redline | 334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2023, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe
Size

1.0MB
MD5

45aa981ff3f2a60960ef065277046055
SHA1

cdd052cd41db373c495efde646922259c5e34ee0
SHA256

334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8
SHA512

8cf6a0c820d7da7c87f00f2683fb95ce63e4c1825f3d75a8e05efcbc18e97cfe888012ea4863599c7e922a23fbdb69694cf98e07d3fa12a226508977f4bae74e
SSDEEP

24576:eyzTytTOt1DPhkJ9jiDKgkfVM6cfEaFK9xCpohdSXoBfh3:tzTytTOtB89jcKHVM6cffFKTCpovS4B5

Score

10^/10

redline greg lina discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lina

83.97.73.122:19062

Attributes

auth_value
13523aee5d194d7716b22eeab7de10ad

Extracted

Family

redline

Botnet

greg

83.97.73.122:19062

Attributes

auth_value
4c966a90781c6b4ab7f512d018696362

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legends.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	s9855266.exe

Executes dropped EXE 15 IoCs

pid	Process
784	z1105825.exe
1000	z9276372.exe
652	o5306422.exe
232	p3783881.exe
2596	r3016149.exe
5092	s9855266.exe
560	s9855266.exe
1344	legends.exe
1792	legends.exe
2260	legends.exe
3656	legends.exe
4700	legends.exe
212	legends.exe
1976	legends.exe
1644	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
3324	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1105825.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z9276372.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9276372.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1105825.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 652 set thread context of 268	652	o5306422.exe	89
PID 2596 set thread context of 2424	2596	r3016149.exe	99
PID 5092 set thread context of 560	5092	s9855266.exe	101
PID 1344 set thread context of 2260	1344	legends.exe	105
PID 3656 set thread context of 212	3656	legends.exe	119
PID 1976 set thread context of 1644	1976	legends.exe	122

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
268	AppLaunch.exe
268	AppLaunch.exe
232	p3783881.exe
232	p3783881.exe
2424	AppLaunch.exe
2424	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	268	AppLaunch.exe
Token: SeDebugPrivilege	232	p3783881.exe
Token: SeDebugPrivilege	5092	s9855266.exe
Token: SeDebugPrivilege	1344	legends.exe
Token: SeDebugPrivilege	2424	AppLaunch.exe
Token: SeDebugPrivilege	3656	legends.exe
Token: SeDebugPrivilege	1976	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
560	s9855266.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 784	4668	334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe	85
PID 4668 wrote to memory of 784	4668	334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe	85
PID 4668 wrote to memory of 784	4668	334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe	85
PID 784 wrote to memory of 1000	784	z1105825.exe	86
PID 784 wrote to memory of 1000	784	z1105825.exe	86
PID 784 wrote to memory of 1000	784	z1105825.exe	86
PID 1000 wrote to memory of 652	1000	z9276372.exe	87
PID 1000 wrote to memory of 652	1000	z9276372.exe	87
PID 1000 wrote to memory of 652	1000	z9276372.exe	87
PID 652 wrote to memory of 268	652	o5306422.exe	89
PID 652 wrote to memory of 268	652	o5306422.exe	89
PID 652 wrote to memory of 268	652	o5306422.exe	89
PID 652 wrote to memory of 268	652	o5306422.exe	89
PID 652 wrote to memory of 268	652	o5306422.exe	89
PID 1000 wrote to memory of 232	1000	z9276372.exe	90
PID 1000 wrote to memory of 232	1000	z9276372.exe	90
PID 1000 wrote to memory of 232	1000	z9276372.exe	90
PID 784 wrote to memory of 2596	784	z1105825.exe	97
PID 784 wrote to memory of 2596	784	z1105825.exe	97
PID 784 wrote to memory of 2596	784	z1105825.exe	97
PID 2596 wrote to memory of 2424	2596	r3016149.exe	99
PID 2596 wrote to memory of 2424	2596	r3016149.exe	99
PID 2596 wrote to memory of 2424	2596	r3016149.exe	99
PID 2596 wrote to memory of 2424	2596	r3016149.exe	99
PID 2596 wrote to memory of 2424	2596	r3016149.exe	99
PID 4668 wrote to memory of 5092	4668	334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe	100
PID 4668 wrote to memory of 5092	4668	334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe	100
PID 4668 wrote to memory of 5092	4668	334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe	100
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 5092 wrote to memory of 560	5092	s9855266.exe	101
PID 560 wrote to memory of 1344	560	s9855266.exe	103
PID 560 wrote to memory of 1344	560	s9855266.exe	103
PID 560 wrote to memory of 1344	560	s9855266.exe	103
PID 1344 wrote to memory of 1792	1344	legends.exe	104
PID 1344 wrote to memory of 1792	1344	legends.exe	104
PID 1344 wrote to memory of 1792	1344	legends.exe	104
PID 1344 wrote to memory of 1792	1344	legends.exe	104
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 1344 wrote to memory of 2260	1344	legends.exe	105
PID 2260 wrote to memory of 3152	2260	legends.exe	106
PID 2260 wrote to memory of 3152	2260	legends.exe	106
PID 2260 wrote to memory of 3152	2260	legends.exe	106
PID 2260 wrote to memory of 2732	2260	legends.exe	108
PID 2260 wrote to memory of 2732	2260	legends.exe	108
PID 2260 wrote to memory of 2732	2260	legends.exe	108
PID 2732 wrote to memory of 3612	2732	cmd.exe	110
PID 2732 wrote to memory of 3612	2732	cmd.exe	110
PID 2732 wrote to memory of 3612	2732	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe
"C:\Users\Admin\AppData\Local\Temp\334d49a6376c7ecf8c92e40143357995ac74a9eef2dcf189d13d951a284bc9a8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1105825.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1105825.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9276372.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9276372.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5306422.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5306422.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:652
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:268
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3783881.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3783881.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:232
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3016149.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3016149.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2424
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9855266.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9855266.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9855266.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9855266.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2260
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3152
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:4028
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:3324

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3656
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:212

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1976
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9855266.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9855266.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9855266.exe

Filesize
962KB

MD5
f11352528db3cf0392de21b5d39a8f25

SHA1
651b7142c317f1c6f21e09b71bf72e8907dd7ea6

SHA256
92c4969093ce3282f9cbd6858baee4a386a79c10fe97a985008b5b69a3573fe1

SHA512
a60f319e46a184427e7f4040f0fa506486314238fd9033feabc6aa90009c84cade3c4ee848e7a63a28265896e9ce88e1871faad4ad3d14b08d0ead82b4afa29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1105825.exe

Filesize
592KB

MD5
3112365f71ed8f96fad16eb8009539d8

SHA1
ae2235332141de81ccffba1312cf3d5f95088d66

SHA256
c7b107263da14893685ad5897c28f690f87ac5a66972bcf20d9135414f8f69a3

SHA512
521ba08cffc260f37156e3f64efb45d8d5f29bfd5ff3c72a411cd9b0c5a2e63bd84d66c9d8d7c6caf9a469e8a18a2eead1d42c4820f825b91015ffef6e24f90c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1105825.exe

Filesize
592KB

MD5
3112365f71ed8f96fad16eb8009539d8

SHA1
ae2235332141de81ccffba1312cf3d5f95088d66

SHA256
c7b107263da14893685ad5897c28f690f87ac5a66972bcf20d9135414f8f69a3

SHA512
521ba08cffc260f37156e3f64efb45d8d5f29bfd5ff3c72a411cd9b0c5a2e63bd84d66c9d8d7c6caf9a469e8a18a2eead1d42c4820f825b91015ffef6e24f90c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3016149.exe

Filesize
315KB

MD5
5ccd2d6ffa2e9c3ee1b2243915394625

SHA1
f324d501f190a0bb85d058c965d8bff8cf6438e7

SHA256
0372ea107d4be9d18d4c367655278b1f3a5a4a72f6554ec6d12417a7bfba3bb7

SHA512
288d2d0a39f86b6db0f16ccb3b5cb119514b8dc4387041932aaeb1f6f7fe780e13263c5b19c2b074ab05b4fd9073c3456a9c73b734ffe185fcf29d0eba878eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3016149.exe

Filesize
315KB

MD5
5ccd2d6ffa2e9c3ee1b2243915394625

SHA1
f324d501f190a0bb85d058c965d8bff8cf6438e7

SHA256
0372ea107d4be9d18d4c367655278b1f3a5a4a72f6554ec6d12417a7bfba3bb7

SHA512
288d2d0a39f86b6db0f16ccb3b5cb119514b8dc4387041932aaeb1f6f7fe780e13263c5b19c2b074ab05b4fd9073c3456a9c73b734ffe185fcf29d0eba878eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9276372.exe

Filesize
275KB

MD5
d7b7bedb1824d35c2a0ee93cd9d25031

SHA1
0379b9778970e30af539bb3dc00a9b7addb29455

SHA256
4f20be6f5001ff60b0a2f5c7d8c4519235b586d1a287a6c5b12b08933d4250a9

SHA512
f33efc4a861203828dca709ab16e274622eda12267a07ea011ec8cf402354ae87aadc07551e6cd83ed38ea7172f4bd3f71e9af5216a4b71892e5fa7ad4f68f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9276372.exe

Filesize
275KB

MD5
d7b7bedb1824d35c2a0ee93cd9d25031

SHA1
0379b9778970e30af539bb3dc00a9b7addb29455

SHA256
4f20be6f5001ff60b0a2f5c7d8c4519235b586d1a287a6c5b12b08933d4250a9

SHA512
f33efc4a861203828dca709ab16e274622eda12267a07ea011ec8cf402354ae87aadc07551e6cd83ed38ea7172f4bd3f71e9af5216a4b71892e5fa7ad4f68f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5306422.exe

Filesize
181KB

MD5
ece3a3f933b06f4d726830234434e122

SHA1
e084ebb2c6e369160157b44553c16ee892b5a667

SHA256
e28a4c0924790feb8ecd5f2154b13073df7535def6b76aad8705a5ce1962b4a7

SHA512
613b61921e36ea8d515d07874e7fb621646ae470d963e59387b71ce725fb4c4dedd36c72666e38611a6547004caf6909d7f9dc99cf59340dc3aa3afd62749505

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5306422.exe

Filesize
181KB

MD5
ece3a3f933b06f4d726830234434e122

SHA1
e084ebb2c6e369160157b44553c16ee892b5a667

SHA256
e28a4c0924790feb8ecd5f2154b13073df7535def6b76aad8705a5ce1962b4a7

SHA512
613b61921e36ea8d515d07874e7fb621646ae470d963e59387b71ce725fb4c4dedd36c72666e38611a6547004caf6909d7f9dc99cf59340dc3aa3afd62749505

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3783881.exe

Filesize
145KB

MD5
f5dfa7cddaa01bf46de21060cdfd2b05

SHA1
89c8c8e0346155610a05e9d7702fee254255821c

SHA256
a2d51320e5abbb129b19ed8e98273b1b3d348f4be01cc6074fc184606761f9a7

SHA512
0f284b941cd8cc6e6e026d26eac5ff6f2efd211aee676b1e4cd4834291a6623ef53dc63ca4370a3953656fd01c0c46af2663540c312bcecbdb9ab16b6c2d1256

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3783881.exe

Filesize
145KB

MD5
f5dfa7cddaa01bf46de21060cdfd2b05

SHA1
89c8c8e0346155610a05e9d7702fee254255821c

SHA256
a2d51320e5abbb129b19ed8e98273b1b3d348f4be01cc6074fc184606761f9a7

SHA512
0f284b941cd8cc6e6e026d26eac5ff6f2efd211aee676b1e4cd4834291a6623ef53dc63ca4370a3953656fd01c0c46af2663540c312bcecbdb9ab16b6c2d1256

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/212-233-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/212-235-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/212-234-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/232-170-0x0000000006430000-0x00000000069D4000-memory.dmp

Filesize
5.6MB

Download
memory/232-166-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/232-163-0x0000000000630000-0x000000000065A000-memory.dmp

Filesize
168KB

Download
memory/232-164-0x0000000005550000-0x0000000005B68000-memory.dmp

Filesize
6.1MB

Download
memory/232-165-0x00000000050D0000-0x00000000051DA000-memory.dmp

Filesize
1.0MB

Download
memory/232-167-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download
memory/232-168-0x0000000005060000-0x000000000509C000-memory.dmp

Filesize
240KB

Download
memory/232-169-0x0000000005370000-0x00000000053D6000-memory.dmp

Filesize
408KB

Download
memory/232-171-0x0000000005F60000-0x0000000005FF2000-memory.dmp

Filesize
584KB

Download
memory/232-172-0x00000000069E0000-0x0000000006BA2000-memory.dmp

Filesize
1.8MB

Download
memory/232-173-0x00000000070E0000-0x000000000760C000-memory.dmp

Filesize
5.2MB

Download
memory/232-177-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download
memory/232-174-0x00000000061C0000-0x0000000006236000-memory.dmp

Filesize
472KB

Download
memory/232-175-0x0000000006240000-0x0000000006290000-memory.dmp

Filesize
320KB

Download
memory/268-155-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/560-215-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/560-199-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/560-201-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/560-195-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/560-198-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1344-216-0x0000000007BD0000-0x0000000007BE0000-memory.dmp

Filesize
64KB

Download
memory/1644-259-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1644-260-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1644-261-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2260-224-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2260-221-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2260-253-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2260-222-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2260-225-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2424-183-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2424-193-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3656-229-0x0000000006DC0000-0x0000000006DD0000-memory.dmp

Filesize
64KB

Download
memory/5092-194-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/5092-192-0x0000000000410000-0x0000000000508000-memory.dmp

Filesize
992KB

Download