redline | 854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544

Analysis

max time kernel
134s
max time network
150s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15/05/2023, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe
Size

1.1MB
MD5

e30860ba22fdeb251b4c47f388f50bd6
SHA1

7df122dcccad1822c13962d6493ca5423a8a8282
SHA256

854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544
SHA512

b7c993ffb4e4d85172ac24d2d956410f0827d6d383a7c0c588a133836a700044d650a274af62f637154429e8d19fdccf884211545e389d8ff6b996dfdb9ba634
SSDEEP

24576:byVfboSNAbackLZmaFjE6XtH/CGCqSvpKgF+1Ayier/f:O1b7Naacq0XWHa5qOogIier/

Score

10^/10

redline laris naher discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

laris

185.161.248.25:4132

Attributes

auth_value
8774964465c41ab67a0a17432b084e1e

Extracted

Family

redline

Botnet

naher

185.161.248.25:4132

Attributes

auth_value
91f06fcf80f600c56b2797e1c73d214d

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o9291839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o9291839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o9291839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o9291839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o9291839.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 15 IoCs

pid	Process
1720	z6723870.exe
1488	z5300368.exe
4372	o9291839.exe
4644	p7160045.exe
1100	r2646942.exe
4160	r2646942.exe
3560	r2646942.exe
4864	s5770305.exe
3728	s5770305.exe
4812	legends.exe
4460	legends.exe
756	legends.exe
4120	legends.exe
1360	legends.exe
760	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
1216	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o9291839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o9291839.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z5300368.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z6723870.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6723870.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z5300368.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 3560	1100	r2646942.exe	73
PID 4864 set thread context of 3728	4864	s5770305.exe	75
PID 4812 set thread context of 4460	4812	legends.exe	77
PID 756 set thread context of 4120	756	legends.exe	89
PID 1360 set thread context of 760	1360	legends.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4372	o9291839.exe
4372	o9291839.exe
4644	p7160045.exe
4644	p7160045.exe
3560	r2646942.exe
3560	r2646942.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	o9291839.exe
Token: SeDebugPrivilege	4644	p7160045.exe
Token: SeDebugPrivilege	1100	r2646942.exe
Token: SeDebugPrivilege	4864	s5770305.exe
Token: SeDebugPrivilege	4812	legends.exe
Token: SeDebugPrivilege	3560	r2646942.exe
Token: SeDebugPrivilege	756	legends.exe
Token: SeDebugPrivilege	1360	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3728	s5770305.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1720	4228	854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe	66
PID 4228 wrote to memory of 1720	4228	854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe	66
PID 4228 wrote to memory of 1720	4228	854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe	66
PID 1720 wrote to memory of 1488	1720	z6723870.exe	67
PID 1720 wrote to memory of 1488	1720	z6723870.exe	67
PID 1720 wrote to memory of 1488	1720	z6723870.exe	67
PID 1488 wrote to memory of 4372	1488	z5300368.exe	68
PID 1488 wrote to memory of 4372	1488	z5300368.exe	68
PID 1488 wrote to memory of 4372	1488	z5300368.exe	68
PID 1488 wrote to memory of 4644	1488	z5300368.exe	69
PID 1488 wrote to memory of 4644	1488	z5300368.exe	69
PID 1488 wrote to memory of 4644	1488	z5300368.exe	69
PID 1720 wrote to memory of 1100	1720	z6723870.exe	71
PID 1720 wrote to memory of 1100	1720	z6723870.exe	71
PID 1720 wrote to memory of 1100	1720	z6723870.exe	71
PID 1100 wrote to memory of 4160	1100	r2646942.exe	72
PID 1100 wrote to memory of 4160	1100	r2646942.exe	72
PID 1100 wrote to memory of 4160	1100	r2646942.exe	72
PID 1100 wrote to memory of 4160	1100	r2646942.exe	72
PID 1100 wrote to memory of 3560	1100	r2646942.exe	73
PID 1100 wrote to memory of 3560	1100	r2646942.exe	73
PID 1100 wrote to memory of 3560	1100	r2646942.exe	73
PID 1100 wrote to memory of 3560	1100	r2646942.exe	73
PID 1100 wrote to memory of 3560	1100	r2646942.exe	73
PID 1100 wrote to memory of 3560	1100	r2646942.exe	73
PID 1100 wrote to memory of 3560	1100	r2646942.exe	73
PID 1100 wrote to memory of 3560	1100	r2646942.exe	73
PID 4228 wrote to memory of 4864	4228	854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe	74
PID 4228 wrote to memory of 4864	4228	854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe	74
PID 4228 wrote to memory of 4864	4228	854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe	74
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 4864 wrote to memory of 3728	4864	s5770305.exe	75
PID 3728 wrote to memory of 4812	3728	s5770305.exe	76
PID 3728 wrote to memory of 4812	3728	s5770305.exe	76
PID 3728 wrote to memory of 4812	3728	s5770305.exe	76
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4812 wrote to memory of 4460	4812	legends.exe	77
PID 4460 wrote to memory of 3192	4460	legends.exe	78
PID 4460 wrote to memory of 3192	4460	legends.exe	78
PID 4460 wrote to memory of 3192	4460	legends.exe	78
PID 4460 wrote to memory of 4416	4460	legends.exe	80
PID 4460 wrote to memory of 4416	4460	legends.exe	80
PID 4460 wrote to memory of 4416	4460	legends.exe	80
PID 4416 wrote to memory of 4136	4416	cmd.exe	82
PID 4416 wrote to memory of 4136	4416	cmd.exe	82
PID 4416 wrote to memory of 4136	4416	cmd.exe	82
PID 4416 wrote to memory of 5012	4416	cmd.exe	83
PID 4416 wrote to memory of 5012	4416	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe
"C:\Users\Admin\AppData\Local\Temp\854a8c40d1c69ed55464a555cc650719623447231dbf8b00be64567d3b377544.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6723870.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6723870.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5300368.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5300368.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9291839.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9291839.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7160045.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7160045.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe
      4⤵
      Executes dropped EXE
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5770305.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5770305.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5770305.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5770305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3192
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:4932
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:1216

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:756
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:4120

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1360
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
605f809fab8c19729d39d075f7ffdb53

SHA1
c546f877c9bd53563174a90312a8337fdfc5fdd9

SHA256
6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

SHA512
82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r2646942.exe.log

Filesize
425B

MD5
605f809fab8c19729d39d075f7ffdb53

SHA1
c546f877c9bd53563174a90312a8337fdfc5fdd9

SHA256
6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

SHA512
82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5770305.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5770305.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5770305.exe

Filesize
963KB

MD5
5e82d364f8f5f3da2d09d2c154a0ebc9

SHA1
748e530440551acc72c18de3690f6b3ea9e84e16

SHA256
290b51c3f3ea99877be248ed111f62a0fb3a18330e66475b297d85e3122d2b07

SHA512
8aab26af6e30f6f8510f6c5b126eddd6ada6d7a0c3dbe636e6be931b1dd48771456c11beba596608f3912bb70570f2809b23b1fb4b6c2b1b39d321050be4a090

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6723870.exe

Filesize
702KB

MD5
83f4c5ae99b228a2d8875df48762332a

SHA1
77e43f7407c2fb0cecb59003a62f946f765c75b2

SHA256
c7351a72da7a468847604cc1d1d70633868880cde93d2f4c8050fbf3983b762d

SHA512
b210dc941182b38b367e09039c90ac44c47cc36dd48107dc672068af880641cb8330a062186d2c288445a48be9b9840bb933340e73f6c7ccfe3a4788503f7073

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6723870.exe

Filesize
702KB

MD5
83f4c5ae99b228a2d8875df48762332a

SHA1
77e43f7407c2fb0cecb59003a62f946f765c75b2

SHA256
c7351a72da7a468847604cc1d1d70633868880cde93d2f4c8050fbf3983b762d

SHA512
b210dc941182b38b367e09039c90ac44c47cc36dd48107dc672068af880641cb8330a062186d2c288445a48be9b9840bb933340e73f6c7ccfe3a4788503f7073

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe

Filesize
904KB

MD5
7e6a911f7e5ecd2a8a723b8efadaf75d

SHA1
1d89013cb1f935cff71084e3afa2a16c7a9acd9c

SHA256
eb14d49481e8afda5a297e731eee1f089a26617894755628f08529401e61e303

SHA512
0e54c671e13aa08bf3c68ac85a52c2492dcdfcf97e31806591abaf5afeb82cf8c24d0b102024b21117ebb9f91e2045972d0c90e345fd56952cd9a55deca5b472

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe

Filesize
904KB

MD5
7e6a911f7e5ecd2a8a723b8efadaf75d

SHA1
1d89013cb1f935cff71084e3afa2a16c7a9acd9c

SHA256
eb14d49481e8afda5a297e731eee1f089a26617894755628f08529401e61e303

SHA512
0e54c671e13aa08bf3c68ac85a52c2492dcdfcf97e31806591abaf5afeb82cf8c24d0b102024b21117ebb9f91e2045972d0c90e345fd56952cd9a55deca5b472

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe

Filesize
904KB

MD5
7e6a911f7e5ecd2a8a723b8efadaf75d

SHA1
1d89013cb1f935cff71084e3afa2a16c7a9acd9c

SHA256
eb14d49481e8afda5a297e731eee1f089a26617894755628f08529401e61e303

SHA512
0e54c671e13aa08bf3c68ac85a52c2492dcdfcf97e31806591abaf5afeb82cf8c24d0b102024b21117ebb9f91e2045972d0c90e345fd56952cd9a55deca5b472

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2646942.exe

Filesize
904KB

MD5
7e6a911f7e5ecd2a8a723b8efadaf75d

SHA1
1d89013cb1f935cff71084e3afa2a16c7a9acd9c

SHA256
eb14d49481e8afda5a297e731eee1f089a26617894755628f08529401e61e303

SHA512
0e54c671e13aa08bf3c68ac85a52c2492dcdfcf97e31806591abaf5afeb82cf8c24d0b102024b21117ebb9f91e2045972d0c90e345fd56952cd9a55deca5b472

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5300368.exe

Filesize
306KB

MD5
822cd5504fab41f01403941295d8917c

SHA1
01fcca6e1fcd779543d1ca6bec7fa12d6639167f

SHA256
4d4fd93ef28e6526a25ea1ccc15bb2e8392d08bbd809b2ac3539d67c455b1f51

SHA512
536f9c5dae1572169d86877189c83652421c87a995766c1d2092aed6f4bf9390bd6fd7476a32eb8e707108b69a7168a0432c7dd3c81e2e6ca6818e47d431a8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5300368.exe

Filesize
306KB

MD5
822cd5504fab41f01403941295d8917c

SHA1
01fcca6e1fcd779543d1ca6bec7fa12d6639167f

SHA256
4d4fd93ef28e6526a25ea1ccc15bb2e8392d08bbd809b2ac3539d67c455b1f51

SHA512
536f9c5dae1572169d86877189c83652421c87a995766c1d2092aed6f4bf9390bd6fd7476a32eb8e707108b69a7168a0432c7dd3c81e2e6ca6818e47d431a8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9291839.exe

Filesize
185KB

MD5
3c64a525fe37cd5dd26d7f2b330b81f8

SHA1
3cac32b76601e35c1ddb0509dd647adc2076be79

SHA256
267a96e6835d32ee1b39d6eff83ba359ef97341edc265e91a916840892ed5fe9

SHA512
377695bf6522969c5dd530bc6e6f6902509f81c141791d6c87d4a31cd6aca65e7f50334c44009dc170bd49c4bfae83d52c678c74eddbce4d151b1da7ee24114c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9291839.exe

Filesize
185KB

MD5
3c64a525fe37cd5dd26d7f2b330b81f8

SHA1
3cac32b76601e35c1ddb0509dd647adc2076be79

SHA256
267a96e6835d32ee1b39d6eff83ba359ef97341edc265e91a916840892ed5fe9

SHA512
377695bf6522969c5dd530bc6e6f6902509f81c141791d6c87d4a31cd6aca65e7f50334c44009dc170bd49c4bfae83d52c678c74eddbce4d151b1da7ee24114c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7160045.exe

Filesize
145KB

MD5
5d242bbdf472a232d718c5c38905fe70

SHA1
53ce8eaeb9471160547bee18b3c0e92f05406e1e

SHA256
cb59223767697c151c3abc94e853d4ee4bf1be85dca1516e8c2078f73212631b

SHA512
d12dd44eea33b1a3550e534cb2d65198da4ddf45a7e5b2ab46128916ecdb03d449f1afc6f55b2698ab73b8dd7b49e196bbc8b23b0b5921fe7249e39c692499c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7160045.exe

Filesize
145KB

MD5
5d242bbdf472a232d718c5c38905fe70

SHA1
53ce8eaeb9471160547bee18b3c0e92f05406e1e

SHA256
cb59223767697c151c3abc94e853d4ee4bf1be85dca1516e8c2078f73212631b

SHA512
d12dd44eea33b1a3550e534cb2d65198da4ddf45a7e5b2ab46128916ecdb03d449f1afc6f55b2698ab73b8dd7b49e196bbc8b23b0b5921fe7249e39c692499c7

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
memory/756-234-0x00000000014E0000-0x00000000014F0000-memory.dmp

Filesize
64KB

Download
memory/760-265-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/760-264-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/760-266-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1100-195-0x0000000007680000-0x0000000007690000-memory.dmp

Filesize
64KB

Download
memory/1100-194-0x00000000007C0000-0x00000000008A8000-memory.dmp

Filesize
928KB

Download
memory/1360-261-0x0000000007820000-0x0000000007830000-memory.dmp

Filesize
64KB

Download
memory/3560-205-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/3560-197-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3728-221-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3728-207-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3728-213-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3728-211-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3728-210-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4120-239-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4120-238-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4120-237-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4372-152-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-144-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-137-0x0000000002110000-0x000000000212E000-memory.dmp

Filesize
120KB

Download
memory/4372-138-0x0000000004B70000-0x000000000506E000-memory.dmp

Filesize
5.0MB

Download
memory/4372-139-0x00000000024F0000-0x000000000250C000-memory.dmp

Filesize
112KB

Download
memory/4372-140-0x0000000004B60000-0x0000000004B70000-memory.dmp

Filesize
64KB

Download
memory/4372-141-0x0000000004B60000-0x0000000004B70000-memory.dmp

Filesize
64KB

Download
memory/4372-142-0x0000000004B60000-0x0000000004B70000-memory.dmp

Filesize
64KB

Download
memory/4372-171-0x0000000004B60000-0x0000000004B70000-memory.dmp

Filesize
64KB

Download
memory/4372-170-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-143-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-156-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-168-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-154-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-146-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-148-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-166-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-164-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-162-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-160-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-150-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4372-158-0x00000000024F0000-0x0000000002507000-memory.dmp

Filesize
92KB

Download
memory/4460-226-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-227-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-229-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-230-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-257-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4644-182-0x00000000052F0000-0x000000000533B000-memory.dmp

Filesize
300KB

Download
memory/4644-181-0x0000000005170000-0x00000000051AE000-memory.dmp

Filesize
248KB

Download
memory/4644-180-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/4644-188-0x0000000006860000-0x00000000068B0000-memory.dmp

Filesize
320KB

Download
memory/4644-187-0x0000000006AB0000-0x0000000006B26000-memory.dmp

Filesize
472KB

Download
memory/4644-186-0x0000000006FE0000-0x000000000750C000-memory.dmp

Filesize
5.2MB

Download
memory/4644-189-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/4644-184-0x0000000005D10000-0x0000000005D76000-memory.dmp

Filesize
408KB

Download
memory/4644-183-0x0000000005C70000-0x0000000005D02000-memory.dmp

Filesize
584KB

Download
memory/4644-185-0x00000000068E0000-0x0000000006AA2000-memory.dmp

Filesize
1.8MB

Download
memory/4644-179-0x0000000005110000-0x0000000005122000-memory.dmp

Filesize
72KB

Download
memory/4644-178-0x00000000051E0000-0x00000000052EA000-memory.dmp

Filesize
1.0MB

Download
memory/4644-176-0x00000000008C0000-0x00000000008EA000-memory.dmp

Filesize
168KB

Download
memory/4644-177-0x0000000005660000-0x0000000005C66000-memory.dmp

Filesize
6.0MB

Download
memory/4812-222-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/4864-204-0x0000000000910000-0x0000000000A08000-memory.dmp

Filesize
992KB

Download
memory/4864-206-0x00000000076A0000-0x00000000076B0000-memory.dmp

Filesize
64KB

Download