redline | aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2023 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe
Size

1.0MB
MD5

59d31755e9d0db71f00c5a7455dc2156
SHA1

e6caff8a00c59350cf1dc2f1a7b4444f3b2d50ed
SHA256

aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51
SHA512

d5c99322dd1cb127a27db782c9d9bfe73a8cc387689c8cf86fa46e54b10ba8c3863a9d3e4a89ab63a4a1ef97acf04dc829072acf089f4ffbf188b60769ddb5ed
SSDEEP

24576:ZyA4Cjp7ys/nVXyuwZyrFk3qSu+X0j0QRM5A+fy21Z:MaXVXlH0N5EjjMG+

Score

10^/10

redline lusa munder discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lusa

83.97.73.127:19062

Attributes

auth_value
c9df946711e01c378b42221de692acbd

Extracted

Family

redline

Botnet

munder

83.97.73.127:19062

Attributes

auth_value
159bf350f6393f0d879c80a22059fba2

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	s2082388.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 17 IoCs

pid	Process
2344	z3051169.exe
4236	z1454553.exe
2600	o7085036.exe
4224	p9184553.exe
1184	r8676603.exe
400	s2082388.exe
3456	s2082388.exe
1420	legends.exe
2212	legends.exe
3748	legends.exe
1656	legends.exe
5052	legends.exe
4128	legends.exe
3192	legends.exe
3620	legends.exe
3420	legends.exe
2184	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
2172	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z3051169.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z3051169.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1454553.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z1454553.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2600 set thread context of 4388	2600	o7085036.exe	88
PID 1184 set thread context of 4360	1184	r8676603.exe	92
PID 400 set thread context of 3456	400	s2082388.exe	94
PID 1420 set thread context of 4128	1420	legends.exe	101
PID 3192 set thread context of 3620	3192	legends.exe	113
PID 3420 set thread context of 2184	3420	legends.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4388	AppLaunch.exe
4388	AppLaunch.exe
4224	p9184553.exe
4224	p9184553.exe
4360	AppLaunch.exe
4360	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	AppLaunch.exe
Token: SeDebugPrivilege	4224	p9184553.exe
Token: SeDebugPrivilege	400	s2082388.exe
Token: SeDebugPrivilege	1420	legends.exe
Token: SeDebugPrivilege	4360	AppLaunch.exe
Token: SeDebugPrivilege	3192	legends.exe
Token: SeDebugPrivilege	3420	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3456	s2082388.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2344	388	aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe	84
PID 388 wrote to memory of 2344	388	aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe	84
PID 388 wrote to memory of 2344	388	aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe	84
PID 2344 wrote to memory of 4236	2344	z3051169.exe	85
PID 2344 wrote to memory of 4236	2344	z3051169.exe	85
PID 2344 wrote to memory of 4236	2344	z3051169.exe	85
PID 4236 wrote to memory of 2600	4236	z1454553.exe	86
PID 4236 wrote to memory of 2600	4236	z1454553.exe	86
PID 4236 wrote to memory of 2600	4236	z1454553.exe	86
PID 2600 wrote to memory of 4388	2600	o7085036.exe	88
PID 2600 wrote to memory of 4388	2600	o7085036.exe	88
PID 2600 wrote to memory of 4388	2600	o7085036.exe	88
PID 2600 wrote to memory of 4388	2600	o7085036.exe	88
PID 2600 wrote to memory of 4388	2600	o7085036.exe	88
PID 4236 wrote to memory of 4224	4236	z1454553.exe	89
PID 4236 wrote to memory of 4224	4236	z1454553.exe	89
PID 4236 wrote to memory of 4224	4236	z1454553.exe	89
PID 2344 wrote to memory of 1184	2344	z3051169.exe	90
PID 2344 wrote to memory of 1184	2344	z3051169.exe	90
PID 2344 wrote to memory of 1184	2344	z3051169.exe	90
PID 1184 wrote to memory of 4360	1184	r8676603.exe	92
PID 1184 wrote to memory of 4360	1184	r8676603.exe	92
PID 1184 wrote to memory of 4360	1184	r8676603.exe	92
PID 1184 wrote to memory of 4360	1184	r8676603.exe	92
PID 1184 wrote to memory of 4360	1184	r8676603.exe	92
PID 388 wrote to memory of 400	388	aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe	93
PID 388 wrote to memory of 400	388	aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe	93
PID 388 wrote to memory of 400	388	aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe	93
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 400 wrote to memory of 3456	400	s2082388.exe	94
PID 3456 wrote to memory of 1420	3456	s2082388.exe	95
PID 3456 wrote to memory of 1420	3456	s2082388.exe	95
PID 3456 wrote to memory of 1420	3456	s2082388.exe	95
PID 1420 wrote to memory of 2212	1420	legends.exe	96
PID 1420 wrote to memory of 2212	1420	legends.exe	96
PID 1420 wrote to memory of 2212	1420	legends.exe	96
PID 1420 wrote to memory of 2212	1420	legends.exe	96
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 3748	1420	legends.exe	97
PID 1420 wrote to memory of 1656	1420	legends.exe	98
PID 1420 wrote to memory of 1656	1420	legends.exe	98
PID 1420 wrote to memory of 1656	1420	legends.exe	98
PID 1420 wrote to memory of 1656	1420	legends.exe	98
PID 1420 wrote to memory of 5052	1420	legends.exe	100
PID 1420 wrote to memory of 5052	1420	legends.exe	100
PID 1420 wrote to memory of 5052	1420	legends.exe	100
PID 1420 wrote to memory of 5052	1420	legends.exe	100
PID 1420 wrote to memory of 4128	1420	legends.exe	101
PID 1420 wrote to memory of 4128	1420	legends.exe	101

C:\Users\Admin\AppData\Local\Temp\aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe
"C:\Users\Admin\AppData\Local\Temp\aaa4b3f791df3ef26006de4454e1b4b452b86a3e7893185c06a0e7166ff05a51.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3051169.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3051169.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1454553.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1454553.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7085036.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7085036.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9184553.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9184553.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8676603.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8676603.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4360
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2082388.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2082388.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2082388.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2082388.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Executes dropped EXE
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4128
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3648
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:3020
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:2172

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3192
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:3620

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3420
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2082388.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2082388.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2082388.exe

Filesize
963KB

MD5
adbc2e422004339b41752734499e3e96

SHA1
200a0d0d617a002cff0d300310378074c4eee503

SHA256
bc9dfb335a205e94c0de56b50bd6ef6f165443faa57173d0807c5c9f1da51f72

SHA512
98debecbc3ea8aacc426cbe66a2c70505ed6bf6a56f10f90c6119e6c90e25089cbe40ea0d23fce8e827a0e1493f77198d1b6939871d89c7fc95c2f51bb624525

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3051169.exe

Filesize
599KB

MD5
f27b3bfaeb4a10d431b2356cfd18ba1c

SHA1
334565e3d57417017960eb960aec728f989311ef

SHA256
4597f2fa3bc0a0f964e7ec4ed8739d5b09450b3a0c5bf6866e7aed0627a09c9f

SHA512
7b67c18efd32d7d792108470748ed8548daa7ad4282963eb82c2bea5ee85f288b927134f593d2b68e0453d3267302b81bb11176540da8e05b792caff2d3fdf6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3051169.exe

Filesize
599KB

MD5
f27b3bfaeb4a10d431b2356cfd18ba1c

SHA1
334565e3d57417017960eb960aec728f989311ef

SHA256
4597f2fa3bc0a0f964e7ec4ed8739d5b09450b3a0c5bf6866e7aed0627a09c9f

SHA512
7b67c18efd32d7d792108470748ed8548daa7ad4282963eb82c2bea5ee85f288b927134f593d2b68e0453d3267302b81bb11176540da8e05b792caff2d3fdf6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8676603.exe

Filesize
315KB

MD5
2f7a50905b4238d4a5424fce76c9ff6c

SHA1
3d0e6e18635400b617a37ef886f5ae20443da0cf

SHA256
df1f4c601cf17fb2c6bb8eedb0aabcb24346090885d20039e7a30803142e3846

SHA512
f23c4805d90469b8a548ea892ee6e78444ed1c9d1e83a88907b6051deb1724c9f5dc35575ea8c9914228ab34c2b0bf2616202f618543ac356c593ee9b6777cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8676603.exe

Filesize
315KB

MD5
2f7a50905b4238d4a5424fce76c9ff6c

SHA1
3d0e6e18635400b617a37ef886f5ae20443da0cf

SHA256
df1f4c601cf17fb2c6bb8eedb0aabcb24346090885d20039e7a30803142e3846

SHA512
f23c4805d90469b8a548ea892ee6e78444ed1c9d1e83a88907b6051deb1724c9f5dc35575ea8c9914228ab34c2b0bf2616202f618543ac356c593ee9b6777cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1454553.exe

Filesize
278KB

MD5
0a164c4bc24f6f3c4ba4e1760201b39f

SHA1
723123d9a5f96deb33162f5208e68790cd83b719

SHA256
95ce3433ae7f6aeb8c0d49495285cf5880ee57a7c9b9f20cd3f697b137668957

SHA512
efd0bde6d61465c24f39da64b5a6efde508dadd41f44e078d79860a98c03844e516db38ab428a64bac61055a0ad24c4bfd698569bcd03fec98978091367563f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1454553.exe

Filesize
278KB

MD5
0a164c4bc24f6f3c4ba4e1760201b39f

SHA1
723123d9a5f96deb33162f5208e68790cd83b719

SHA256
95ce3433ae7f6aeb8c0d49495285cf5880ee57a7c9b9f20cd3f697b137668957

SHA512
efd0bde6d61465c24f39da64b5a6efde508dadd41f44e078d79860a98c03844e516db38ab428a64bac61055a0ad24c4bfd698569bcd03fec98978091367563f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7085036.exe

Filesize
180KB

MD5
f1a0bb1b5f471fa7048357d84924e952

SHA1
a6312eb0c1de11df5e308231af2b59c287e48545

SHA256
739dd26cfa73f714eae29bf16b1c913eac19a603f0c26e8490ccaac6a464020e

SHA512
fa980a23d09bc317d57cf80f79d7374856dd907b607be7f796c168c5b3f85c687fa5ee89001853439d0740bb372bd68e9d96acdf4a30eca84b1ff57dc5155572

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o7085036.exe

Filesize
180KB

MD5
f1a0bb1b5f471fa7048357d84924e952

SHA1
a6312eb0c1de11df5e308231af2b59c287e48545

SHA256
739dd26cfa73f714eae29bf16b1c913eac19a603f0c26e8490ccaac6a464020e

SHA512
fa980a23d09bc317d57cf80f79d7374856dd907b607be7f796c168c5b3f85c687fa5ee89001853439d0740bb372bd68e9d96acdf4a30eca84b1ff57dc5155572

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9184553.exe

Filesize
145KB

MD5
05603595f5c9eb60c07c649cff425ab2

SHA1
974567c3a084c6c282a02fd1e2b2d9b93a85ff62

SHA256
e5a11c82c884ccf0237874bc5cc12c2e2d400fd78c247c239379757777603464

SHA512
d01db44e736a114a427767c0e362f2b7e7114d7f894618fb6ed35191cfab63eba5403f86f1727de0746a5022eda06f07852b1d229cf82eb3c18f7ba62b2f6058

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9184553.exe

Filesize
145KB

MD5
05603595f5c9eb60c07c649cff425ab2

SHA1
974567c3a084c6c282a02fd1e2b2d9b93a85ff62

SHA256
e5a11c82c884ccf0237874bc5cc12c2e2d400fd78c247c239379757777603464

SHA512
d01db44e736a114a427767c0e362f2b7e7114d7f894618fb6ed35191cfab63eba5403f86f1727de0746a5022eda06f07852b1d229cf82eb3c18f7ba62b2f6058

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/400-194-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Filesize
64KB

Download
memory/400-192-0x0000000000F40000-0x0000000001038000-memory.dmp

Filesize
992KB

Download
memory/1420-216-0x0000000007B70000-0x0000000007B80000-memory.dmp

Filesize
64KB

Download
memory/1420-220-0x0000000007B70000-0x0000000007B80000-memory.dmp

Filesize
64KB

Download
memory/2184-265-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2184-264-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2184-263-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3192-233-0x0000000006FE0000-0x0000000006FF0000-memory.dmp

Filesize
64KB

Download
memory/3420-260-0x0000000007900000-0x0000000007910000-memory.dmp

Filesize
64KB

Download
memory/3456-215-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3456-201-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3456-199-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3456-198-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3456-195-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3620-236-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3620-237-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3620-238-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4128-228-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4128-226-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4128-225-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4128-229-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4128-256-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4224-171-0x0000000004EC0000-0x0000000004F26000-memory.dmp

Filesize
408KB

Download
memory/4224-169-0x0000000005B30000-0x00000000060D4000-memory.dmp

Filesize
5.6MB

Download
memory/4224-175-0x00000000069B0000-0x0000000006EDC000-memory.dmp

Filesize
5.2MB

Download
memory/4224-174-0x00000000062B0000-0x0000000006472000-memory.dmp

Filesize
1.8MB

Download
memory/4224-173-0x0000000005AD0000-0x0000000005B20000-memory.dmp

Filesize
320KB

Download
memory/4224-172-0x0000000005A50000-0x0000000005AC6000-memory.dmp

Filesize
472KB

Download
memory/4224-163-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/4224-170-0x0000000005580000-0x0000000005612000-memory.dmp

Filesize
584KB

Download
memory/4224-164-0x0000000004F60000-0x0000000005578000-memory.dmp

Filesize
6.1MB

Download
memory/4224-177-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/4224-168-0x0000000004A70000-0x0000000004AAC000-memory.dmp

Filesize
240KB

Download
memory/4224-167-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/4224-166-0x0000000004A10000-0x0000000004A22000-memory.dmp

Filesize
72KB

Download
memory/4224-165-0x0000000004AE0000-0x0000000004BEA000-memory.dmp

Filesize
1.0MB

Download
memory/4360-193-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/4360-183-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4388-155-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download