MD5
1ed8d3cd6c5efdb2290debd79c2e91ba

SHA1
ffe1d49b9c16cccdde924fcdb889efffb68b8142

SHA256
18cfe9e664c70893bd5b440b59ccd383668f257342d08a5273d0525265f2d4b6

SHA512
9eb4d7c9f0015c4869ef6694f90f6fa659b5b0f5f03a498fa1c7b5adee22418302929e8eb3d7b6d0a869d38dba0ca62ede387c5670fdd5b492fa0d203fa2f60c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3480478.exe

Filesize
904KB

MD5
1ed8d3cd6c5efdb2290debd79c2e91ba

SHA1
ffe1d49b9c16cccdde924fcdb889efffb68b8142

SHA256
18cfe9e664c70893bd5b440b59ccd383668f257342d08a5273d0525265f2d4b6

SHA512
9eb4d7c9f0015c4869ef6694f90f6fa659b5b0f5f03a498fa1c7b5adee22418302929e8eb3d7b6d0a869d38dba0ca62ede387c5670fdd5b492fa0d203fa2f60c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3480478.exe

Filesize
904KB

MD5
1ed8d3cd6c5efdb2290debd79c2e91ba

SHA1
ffe1d49b9c16cccdde924fcdb889efffb68b8142

SHA256
18cfe9e664c70893bd5b440b59ccd383668f257342d08a5273d0525265f2d4b6

SHA512
9eb4d7c9f0015c4869ef6694f90f6fa659b5b0f5f03a498fa1c7b5adee22418302929e8eb3d7b6d0a869d38dba0ca62ede387c5670fdd5b492fa0d203fa2f60c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6524023.exe

Filesize
306KB

MD5
3813df7fd683f8545a15b4b859182ee9

SHA1
03c7845c77390347cc558ab468578e25b11dd84d

SHA256
27afc4227510c6ac5c69e8a50d53759e9d9da5496b791a46ea031413f1d71f51

SHA512
a77dd003433d4cab52efe8061290fabbfc59896d8ff4e987e107bcfdaf5af3e3e7d217adcb0d22abab10d96d9a9f4bdb7c03f32b0cc01ec32d3d9d9d3a8b7962

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6524023.exe

Filesize
306KB

MD5
3813df7fd683f8545a15b4b859182ee9

SHA1
03c7845c77390347cc558ab468578e25b11dd84d

SHA256
27afc4227510c6ac5c69e8a50d53759e9d9da5496b791a46ea031413f1d71f51

SHA512
a77dd003433d4cab52efe8061290fabbfc59896d8ff4e987e107bcfdaf5af3e3e7d217adcb0d22abab10d96d9a9f4bdb7c03f32b0cc01ec32d3d9d9d3a8b7962

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1381575.exe

Filesize
185KB

MD5
7e855f7483d5eb86cf2d7a39d86439d1

SHA1
46452aebb281fc4cece0787ca3736de119e54571

SHA256
c7082938ae82d2d2e673988e436a1b1453f44102860e13ada8c5475d0ae119e4

SHA512
c72dae043125884ae9a0622747a0b6d4d584662aac209c312b7fc8654128628c3215eac5174fcf7d0238461a4e97257748ebb0483a328ed6626d6070fcd736d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1381575.exe

Filesize
185KB

MD5
7e855f7483d5eb86cf2d7a39d86439d1

SHA1
46452aebb281fc4cece0787ca3736de119e54571

SHA256
c7082938ae82d2d2e673988e436a1b1453f44102860e13ada8c5475d0ae119e4

SHA512
c72dae043125884ae9a0622747a0b6d4d584662aac209c312b7fc8654128628c3215eac5174fcf7d0238461a4e97257748ebb0483a328ed6626d6070fcd736d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6007165.exe

Filesize
145KB

MD5
ec7179a3589c26ed312f5a012d5126a8

SHA1
24a4b32d1d7ce335b72c7dfd664787f29e01f5d2

SHA256
030684cb8c803b85fe0a5fe98413343aa4e0f441aed7364fe8f2bf9e7d8dbcd3

SHA512
3788391a3fb76b7cc76a5815260091c48db77c22f09f2bc688ff3e6601f1a8da4ba31d64e1465bb91bfece2e8a40f0f1e730e01451d72e2cee1fbda8ecfee326

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6007165.exe

Filesize
145KB

MD5
ec7179a3589c26ed312f5a012d5126a8

SHA1
24a4b32d1d7ce335b72c7dfd664787f29e01f5d2

SHA256
030684cb8c803b85fe0a5fe98413343aa4e0f441aed7364fe8f2bf9e7d8dbcd3

SHA512
3788391a3fb76b7cc76a5815260091c48db77c22f09f2bc688ff3e6601f1a8da4ba31d64e1465bb91bfece2e8a40f0f1e730e01451d72e2cee1fbda8ecfee326

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1060-254-0x0000000007BF0000-0x0000000007C00000-memory.dmp

Filesize
64KB

Download
memory/1488-261-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1488-260-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1488-259-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1568-203-0x0000000006F00000-0x0000000006F50000-memory.dmp

Filesize
320KB

Download
memory/1568-195-0x00000000057E0000-0x00000000057F2000-memory.dmp

Filesize
72KB

Download
memory/1568-199-0x00000000063A0000-0x0000000006406000-memory.dmp

Filesize
408KB

Download
memory/1568-200-0x00000000070D0000-0x0000000007292000-memory.dmp

Filesize
1.8MB

Download
memory/1568-201-0x00000000077D0000-0x0000000007CFC000-memory.dmp

Filesize
5.2MB

Download
memory/1568-202-0x0000000006F80000-0x0000000006FF6000-memory.dmp

Filesize
472KB

Download
memory/1568-197-0x0000000005860000-0x0000000005870000-memory.dmp

Filesize
64KB

Download
memory/1568-204-0x0000000005860000-0x0000000005870000-memory.dmp

Filesize
64KB

Download
memory/1568-196-0x0000000005870000-0x00000000058AC000-memory.dmp

Filesize
240KB

Download
memory/1568-198-0x0000000005CB0000-0x0000000005D42000-memory.dmp

Filesize
584KB

Download
memory/1568-192-0x0000000000F50000-0x0000000000F7A000-memory.dmp

Filesize
168KB

Download
memory/1568-193-0x0000000005D80000-0x0000000006398000-memory.dmp

Filesize
6.1MB

Download
memory/1568-194-0x00000000058B0000-0x00000000059BA000-memory.dmp

Filesize
1.0MB

Download
memory/1676-210-0x0000000007B00000-0x0000000007B10000-memory.dmp

Filesize
64KB

Download
memory/1676-209-0x0000000000CB0000-0x0000000000D98000-memory.dmp

Filesize
928KB

Download
memory/1896-286-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1896-287-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1896-288-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2596-211-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2596-219-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/4044-247-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4044-249-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4044-246-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4044-250-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4044-279-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4180-242-0x00000000079F0000-0x0000000007A00000-memory.dmp

Filesize
64KB

Download
memory/4408-283-0x0000000006FE0000-0x0000000006FF0000-memory.dmp

Filesize
64KB

Download
memory/4452-220-0x0000000007150000-0x0000000007160000-memory.dmp

Filesize
64KB

Download
memory/4452-218-0x0000000000230000-0x0000000000328000-memory.dmp

Filesize
992KB

Download
memory/4600-227-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4600-241-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4600-225-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4600-221-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4600-224-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4940-180-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-164-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-182-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-185-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4940-178-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-176-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-174-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-172-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-170-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-168-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-166-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-184-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-186-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4940-160-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-162-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-157-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-187-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4940-158-0x0000000002610000-0x0000000002627000-memory.dmp

Filesize
92KB

Download
memory/4940-156-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4940-155-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4940-154-0x0000000004B90000-0x0000000005134000-memory.dmp

Filesize
5.6MB

Download