redline | ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b

Analysis

max time kernel
121s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2023 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe
Size

1.0MB
MD5

671b210e48c8588715255cd0bc31b34d
SHA1

1386bc6eca4197aca75814925f222c116ea1db09
SHA256

ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b
SHA512

99864562c5d173c017be9bc69455a2e88c482a5e332c0342ecd297c4fa763fd2aebb3aa6b680353edcc0b96428b4c73ad4e187feb6f21e1c797fac410696631b
SSDEEP

12288:zMrvy90u39IBalThxMbtFUuDMAuEWNVe662D4wyQPxbvGvlQAz6KfB7X9r75uf1T:cyFt5lTXZuee662DY0il/9BD7udc41

Score

10^/10

redline liza ronin discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

liza

83.97.73.127:19045

Attributes

auth_value
198e3e9b188d6cfab0a2b0fb100bb7c5

Extracted

Family

redline

Botnet

ronin

83.97.73.127:19045

Attributes

auth_value
4cce855f5ba9b9b6e5b1400f102745de

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	s4838376.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 13 IoCs

pid	Process
3208	z1650784.exe
2824	z5055730.exe
3484	o9665811.exe
3844	p8379765.exe
2820	r2172338.exe
4812	s4838376.exe
1156	s4838376.exe
3288	legends.exe
3712	legends.exe
4116	legends.exe
5016	legends.exe
4640	legends.exe
1448	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
548	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1650784.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1650784.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z5055730.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z5055730.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3484 set thread context of 1460	3484	o9665811.exe	87
PID 2820 set thread context of 1424	2820	r2172338.exe	97
PID 4812 set thread context of 1156	4812	s4838376.exe	99
PID 3288 set thread context of 3712	3288	legends.exe	102
PID 4116 set thread context of 5016	4116	legends.exe	115
PID 4640 set thread context of 1448	4640	legends.exe	118

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1460	AppLaunch.exe
1460	AppLaunch.exe
3844	p8379765.exe
3844	p8379765.exe
1424	AppLaunch.exe
1424	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	AppLaunch.exe
Token: SeDebugPrivilege	3844	p8379765.exe
Token: SeDebugPrivilege	4812	s4838376.exe
Token: SeDebugPrivilege	3288	legends.exe
Token: SeDebugPrivilege	1424	AppLaunch.exe
Token: SeDebugPrivilege	4116	legends.exe
Token: SeDebugPrivilege	4640	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1156	s4838376.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 3208	4232	ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe	83
PID 4232 wrote to memory of 3208	4232	ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe	83
PID 4232 wrote to memory of 3208	4232	ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe	83
PID 3208 wrote to memory of 2824	3208	z1650784.exe	84
PID 3208 wrote to memory of 2824	3208	z1650784.exe	84
PID 3208 wrote to memory of 2824	3208	z1650784.exe	84
PID 2824 wrote to memory of 3484	2824	z5055730.exe	85
PID 2824 wrote to memory of 3484	2824	z5055730.exe	85
PID 2824 wrote to memory of 3484	2824	z5055730.exe	85
PID 3484 wrote to memory of 1460	3484	o9665811.exe	87
PID 3484 wrote to memory of 1460	3484	o9665811.exe	87
PID 3484 wrote to memory of 1460	3484	o9665811.exe	87
PID 3484 wrote to memory of 1460	3484	o9665811.exe	87
PID 3484 wrote to memory of 1460	3484	o9665811.exe	87
PID 2824 wrote to memory of 3844	2824	z5055730.exe	88
PID 2824 wrote to memory of 3844	2824	z5055730.exe	88
PID 2824 wrote to memory of 3844	2824	z5055730.exe	88
PID 3208 wrote to memory of 2820	3208	z1650784.exe	95
PID 3208 wrote to memory of 2820	3208	z1650784.exe	95
PID 3208 wrote to memory of 2820	3208	z1650784.exe	95
PID 2820 wrote to memory of 1424	2820	r2172338.exe	97
PID 2820 wrote to memory of 1424	2820	r2172338.exe	97
PID 2820 wrote to memory of 1424	2820	r2172338.exe	97
PID 2820 wrote to memory of 1424	2820	r2172338.exe	97
PID 2820 wrote to memory of 1424	2820	r2172338.exe	97
PID 4232 wrote to memory of 4812	4232	ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe	98
PID 4232 wrote to memory of 4812	4232	ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe	98
PID 4232 wrote to memory of 4812	4232	ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe	98
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 4812 wrote to memory of 1156	4812	s4838376.exe	99
PID 1156 wrote to memory of 3288	1156	s4838376.exe	101
PID 1156 wrote to memory of 3288	1156	s4838376.exe	101
PID 1156 wrote to memory of 3288	1156	s4838376.exe	101
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3288 wrote to memory of 3712	3288	legends.exe	102
PID 3712 wrote to memory of 1072	3712	legends.exe	103
PID 3712 wrote to memory of 1072	3712	legends.exe	103
PID 3712 wrote to memory of 1072	3712	legends.exe	103
PID 3712 wrote to memory of 4488	3712	legends.exe	105
PID 3712 wrote to memory of 4488	3712	legends.exe	105
PID 3712 wrote to memory of 4488	3712	legends.exe	105
PID 4488 wrote to memory of 1596	4488	cmd.exe	107
PID 4488 wrote to memory of 1596	4488	cmd.exe	107
PID 4488 wrote to memory of 1596	4488	cmd.exe	107
PID 4488 wrote to memory of 4164	4488	cmd.exe	108
PID 4488 wrote to memory of 4164	4488	cmd.exe	108
PID 4488 wrote to memory of 4164	4488	cmd.exe	108
PID 4488 wrote to memory of 3136	4488	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe
"C:\Users\Admin\AppData\Local\Temp\ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1650784.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1650784.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5055730.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5055730.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9665811.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9665811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3484
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8379765.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8379765.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3844
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2172338.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2172338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4838376.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4838376.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4838376.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4838376.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3712
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1072
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:4296
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:548

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4116
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:5016

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4640
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4838376.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4838376.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4838376.exe

Filesize
964KB

MD5
df6421d56b83712dd8ddbb10a5acb69f

SHA1
0d9316ec05add3cb317eebeb505b27e95674e440

SHA256
ba36664defbf72798386af6753aabfd8c738c959fe0240b6d1affe59f2dd64f8

SHA512
daed402e484088e8fd606f26e8c15a4fdfa17772f659bc9c0d1a868dcd1e0a4158e1c4a528d33a6a6a5fb01c92dda5aaf8c37cc17709975e43704d6632297b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1650784.exe

Filesize
581KB

MD5
e74ed803ffc3ad7d7816f2a4dbfc64f9

SHA1
3cef18d7ca824da7d7a44eda8c93335d8f5775c5

SHA256
afe53820f7a1d97cb1832399831690fb4676f0047a112f27313c632a5006f85a

SHA512
311bbdad9df88dcd8152909946f21a9e1b52be6bb6d019037b52f12f51a4b49e9464141685f2d643124d7945c8d2937eadaeb222153689380c8e474764832d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1650784.exe

Filesize
581KB

MD5
e74ed803ffc3ad7d7816f2a4dbfc64f9

SHA1
3cef18d7ca824da7d7a44eda8c93335d8f5775c5

SHA256
afe53820f7a1d97cb1832399831690fb4676f0047a112f27313c632a5006f85a

SHA512
311bbdad9df88dcd8152909946f21a9e1b52be6bb6d019037b52f12f51a4b49e9464141685f2d643124d7945c8d2937eadaeb222153689380c8e474764832d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2172338.exe

Filesize
327KB

MD5
3731c22915f16038ffdbc6ad267d277a

SHA1
42ca373d30baa8c11e0d4f5f23cfdd1e21bcfa01

SHA256
27452d41125887ebc4f2b6f4ec6701fd7db9f1892f4e7d06bca68a5d3965322f

SHA512
2d2bc1698e0954ebd072d1d96d7529ae96cbeaa3ee216aa07d2d68fcc017e03da4074cd5e615785defe8f420e399723ae9601c8fb52b67450d859df7a2449b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2172338.exe

Filesize
327KB

MD5
3731c22915f16038ffdbc6ad267d277a

SHA1
42ca373d30baa8c11e0d4f5f23cfdd1e21bcfa01

SHA256
27452d41125887ebc4f2b6f4ec6701fd7db9f1892f4e7d06bca68a5d3965322f

SHA512
2d2bc1698e0954ebd072d1d96d7529ae96cbeaa3ee216aa07d2d68fcc017e03da4074cd5e615785defe8f420e399723ae9601c8fb52b67450d859df7a2449b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5055730.exe

Filesize
281KB

MD5
8f41d52a95de1abee452ad66e09fafb0

SHA1
05558e41c93d41c9b3738298cab093e2979f2a83

SHA256
56f99e2e537c0ed0904bd7bc82a8af66f8dc4f8202895602afe28ed2e35d2055

SHA512
a301f590f74a745743b1447c4bde4b2c5a3a26d9d282d0201368998388112cf21673e69697cc33cd93e52f5b2d7c41361b3b1b17981053cea895e76ac15ca06f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5055730.exe

Filesize
281KB

MD5
8f41d52a95de1abee452ad66e09fafb0

SHA1
05558e41c93d41c9b3738298cab093e2979f2a83

SHA256
56f99e2e537c0ed0904bd7bc82a8af66f8dc4f8202895602afe28ed2e35d2055

SHA512
a301f590f74a745743b1447c4bde4b2c5a3a26d9d282d0201368998388112cf21673e69697cc33cd93e52f5b2d7c41361b3b1b17981053cea895e76ac15ca06f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9665811.exe

Filesize
169KB

MD5
59abf7484c04801d2c19318bff78bf56

SHA1
b43cf94669a176c71dd7c7be60c7b87ea5e113fb

SHA256
40ae0350a432ca91321a58908930b839944f23c48795841aeab7aa05d6eb4f12

SHA512
0a9af1e0f858210de24af9eddfd05b9496f21b7b8286d51310fcd0724cbd7dfd2a463fcfbeb45da7104ec5fba089759fa479df6c9e2dd145574ac30b4e3b5484

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9665811.exe

Filesize
169KB

MD5
59abf7484c04801d2c19318bff78bf56

SHA1
b43cf94669a176c71dd7c7be60c7b87ea5e113fb

SHA256
40ae0350a432ca91321a58908930b839944f23c48795841aeab7aa05d6eb4f12

SHA512
0a9af1e0f858210de24af9eddfd05b9496f21b7b8286d51310fcd0724cbd7dfd2a463fcfbeb45da7104ec5fba089759fa479df6c9e2dd145574ac30b4e3b5484

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8379765.exe

Filesize
168KB

MD5
05c7e02e491a7d9ec24dc215caccec55

SHA1
cca1483b66f487bf3c030d7ed6f46113ef43962a

SHA256
4ef19864635ccaa60030503a7ac5b2835e0c32bed80413e387536959ed0213d8

SHA512
2a1ef91be388fa913439d5b19d66343eea1ed2856fce4167a2291367de8d795c0d3365ef5e8dac6b75068004a68eeafc9fd501b3acb733db69b98d73ae6a723d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8379765.exe

Filesize
168KB

MD5
05c7e02e491a7d9ec24dc215caccec55

SHA1
cca1483b66f487bf3c030d7ed6f46113ef43962a

SHA256
4ef19864635ccaa60030503a7ac5b2835e0c32bed80413e387536959ed0213d8

SHA512
2a1ef91be388fa913439d5b19d66343eea1ed2856fce4167a2291367de8d795c0d3365ef5e8dac6b75068004a68eeafc9fd501b3acb733db69b98d73ae6a723d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1156-195-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1156-215-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1156-201-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1156-199-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1156-198-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1424-194-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/1424-183-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1448-258-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1448-259-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1448-260-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1460-155-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3288-216-0x0000000007300000-0x0000000007310000-memory.dmp

Filesize
64KB

Download
memory/3712-251-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3712-224-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3712-221-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3712-223-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3712-220-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3844-175-0x000000000C5E0000-0x000000000C7A2000-memory.dmp

Filesize
1.8MB

Download
memory/3844-166-0x000000000AC00000-0x000000000AC12000-memory.dmp

Filesize
72KB

Download
memory/3844-172-0x000000000B8B0000-0x000000000B916000-memory.dmp

Filesize
408KB

Download
memory/3844-170-0x000000000B810000-0x000000000B8A2000-memory.dmp

Filesize
584KB

Download
memory/3844-169-0x000000000B070000-0x000000000B0E6000-memory.dmp

Filesize
472KB

Download
memory/3844-177-0x0000000003340000-0x0000000003350000-memory.dmp

Filesize
64KB

Download
memory/3844-168-0x0000000003340000-0x0000000003350000-memory.dmp

Filesize
64KB

Download
memory/3844-176-0x000000000CCE0000-0x000000000D20C000-memory.dmp

Filesize
5.2MB

Download
memory/3844-163-0x0000000000E90000-0x0000000000EBE000-memory.dmp

Filesize
184KB

Download
memory/3844-164-0x000000000B150000-0x000000000B768000-memory.dmp

Filesize
6.1MB

Download
memory/3844-167-0x000000000AC60000-0x000000000AC9C000-memory.dmp

Filesize
240KB

Download
memory/3844-171-0x000000000BE60000-0x000000000C404000-memory.dmp

Filesize
5.6MB

Download
memory/3844-173-0x000000000BDB0000-0x000000000BE00000-memory.dmp

Filesize
320KB

Download
memory/3844-165-0x000000000ACD0000-0x000000000ADDA000-memory.dmp

Filesize
1.0MB

Download
memory/4116-228-0x00000000076B0000-0x00000000076C0000-memory.dmp

Filesize
64KB

Download
memory/4640-255-0x0000000002530000-0x0000000002540000-memory.dmp

Filesize
64KB

Download
memory/4812-193-0x0000000002560000-0x0000000002570000-memory.dmp

Filesize
64KB

Download
memory/4812-192-0x0000000000170000-0x0000000000268000-memory.dmp

Filesize
992KB

Download
memory/5016-233-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5016-232-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5016-231-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download