redline | 1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b

Analysis

max time kernel
107s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2023, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe
Size

1021KB
MD5

436f4e6e35d6efc7ac4e7f35e9982f9e
SHA1

43acb433deafdf81e8e3b78936b7d814e11e904e
SHA256

1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b
SHA512

8185ea61516f7a9156b1598cf6d372e83a5b74bb77a9a84df896ecee9699faa8a2079f475450f20c7a75eedc2a7e7db355df592e1adb4212645b82280bf3ca4b
SSDEEP

24576:4y5SxGIlE3DdEnqaJwYDy9UUbhh7u/QBgZZKi7BEJRnHs:/VY0D6nqaJiqehh6NZKsOJl

Score

10^/10

redline luza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

luza

185.161.248.37:4138

Attributes

auth_value
1261701914d508e02e8b4f25d38bc7f9

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o7179323.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o7179323.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o7179323.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o7179323.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o7179323.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o7179323.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

resource	yara_rule
behavioral1/memory/3448-211-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-213-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-210-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-215-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-217-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-219-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-221-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-223-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-225-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-227-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-229-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-231-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-233-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-235-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-237-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-239-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-241-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-243-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/3448-245-0x00000000049A0000-0x00000000049DC000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	legends.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	s3672709.exe

Executes dropped EXE 11 IoCs

pid	Process
3260	z4133257.exe
4488	z8932043.exe
1676	o7179323.exe
344	p3366526.exe
3448	r8523793.exe
3748	s3672709.exe
4460	s3672709.exe
1620	legends.exe
3732	legends.exe
2076	legends.exe
4004	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
540	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o7179323.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o7179323.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z4133257.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4133257.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z8932043.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z8932043.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3748 set thread context of 4460	3748	s3672709.exe	89
PID 1620 set thread context of 3732	1620	legends.exe	91
PID 2076 set thread context of 4004	2076	legends.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	4004	WerFault.exe	103

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1676	o7179323.exe
1676	o7179323.exe
344	p3366526.exe
344	p3366526.exe
3448	r8523793.exe
3448	r8523793.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	o7179323.exe
Token: SeDebugPrivilege	344	p3366526.exe
Token: SeDebugPrivilege	3448	r8523793.exe
Token: SeDebugPrivilege	3748	s3672709.exe
Token: SeDebugPrivilege	1620	legends.exe
Token: SeDebugPrivilege	2076	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4460	s3672709.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4004	legends.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 3260	3336	1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe	83
PID 3336 wrote to memory of 3260	3336	1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe	83
PID 3336 wrote to memory of 3260	3336	1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe	83
PID 3260 wrote to memory of 4488	3260	z4133257.exe	84
PID 3260 wrote to memory of 4488	3260	z4133257.exe	84
PID 3260 wrote to memory of 4488	3260	z4133257.exe	84
PID 4488 wrote to memory of 1676	4488	z8932043.exe	85
PID 4488 wrote to memory of 1676	4488	z8932043.exe	85
PID 4488 wrote to memory of 1676	4488	z8932043.exe	85
PID 4488 wrote to memory of 344	4488	z8932043.exe	86
PID 4488 wrote to memory of 344	4488	z8932043.exe	86
PID 4488 wrote to memory of 344	4488	z8932043.exe	86
PID 3260 wrote to memory of 3448	3260	z4133257.exe	87
PID 3260 wrote to memory of 3448	3260	z4133257.exe	87
PID 3260 wrote to memory of 3448	3260	z4133257.exe	87
PID 3336 wrote to memory of 3748	3336	1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe	88
PID 3336 wrote to memory of 3748	3336	1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe	88
PID 3336 wrote to memory of 3748	3336	1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe	88
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 3748 wrote to memory of 4460	3748	s3672709.exe	89
PID 4460 wrote to memory of 1620	4460	s3672709.exe	90
PID 4460 wrote to memory of 1620	4460	s3672709.exe	90
PID 4460 wrote to memory of 1620	4460	s3672709.exe	90
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 1620 wrote to memory of 3732	1620	legends.exe	91
PID 3732 wrote to memory of 4732	3732	legends.exe	92
PID 3732 wrote to memory of 4732	3732	legends.exe	92
PID 3732 wrote to memory of 4732	3732	legends.exe	92
PID 3732 wrote to memory of 4636	3732	legends.exe	94
PID 3732 wrote to memory of 4636	3732	legends.exe	94
PID 3732 wrote to memory of 4636	3732	legends.exe	94
PID 4636 wrote to memory of 5108	4636	cmd.exe	96
PID 4636 wrote to memory of 5108	4636	cmd.exe	96
PID 4636 wrote to memory of 5108	4636	cmd.exe	96
PID 4636 wrote to memory of 780	4636	cmd.exe	97
PID 4636 wrote to memory of 780	4636	cmd.exe	97
PID 4636 wrote to memory of 780	4636	cmd.exe	97
PID 4636 wrote to memory of 2872	4636	cmd.exe	98
PID 4636 wrote to memory of 2872	4636	cmd.exe	98
PID 4636 wrote to memory of 2872	4636	cmd.exe	98
PID 4636 wrote to memory of 4844	4636	cmd.exe	99
PID 4636 wrote to memory of 4844	4636	cmd.exe	99
PID 4636 wrote to memory of 4844	4636	cmd.exe	99
PID 4636 wrote to memory of 2208	4636	cmd.exe	100
PID 4636 wrote to memory of 2208	4636	cmd.exe	100
PID 4636 wrote to memory of 2208	4636	cmd.exe	100
PID 4636 wrote to memory of 4384	4636	cmd.exe	101
PID 4636 wrote to memory of 4384	4636	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe
"C:\Users\Admin\AppData\Local\Temp\1eeb1d08ffed443ed62cbfc92d7ccda4b38c31d1385986947699a2dfdbd3e22b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4133257.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4133257.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8932043.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8932043.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7179323.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7179323.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3366526.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3366526.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:344
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8523793.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8523793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3672709.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3672709.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3672709.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3672709.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3732
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4732
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:780
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:4384
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:540

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2076
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 12
    3⤵
    - Program crash
    PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4004 -ip 4004
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3672709.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3672709.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3672709.exe

Filesize
963KB

MD5
63e1d7d31ff089cfab408d98addab9b6

SHA1
17a0db10fe25fba7b89b3ee40de5125ce64f1883

SHA256
cecc060bad35e6b5ffbb88559517785954edf66f8d6c1ed4564bbe6fc7acd5b9

SHA512
e9cb4e4972e0a09d64f16fb98aeb039e7396dff380e7a1c5eade51ddd890a21cbbe22de7d51e8f8318ecd3a3e30c91dcc2461abbeddd777ef479580b35535b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4133257.exe

Filesize
576KB

MD5
bf93a6a2a834a1b9c737f9a78a2f2e77

SHA1
d85261328f07d266b837e1e4a68993d00c5483c0

SHA256
d79d6781c1944f2d2faa381909cbfd5f6a1046286614ef2db118b4b7b66cac19

SHA512
f09c9e6e756446eb1f9ca3f7e92ef95910154caae075fcdeb398edbd4c5191d53c40d321a780c638b9a7f1114a24cbf1a65188df067c5bff9901cd084ef9be85

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4133257.exe

Filesize
576KB

MD5
bf93a6a2a834a1b9c737f9a78a2f2e77

SHA1
d85261328f07d266b837e1e4a68993d00c5483c0

SHA256
d79d6781c1944f2d2faa381909cbfd5f6a1046286614ef2db118b4b7b66cac19

SHA512
f09c9e6e756446eb1f9ca3f7e92ef95910154caae075fcdeb398edbd4c5191d53c40d321a780c638b9a7f1114a24cbf1a65188df067c5bff9901cd084ef9be85

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8523793.exe

Filesize
285KB

MD5
bcdee5eef5d6ece7310b827b5bdb7f53

SHA1
40673b56e92c1eaa7911b0500b821fd1a8b2a6b8

SHA256
f1cb0fc818fabf3bb72c5a7e96adadb5d38a15a721d45e6d8da02d2080749fdd

SHA512
ec5cab4b26cab035979d57e05c4b11b15075ef4f8a62ab2d1b3c71a697fc3e211b93a8ff2bdf325b0e75b19cc319babfa2a491c9a01b9fed110e1198fc25e981

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8523793.exe

Filesize
285KB

MD5
bcdee5eef5d6ece7310b827b5bdb7f53

SHA1
40673b56e92c1eaa7911b0500b821fd1a8b2a6b8

SHA256
f1cb0fc818fabf3bb72c5a7e96adadb5d38a15a721d45e6d8da02d2080749fdd

SHA512
ec5cab4b26cab035979d57e05c4b11b15075ef4f8a62ab2d1b3c71a697fc3e211b93a8ff2bdf325b0e75b19cc319babfa2a491c9a01b9fed110e1198fc25e981

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8932043.exe

Filesize
305KB

MD5
ee504d393eff985db48e4090f95e868f

SHA1
c9f446d3da961e6702aedef1f97daa8a90791b1a

SHA256
eed941bebd7396717ac3091e133b8e012e3b2ebb5950aac1198c63ea5cd46b69

SHA512
a76e2732c7c9eb247f41366c4dd29657ee7303bb3b79b837ed61b36bc9f7ba290e6e0d0f13b913fb5e7057a8d3d879d5fde117f8da9852f836a4c0078123c84d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8932043.exe

Filesize
305KB

MD5
ee504d393eff985db48e4090f95e868f

SHA1
c9f446d3da961e6702aedef1f97daa8a90791b1a

SHA256
eed941bebd7396717ac3091e133b8e012e3b2ebb5950aac1198c63ea5cd46b69

SHA512
a76e2732c7c9eb247f41366c4dd29657ee7303bb3b79b837ed61b36bc9f7ba290e6e0d0f13b913fb5e7057a8d3d879d5fde117f8da9852f836a4c0078123c84d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7179323.exe

Filesize
185KB

MD5
a9491eacf3f899ab5dcdf3f9cfe2257e

SHA1
59b2e6941e1089cf5c5d0da2c49b9a0db0f167cd

SHA256
c3b8dea5a7df167d527e6fc805655776c63065ca14a152bc756bae8a766e356d

SHA512
14fedef279326e721201a8fbc0e90d812b0ad632d4ecc1f76b0a195c7ca7aa4b12397dfdec1c8e54c9894dbf5db77dcc0f933698547590aae4d3a6295f81e250

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7179323.exe

Filesize
185KB

MD5
a9491eacf3f899ab5dcdf3f9cfe2257e

SHA1
59b2e6941e1089cf5c5d0da2c49b9a0db0f167cd

SHA256
c3b8dea5a7df167d527e6fc805655776c63065ca14a152bc756bae8a766e356d

SHA512
14fedef279326e721201a8fbc0e90d812b0ad632d4ecc1f76b0a195c7ca7aa4b12397dfdec1c8e54c9894dbf5db77dcc0f933698547590aae4d3a6295f81e250

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3366526.exe

Filesize
145KB

MD5
5d8673ed932c057a78214424c3e75645

SHA1
c3e429bec52b001ae83bf47eb304d1fba7d22006

SHA256
0aeb1cc638e81139d49dcbf7627a81a3264159dba4c68dee3a81abd29bfea0a1

SHA512
b80c5df7a674dee447f495d1d71095cc39041cd0f7925b0a64b2eaee546a56bbc105c888aeb65d91562d432e0a0c4a244900bf1f3babf151ed7de812923906eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3366526.exe

Filesize
145KB

MD5
5d8673ed932c057a78214424c3e75645

SHA1
c3e429bec52b001ae83bf47eb304d1fba7d22006

SHA256
0aeb1cc638e81139d49dcbf7627a81a3264159dba4c68dee3a81abd29bfea0a1

SHA512
b80c5df7a674dee447f495d1d71095cc39041cd0f7925b0a64b2eaee546a56bbc105c888aeb65d91562d432e0a0c4a244900bf1f3babf151ed7de812923906eb

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/344-198-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/344-199-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/344-193-0x0000000000A80000-0x0000000000AAA000-memory.dmp

Filesize
168KB

Download
memory/344-194-0x00000000059F0000-0x0000000006008000-memory.dmp

Filesize
6.1MB

Download
memory/344-196-0x0000000005450000-0x0000000005462000-memory.dmp

Filesize
72KB

Download
memory/344-197-0x00000000054D0000-0x000000000550C000-memory.dmp

Filesize
240KB

Download
memory/344-195-0x0000000005520000-0x000000000562A000-memory.dmp

Filesize
1.0MB

Download
memory/344-205-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/344-200-0x00000000063B0000-0x0000000006442000-memory.dmp

Filesize
584KB

Download
memory/344-201-0x0000000006720000-0x00000000068E2000-memory.dmp

Filesize
1.8MB

Download
memory/344-202-0x00000000074E0000-0x0000000007A0C000-memory.dmp

Filesize
5.2MB

Download
memory/344-203-0x00000000065F0000-0x0000000006666000-memory.dmp

Filesize
472KB

Download
memory/344-204-0x0000000006670000-0x00000000066C0000-memory.dmp

Filesize
320KB

Download
memory/1620-1152-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/1676-187-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/1676-161-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-183-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-185-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-186-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/1676-177-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-188-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/1676-169-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-167-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-165-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-163-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-171-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-159-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-179-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-158-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-157-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/1676-156-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/1676-173-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-155-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/1676-154-0x0000000004A50000-0x0000000004FF4000-memory.dmp

Filesize
5.6MB

Download
memory/1676-175-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/1676-181-0x0000000004970000-0x0000000004986000-memory.dmp

Filesize
88KB

Download
memory/2076-1165-0x0000000007900000-0x0000000007910000-memory.dmp

Filesize
64KB

Download
memory/3448-213-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-210-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-245-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-325-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/3448-329-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/3448-326-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/3448-1121-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/3448-1122-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/3448-1123-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/3448-1124-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/3448-241-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-239-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-211-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-221-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-237-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-215-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-235-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-233-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-231-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-217-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-229-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-227-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-243-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-219-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-225-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3448-223-0x00000000049A0000-0x00000000049DC000-memory.dmp

Filesize
240KB

Download
memory/3732-1159-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3732-1162-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3748-1130-0x0000000007520000-0x0000000007530000-memory.dmp

Filesize
64KB

Download
memory/3748-1129-0x00000000006D0000-0x00000000007C8000-memory.dmp

Filesize
992KB

Download
memory/4460-1151-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-1137-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download