redline | 5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2023 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8629d4c23ae53df1cc16f1527229dae4.exe
Size

1.1MB
MD5

8629d4c23ae53df1cc16f1527229dae4
SHA1

b49a1842163688a2768fa599f8a2529e0e84c356
SHA256

5186b8b15914efa186c1d5141a15b8fe6a5dce062583cc0c17e839dd170f011d
SHA512

3228e0478c0000cb30935e364220f36c1b66c2a44da250a4b73013b5a43f9943b83789fe18a4cf4140c4664775de9626716e685a1f1bba05c1261b4eee6a57fe
SSDEEP

24576:uyXLr3MPeaTlstp2lNHVNCRzUKzZrj1yPPREwTEjmt:9X3MXT+tp2lZCRzUKRj6JEwTE

Score

10^/10

redline luka terra discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

luka

185.161.248.75:4132

Attributes

auth_value
44560bcd37d6bf076da309730fdb519a

Extracted

Family

redline

Botnet

terra

185.161.248.75:4132

Attributes

auth_value
60df3f535f8aa4e264f78041983592d2

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

o3532759.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o3532759.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o3532759.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

s4728570.exelegends.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	s4728570.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 15 IoCs

Processes:

z7728160.exez1047074.exeo3532759.exep6151635.exer6319465.exer6319465.exer6319465.exes4728570.exes4728570.exelegends.exelegends.exelegends.exelegends.exelegends.exelegends.exe

pid	process
3112	z7728160.exe
2016	z1047074.exe
1324	o3532759.exe
452	p6151635.exe
5116	r6319465.exe
3860	r6319465.exe
3228	r6319465.exe
4208	s4728570.exe
2600	s4728570.exe
1036	legends.exe
3132	legends.exe
336	legends.exe
1256	legends.exe
984	legends.exe
1508	legends.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3028 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3028	rundll32.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

o3532759.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o3532759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o3532759.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

z1047074.exe8629d4c23ae53df1cc16f1527229dae4.exez7728160.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1047074.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z1047074.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8629d4c23ae53df1cc16f1527229dae4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8629d4c23ae53df1cc16f1527229dae4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z7728160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z7728160.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

Processes:

r6319465.exes4728570.exelegends.exelegends.exelegends.exe

description	pid	process	target process
PID 5116 set thread context of 3228	5116	r6319465.exe	r6319465.exe
PID 4208 set thread context of 2600	4208	s4728570.exe	s4728570.exe
PID 1036 set thread context of 3132	1036	legends.exe	legends.exe
PID 336 set thread context of 1256	336	legends.exe	legends.exe
PID 984 set thread context of 1508	984	legends.exe	legends.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3776 452 WerFault.exe p6151635.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4192 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

o3532759.exer6319465.exe

pid process

1324 o3532759.exe
1324 o3532759.exe
3228 r6319465.exe
3228 r6319465.exe

pid	pid_target	process	target process
3776	452	WerFault.exe	p6151635.exe

pid	process
4192	schtasks.exe

pid	process
1324	o3532759.exe
1324	o3532759.exe
3228	r6319465.exe
3228	r6319465.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

o3532759.exer6319465.exes4728570.exelegends.exer6319465.exelegends.exelegends.exe

description	pid	process
Token: SeDebugPrivilege	1324	o3532759.exe
Token: SeDebugPrivilege	5116	r6319465.exe
Token: SeDebugPrivilege	4208	s4728570.exe
Token: SeDebugPrivilege	1036	legends.exe
Token: SeDebugPrivilege	3228	r6319465.exe
Token: SeDebugPrivilege	336	legends.exe
Token: SeDebugPrivilege	984	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

s4728570.exe

pid process

2600 s4728570.exe

pid	process
2600	s4728570.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8629d4c23ae53df1cc16f1527229dae4.exez7728160.exez1047074.exer6319465.exes4728570.exes4728570.exelegends.exelegends.execmd.exe

description	pid	process	target process
PID 2800 wrote to memory of 3112	2800	8629d4c23ae53df1cc16f1527229dae4.exe	z7728160.exe
PID 2800 wrote to memory of 3112	2800	8629d4c23ae53df1cc16f1527229dae4.exe	z7728160.exe
PID 2800 wrote to memory of 3112	2800	8629d4c23ae53df1cc16f1527229dae4.exe	z7728160.exe
PID 3112 wrote to memory of 2016	3112	z7728160.exe	z1047074.exe
PID 3112 wrote to memory of 2016	3112	z7728160.exe	z1047074.exe
PID 3112 wrote to memory of 2016	3112	z7728160.exe	z1047074.exe
PID 2016 wrote to memory of 1324	2016	z1047074.exe	o3532759.exe
PID 2016 wrote to memory of 1324	2016	z1047074.exe	o3532759.exe
PID 2016 wrote to memory of 1324	2016	z1047074.exe	o3532759.exe
PID 2016 wrote to memory of 452	2016	z1047074.exe	p6151635.exe
PID 2016 wrote to memory of 452	2016	z1047074.exe	p6151635.exe
PID 2016 wrote to memory of 452	2016	z1047074.exe	p6151635.exe
PID 3112 wrote to memory of 5116	3112	z7728160.exe	r6319465.exe
PID 3112 wrote to memory of 5116	3112	z7728160.exe	r6319465.exe
PID 3112 wrote to memory of 5116	3112	z7728160.exe	r6319465.exe
PID 5116 wrote to memory of 3860	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3860	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3860	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3860	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3228	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3228	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3228	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3228	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3228	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3228	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3228	5116	r6319465.exe	r6319465.exe
PID 5116 wrote to memory of 3228	5116	r6319465.exe	r6319465.exe
PID 2800 wrote to memory of 4208	2800	8629d4c23ae53df1cc16f1527229dae4.exe	s4728570.exe
PID 2800 wrote to memory of 4208	2800	8629d4c23ae53df1cc16f1527229dae4.exe	s4728570.exe
PID 2800 wrote to memory of 4208	2800	8629d4c23ae53df1cc16f1527229dae4.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 4208 wrote to memory of 2600	4208	s4728570.exe	s4728570.exe
PID 2600 wrote to memory of 1036	2600	s4728570.exe	legends.exe
PID 2600 wrote to memory of 1036	2600	s4728570.exe	legends.exe
PID 2600 wrote to memory of 1036	2600	s4728570.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 1036 wrote to memory of 3132	1036	legends.exe	legends.exe
PID 3132 wrote to memory of 4192	3132	legends.exe	schtasks.exe
PID 3132 wrote to memory of 4192	3132	legends.exe	schtasks.exe
PID 3132 wrote to memory of 4192	3132	legends.exe	schtasks.exe
PID 3132 wrote to memory of 4416	3132	legends.exe	cmd.exe
PID 3132 wrote to memory of 4416	3132	legends.exe	cmd.exe
PID 3132 wrote to memory of 4416	3132	legends.exe	cmd.exe
PID 4416 wrote to memory of 2176	4416	cmd.exe	cmd.exe
PID 4416 wrote to memory of 2176	4416	cmd.exe	cmd.exe
PID 4416 wrote to memory of 2176	4416	cmd.exe	cmd.exe
PID 4416 wrote to memory of 1168	4416	cmd.exe	cacls.exe
PID 4416 wrote to memory of 1168	4416	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\8629d4c23ae53df1cc16f1527229dae4.exe
"C:\Users\Admin\AppData\Local\Temp\8629d4c23ae53df1cc16f1527229dae4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7728160.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7728160.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3112

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1047074.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1047074.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3532759.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3532759.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6151635.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6151635.exe
4⤵
- Executes dropped EXE
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 928
5⤵
- Program crash
PID:3776

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
4⤵
- Executes dropped EXE
PID:3860

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2600

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
6⤵
- Creates scheduled task(s)
PID:4192

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:2176

C:\Windows\SysWOW64\cacls.exe
CACLS "legends.exe" /P "Admin:N"
7⤵
PID:1168

C:\Windows\SysWOW64\cacls.exe
CACLS "legends.exe" /P "Admin:R" /E
7⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:1428

C:\Windows\SysWOW64\cacls.exe
CACLS "..\41bde21dc7" /P "Admin:N"
7⤵
PID:1432

C:\Windows\SysWOW64\cacls.exe
CACLS "..\41bde21dc7" /P "Admin:R" /E
7⤵
PID:1760

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
6⤵
- Loads dropped DLL
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 452 -ip 452
1⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:336

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
2⤵
- Executes dropped EXE
PID:1256

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
2⤵
- Executes dropped EXE
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log
Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r6319465.exe.log
Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4728570.exe
Filesize
961KB

MD5
7f1e17ea1bbf50bf4b93521a6fbb9e4f

SHA1
ef0bdb03ccf77ae9c639d267ca1fe5254d537dad

SHA256
2b952353a22b8cd39d8185eb7e37954dd17fa2a543957a2b89dd0ab3080eb5ba

SHA512
896b6525ad7ca02ba1cf628a879ec71db5228f152b9a3a3e77b0eefe95af986baf36b67a3a53d39ce95d58740f43eef4f9ad88cc46150d6c73017ae66a0fa257

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7728160.exe
Filesize
702KB

MD5
0141ad7dfa70e816b84e68c88093417f

SHA1
13f77f55e258392c9b78249948726b99f43a6cda

SHA256
257acb31a0e51dc8845e2fcfbf63fcc538055cbfda954a1a796c2bf3c6b52890

SHA512
c8fac4616b82172bee1b30426d46328d66c243fdd378a00ed88e3f076845916b7495e326c56271604be96e0b86f224c4bd273105c6557b41eb1bc17ea250d31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7728160.exe
Filesize
702KB

MD5
0141ad7dfa70e816b84e68c88093417f

SHA1
13f77f55e258392c9b78249948726b99f43a6cda

SHA256
257acb31a0e51dc8845e2fcfbf63fcc538055cbfda954a1a796c2bf3c6b52890

SHA512
c8fac4616b82172bee1b30426d46328d66c243fdd378a00ed88e3f076845916b7495e326c56271604be96e0b86f224c4bd273105c6557b41eb1bc17ea250d31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
Filesize
904KB

MD5
a4ef686d5c3855c68a37b14e0e466760

SHA1
16182064bf82125a16550a1d22a58ed4ef4790d0

SHA256
bafac1e8b6532849f8aaabdf0ae371cf4dc658e220a97cf318c91c980411a019

SHA512
4ba04ac690ba6ab28a3166cba8e7f566a80456c6e07002bc069dc2a1573979c908266c8f1e9cab05b52078990c91b7e5b4ed390649e73afbfb9742e1a040c917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
Filesize
904KB

MD5
a4ef686d5c3855c68a37b14e0e466760

SHA1
16182064bf82125a16550a1d22a58ed4ef4790d0

SHA256
bafac1e8b6532849f8aaabdf0ae371cf4dc658e220a97cf318c91c980411a019

SHA512
4ba04ac690ba6ab28a3166cba8e7f566a80456c6e07002bc069dc2a1573979c908266c8f1e9cab05b52078990c91b7e5b4ed390649e73afbfb9742e1a040c917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
Filesize
904KB

MD5
a4ef686d5c3855c68a37b14e0e466760

SHA1
16182064bf82125a16550a1d22a58ed4ef4790d0

SHA256
bafac1e8b6532849f8aaabdf0ae371cf4dc658e220a97cf318c91c980411a019

SHA512
4ba04ac690ba6ab28a3166cba8e7f566a80456c6e07002bc069dc2a1573979c908266c8f1e9cab05b52078990c91b7e5b4ed390649e73afbfb9742e1a040c917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6319465.exe
Filesize
904KB

MD5
a4ef686d5c3855c68a37b14e0e466760

SHA1
16182064bf82125a16550a1d22a58ed4ef4790d0

SHA256
bafac1e8b6532849f8aaabdf0ae371cf4dc658e220a97cf318c91c980411a019

SHA512
4ba04ac690ba6ab28a3166cba8e7f566a80456c6e07002bc069dc2a1573979c908266c8f1e9cab05b52078990c91b7e5b4ed390649e73afbfb9742e1a040c917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1047074.exe
Filesize
306KB

MD5
67ef9b80b249e283648b89f99aaeb59c

SHA1
431324e9e5bb88ee609050b0c3a9c30619ebca0a

SHA256
beb00edef8970de92844ac880e10a62357976f07318c239f1e302fd48e99e038

SHA512
c6fbb2b25b8e3e8a3ac2540f8e0e93412d69174897fa2f60e19f19371e9cef7d50f0fb9f01955c5b87004a3bb6e0e3feb30e22110af704698fe3ec476a7fd4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1047074.exe
Filesize
306KB

MD5
67ef9b80b249e283648b89f99aaeb59c

SHA1
431324e9e5bb88ee609050b0c3a9c30619ebca0a

SHA256
beb00edef8970de92844ac880e10a62357976f07318c239f1e302fd48e99e038

SHA512
c6fbb2b25b8e3e8a3ac2540f8e0e93412d69174897fa2f60e19f19371e9cef7d50f0fb9f01955c5b87004a3bb6e0e3feb30e22110af704698fe3ec476a7fd4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3532759.exe
Filesize
185KB

MD5
53072b5766d2c6d88c28308e07375f78

SHA1
67d7c5fd787a57bd1d5aea3906ba404ffdd0159e

SHA256
b5381e89d497ec5c6f52fee1117366ab6cf5c71da7c0bfe4903e44e768f62161

SHA512
78f29bb9314d1cecf5493d2444e7603cdfac9c8428c447ab1ec867fc26e13556bc2640915058e9f45bf765f5c2c5dc2a471b031e208bdfaf967e0640a8b7ff8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3532759.exe
Filesize
185KB

MD5
53072b5766d2c6d88c28308e07375f78

SHA1
67d7c5fd787a57bd1d5aea3906ba404ffdd0159e

SHA256
b5381e89d497ec5c6f52fee1117366ab6cf5c71da7c0bfe4903e44e768f62161

SHA512
78f29bb9314d1cecf5493d2444e7603cdfac9c8428c447ab1ec867fc26e13556bc2640915058e9f45bf765f5c2c5dc2a471b031e208bdfaf967e0640a8b7ff8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6151635.exe
Filesize
145KB

MD5
3bd293f5ee0b3ae7a4b5fd3bb5800ca3

SHA1
253b2dcf1d180ea00f7e065a35d28cd5eadd439a

SHA256
33e068a88673ad01e03ef2fb6bc63241a11acf5785402a6697cb9518266503a7

SHA512
2350d4d2bdbb1b1b74b3d10077d178d450b7cf5e7e9583bcc4b65cb130fbbfc181ce8b186a5fe062243eb43ea1f7b57d3dbb2c02560e5d853d174e57f7ee6e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6151635.exe
Filesize
145KB

MD5
3bd293f5ee0b3ae7a4b5fd3bb5800ca3

SHA1
253b2dcf1d180ea00f7e065a35d28cd5eadd439a

SHA256
33e068a88673ad01e03ef2fb6bc63241a11acf5785402a6697cb9518266503a7

SHA512
2350d4d2bdbb1b1b74b3d10077d178d450b7cf5e7e9583bcc4b65cb130fbbfc181ce8b186a5fe062243eb43ea1f7b57d3dbb2c02560e5d853d174e57f7ee6e6d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/336-250-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/452-190-0x0000000000E50000-0x0000000000E7A000-memory.dmp

Filesize
168KB

Download
memory/984-277-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/1036-232-0x00000000079F0000-0x0000000007A00000-memory.dmp

Filesize
64KB

Download
memory/1256-253-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1256-254-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1256-255-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1324-175-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-177-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-157-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-161-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-156-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-163-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-155-0x00000000049A0000-0x0000000004F44000-memory.dmp

Filesize
5.6MB

Download
memory/1324-167-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-159-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-184-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/1324-154-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/1324-173-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-171-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-169-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-183-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-181-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-179-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1324-185-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/1324-165-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/1508-281-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1508-280-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1508-282-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-231-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-217-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-215-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-214-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-211-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3132-273-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3132-242-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3132-241-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3132-239-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3132-238-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3228-208-0x0000000005750000-0x0000000005762000-memory.dmp

Filesize
72KB

Download
memory/3228-210-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/3228-246-0x00000000071C0000-0x0000000007236000-memory.dmp

Filesize
472KB

Download
memory/3228-245-0x00000000076F0000-0x0000000007C1C000-memory.dmp

Filesize
5.2MB

Download
memory/3228-244-0x0000000006FF0000-0x00000000071B2000-memory.dmp

Filesize
1.8MB

Download
memory/3228-234-0x0000000005C10000-0x0000000005C76000-memory.dmp

Filesize
408KB

Download
memory/3228-233-0x00000000062C0000-0x0000000006352000-memory.dmp

Filesize
584KB

Download
memory/3228-247-0x0000000006F80000-0x0000000006FD0000-memory.dmp

Filesize
320KB

Download
memory/3228-209-0x00000000057B0000-0x00000000057EC000-memory.dmp

Filesize
240KB

Download
memory/3228-207-0x0000000005820000-0x000000000592A000-memory.dmp

Filesize
1.0MB

Download
memory/3228-197-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3228-205-0x0000000005CA0000-0x00000000062B8000-memory.dmp

Filesize
6.1MB

Download
memory/4208-204-0x00000000006D0000-0x00000000007C6000-memory.dmp

Filesize
984KB

Download
memory/4208-206-0x00000000074A0000-0x00000000074B0000-memory.dmp

Filesize
64KB

Download
memory/5116-195-0x0000000007AD0000-0x0000000007AE0000-memory.dmp

Filesize
64KB

Download
memory/5116-194-0x0000000000D80000-0x0000000000E68000-memory.dmp

Filesize
928KB

Download