redline | d20cf92c909d377865f3b2517b229e8468e304d79514ca15c2bde4933224ba1a

Analysis

max time kernel
114s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2023, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

generator.exe
Size

1.0MB
MD5

ea4a54d1d59d579f0aab18c54ef8c99d
SHA1

17658bd94ed410a9fb7b48025f6a2e49d709949a
SHA256

d20cf92c909d377865f3b2517b229e8468e304d79514ca15c2bde4933224ba1a
SHA512

fa5c0b3e2bc906aa8c80506dbdfee2089fa6cffe36c672b88b20358bd89e6020eccec17f7c1386e4a97b48d52d845f530ae33d8a977c0e8fea5b65ce0253eeee
SSDEEP

24576:vyjnPamoApaeokxxmUEgT+CIkYNC8E/Dx5rq/4ByEl2lvULU:6T7DzYUJYNC9xNqmyKqvQ

Score

10^/10

redline leren discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

leren

77.91.68.253:19065

Attributes

auth_value
4002956b5a03c59e4252363b86bc7713

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o1857887.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o1857887.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o1857887.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o1857887.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o1857887.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o1857887.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

resource	yara_rule
behavioral2/memory/4116-209-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-210-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-212-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-214-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-216-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-218-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-220-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-222-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-224-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-226-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-230-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-228-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-232-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-234-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-236-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-238-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-240-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-242-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline
behavioral2/memory/4116-244-0x0000000004990000-0x00000000049CC000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	s5681433.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 12 IoCs

pid	Process
4268	z3772856.exe
1720	z5511289.exe
3284	o1857887.exe
1344	p3485207.exe
4116	r9466750.exe
5000	s5681433.exe
4764	s5681433.exe
3380	legends.exe
2440	legends.exe
1652	legends.exe
4460	legends.exe
404	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
2488	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o1857887.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o1857887.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z3772856.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z5511289.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z5511289.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	generator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	generator.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z3772856.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5000 set thread context of 4764	5000	s5681433.exe	90
PID 3380 set thread context of 1652	3380	legends.exe	93
PID 4460 set thread context of 404	4460	legends.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3284	o1857887.exe
3284	o1857887.exe
1344	p3485207.exe
1344	p3485207.exe
4116	r9466750.exe
4116	r9466750.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3284	o1857887.exe
Token: SeDebugPrivilege	1344	p3485207.exe
Token: SeDebugPrivilege	4116	r9466750.exe
Token: SeDebugPrivilege	5000	s5681433.exe
Token: SeDebugPrivilege	3380	legends.exe
Token: SeDebugPrivilege	4460	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4764	s5681433.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4268	3704	generator.exe	83
PID 3704 wrote to memory of 4268	3704	generator.exe	83
PID 3704 wrote to memory of 4268	3704	generator.exe	83
PID 4268 wrote to memory of 1720	4268	z3772856.exe	84
PID 4268 wrote to memory of 1720	4268	z3772856.exe	84
PID 4268 wrote to memory of 1720	4268	z3772856.exe	84
PID 1720 wrote to memory of 3284	1720	z5511289.exe	85
PID 1720 wrote to memory of 3284	1720	z5511289.exe	85
PID 1720 wrote to memory of 3284	1720	z5511289.exe	85
PID 1720 wrote to memory of 1344	1720	z5511289.exe	86
PID 1720 wrote to memory of 1344	1720	z5511289.exe	86
PID 1720 wrote to memory of 1344	1720	z5511289.exe	86
PID 4268 wrote to memory of 4116	4268	z3772856.exe	87
PID 4268 wrote to memory of 4116	4268	z3772856.exe	87
PID 4268 wrote to memory of 4116	4268	z3772856.exe	87
PID 3704 wrote to memory of 5000	3704	generator.exe	89
PID 3704 wrote to memory of 5000	3704	generator.exe	89
PID 3704 wrote to memory of 5000	3704	generator.exe	89
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 5000 wrote to memory of 4764	5000	s5681433.exe	90
PID 4764 wrote to memory of 3380	4764	s5681433.exe	91
PID 4764 wrote to memory of 3380	4764	s5681433.exe	91
PID 4764 wrote to memory of 3380	4764	s5681433.exe	91
PID 3380 wrote to memory of 2440	3380	legends.exe	92
PID 3380 wrote to memory of 2440	3380	legends.exe	92
PID 3380 wrote to memory of 2440	3380	legends.exe	92
PID 3380 wrote to memory of 2440	3380	legends.exe	92
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 3380 wrote to memory of 1652	3380	legends.exe	93
PID 1652 wrote to memory of 4768	1652	legends.exe	94
PID 1652 wrote to memory of 4768	1652	legends.exe	94
PID 1652 wrote to memory of 4768	1652	legends.exe	94
PID 1652 wrote to memory of 4012	1652	legends.exe	96
PID 1652 wrote to memory of 4012	1652	legends.exe	96
PID 1652 wrote to memory of 4012	1652	legends.exe	96
PID 4012 wrote to memory of 4048	4012	cmd.exe	98
PID 4012 wrote to memory of 4048	4012	cmd.exe	98
PID 4012 wrote to memory of 4048	4012	cmd.exe	98
PID 4012 wrote to memory of 3756	4012	cmd.exe	99
PID 4012 wrote to memory of 3756	4012	cmd.exe	99
PID 4012 wrote to memory of 3756	4012	cmd.exe	99
PID 4012 wrote to memory of 4624	4012	cmd.exe	100
PID 4012 wrote to memory of 4624	4012	cmd.exe	100
PID 4012 wrote to memory of 4624	4012	cmd.exe	100
PID 4012 wrote to memory of 1320	4012	cmd.exe	101
PID 4012 wrote to memory of 1320	4012	cmd.exe	101
PID 4012 wrote to memory of 1320	4012	cmd.exe	101
PID 4012 wrote to memory of 644	4012	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\generator.exe
"C:\Users\Admin\AppData\Local\Temp\generator.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3772856.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3772856.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5511289.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5511289.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1857887.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1857887.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3485207.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3485207.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1344
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9466750.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9466750.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5681433.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5681433.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5681433.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5681433.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1652
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4768
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:644
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:4308
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:2488

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4460
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5681433.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5681433.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5681433.exe

Filesize
962KB

MD5
877ce85c8ad66533d8bafb81533a00aa

SHA1
ceae7dec12b3d687a3cad36e7641918e156d0ab9

SHA256
47dd82483196a4510eb07c20c89a41477c4c7e688a825d498170d6f9adab56af

SHA512
27646a35e69a528180f1e1b62174b77a9fd3ca22a5d5458c99c09298661419a2fe96a3bf9d6c18c90fbe94bc06e0735b521ff60670f3bff18372e1af48e8472c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3772856.exe

Filesize
584KB

MD5
e871bbfbbd2e9803f415838674d32b1f

SHA1
54790e0fe008d626170f941601118a2089656a59

SHA256
208bf8930f740be8da0b91f4bc0bcbe64054a274321ff14c0b74bbe9c69a095e

SHA512
5264ca8019e79831a3b4d1507e86fb23b321ae8b261ccb320eea66309650ab90e1798f20a95088c58abd5dc815d048f5b8b2f6c7bb4a31667eda718299378045

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3772856.exe

Filesize
584KB

MD5
e871bbfbbd2e9803f415838674d32b1f

SHA1
54790e0fe008d626170f941601118a2089656a59

SHA256
208bf8930f740be8da0b91f4bc0bcbe64054a274321ff14c0b74bbe9c69a095e

SHA512
5264ca8019e79831a3b4d1507e86fb23b321ae8b261ccb320eea66309650ab90e1798f20a95088c58abd5dc815d048f5b8b2f6c7bb4a31667eda718299378045

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9466750.exe

Filesize
284KB

MD5
3384cea0eb61a277b90d5879a34a5c8e

SHA1
4408a99c7fde2f4afb013520c349554c92c87c8d

SHA256
409f388fc22f923d801fa4b3a30d8f8eedd8f1c1e771c38833b535721861e43a

SHA512
92b7788a8c7bd8448227c84dc9aac3a21e33fc2d886eee07f26c2553910a919f6bb960159b61bbb28b3d4e613d379de72b24d0f897550f1432396be80cf5fd8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9466750.exe

Filesize
284KB

MD5
3384cea0eb61a277b90d5879a34a5c8e

SHA1
4408a99c7fde2f4afb013520c349554c92c87c8d

SHA256
409f388fc22f923d801fa4b3a30d8f8eedd8f1c1e771c38833b535721861e43a

SHA512
92b7788a8c7bd8448227c84dc9aac3a21e33fc2d886eee07f26c2553910a919f6bb960159b61bbb28b3d4e613d379de72b24d0f897550f1432396be80cf5fd8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5511289.exe

Filesize
305KB

MD5
eadbc0bc77bd3a88cfd05668f9a693ca

SHA1
f17fe25f8347994cb8b3202ece6686144d6195cd

SHA256
878b93cdc882cf0e77d92e55443341a79d6f50e2845a4c06380c9614963931a3

SHA512
9223161934831b8fcc5bb52b25fdd9d063bf8d866f8558f2b2db6d0b78edd4990e1afbfc9d1fbf8cd77afa6496ca5145575495988027ba3b7cbfbd60871ff824

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5511289.exe

Filesize
305KB

MD5
eadbc0bc77bd3a88cfd05668f9a693ca

SHA1
f17fe25f8347994cb8b3202ece6686144d6195cd

SHA256
878b93cdc882cf0e77d92e55443341a79d6f50e2845a4c06380c9614963931a3

SHA512
9223161934831b8fcc5bb52b25fdd9d063bf8d866f8558f2b2db6d0b78edd4990e1afbfc9d1fbf8cd77afa6496ca5145575495988027ba3b7cbfbd60871ff824

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1857887.exe

Filesize
184KB

MD5
3fa83c859ab9f49a6af7ea91d025a081

SHA1
4ac74861afec78e9ddab6d30fbb26ff4a0c397b0

SHA256
3c131b7ab642a5a3a1981fd81a8819b8058b46e0907fb8746921c1c757d73a6b

SHA512
8713c02e5b224791e5ad4edb6ff3adcc3251ec81fc6be7717ea93304dd2eddb50d9f985dab18134ca7aa5c76b3b2abf05537360fe017349b667e520f3e700160

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o1857887.exe

Filesize
184KB

MD5
3fa83c859ab9f49a6af7ea91d025a081

SHA1
4ac74861afec78e9ddab6d30fbb26ff4a0c397b0

SHA256
3c131b7ab642a5a3a1981fd81a8819b8058b46e0907fb8746921c1c757d73a6b

SHA512
8713c02e5b224791e5ad4edb6ff3adcc3251ec81fc6be7717ea93304dd2eddb50d9f985dab18134ca7aa5c76b3b2abf05537360fe017349b667e520f3e700160

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3485207.exe

Filesize
145KB

MD5
16ad0dac0629d14cb5609fe4395b7ca4

SHA1
e26335d4558e44aff1c12c8e7ef76f83e2ed284b

SHA256
e435ff76d424975463710bfebd23424a38aa7dd542afa29ef3493de16c49cba4

SHA512
7f2f79f48087cfb198ff508127c844c89a5e7c9e7e74433067f0d1a58f8ed55df27d8bf1d74c3d3739f059cb8fb08a92039c6623e7b8426c43643a18fb26d653

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3485207.exe

Filesize
145KB

MD5
16ad0dac0629d14cb5609fe4395b7ca4

SHA1
e26335d4558e44aff1c12c8e7ef76f83e2ed284b

SHA256
e435ff76d424975463710bfebd23424a38aa7dd542afa29ef3493de16c49cba4

SHA512
7f2f79f48087cfb198ff508127c844c89a5e7c9e7e74433067f0d1a58f8ed55df27d8bf1d74c3d3739f059cb8fb08a92039c6623e7b8426c43643a18fb26d653

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/404-1190-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1344-193-0x0000000005B70000-0x0000000006188000-memory.dmp

Filesize
6.1MB

Download
memory/1344-202-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/1344-204-0x00000000076C0000-0x0000000007BEC000-memory.dmp

Filesize
5.2MB

Download
memory/1344-192-0x0000000000C50000-0x0000000000C7A000-memory.dmp

Filesize
168KB

Download
memory/1344-203-0x0000000006FC0000-0x0000000007182000-memory.dmp

Filesize
1.8MB

Download
memory/1344-194-0x00000000056F0000-0x00000000057FA000-memory.dmp

Filesize
1.0MB

Download
memory/1344-195-0x0000000005620000-0x0000000005632000-memory.dmp

Filesize
72KB

Download
memory/1344-196-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/1344-197-0x0000000005680000-0x00000000056BC000-memory.dmp

Filesize
240KB

Download
memory/1344-198-0x00000000059E0000-0x0000000005A72000-memory.dmp

Filesize
584KB

Download
memory/1344-199-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Filesize
408KB

Download
memory/1344-200-0x0000000006670000-0x00000000066E6000-memory.dmp

Filesize
472KB

Download
memory/1344-201-0x00000000066F0000-0x0000000006740000-memory.dmp

Filesize
320KB

Download
memory/1652-1159-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1652-1162-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3284-168-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-164-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-182-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-180-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-178-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-176-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-174-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-172-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-170-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-186-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3284-184-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-166-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-185-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3284-187-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3284-162-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-160-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-154-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3284-158-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-157-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/3284-156-0x0000000004AF0000-0x0000000005094000-memory.dmp

Filesize
5.6MB

Download
memory/3284-155-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3380-1151-0x00000000078B0000-0x00000000078C0000-memory.dmp

Filesize
64KB

Download
memory/4116-212-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-236-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-376-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4116-1120-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4116-1121-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4116-1122-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4116-1123-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4116-372-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4116-244-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-209-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-210-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-242-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-240-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-214-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-238-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-373-0x0000000004A30000-0x0000000004A40000-memory.dmp

Filesize
64KB

Download
memory/4116-216-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-234-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-232-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-228-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-230-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-226-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-224-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-222-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-220-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4116-218-0x0000000004990000-0x00000000049CC000-memory.dmp

Filesize
240KB

Download
memory/4460-1185-0x00000000070A0000-0x00000000070B0000-memory.dmp

Filesize
64KB

Download
memory/4764-1150-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4764-1138-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5000-1129-0x0000000007050000-0x0000000007060000-memory.dmp

Filesize
64KB

Download
memory/5000-1128-0x0000000000190000-0x0000000000288000-memory.dmp

Filesize
992KB

Download