redline | 185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0

Analysis

max time kernel
128s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2023 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe
Size

1.0MB
MD5

46fe17ef3dca9c4fa7c87e2d4259c116
SHA1

7c8664921223d39fe4b748586e9a37a52a9254d9
SHA256

185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0
SHA512

1afb3b8d6c519c08267596bff2a15d8e69b1e51cc6f0b851ff4163da5f5576ab0eead785dd9d6a1bd14acf2e761d74b7367d8c55390f50e79dfbfc08c7f2e3a5
SSDEEP

24576:vy52mL0M5O8oSkZgMxKjh2lAmPcJQnZcx6OiXiZ:6Ym4M1oIMsjhYkmZcx6ny

Score

10^/10

redline grom lars discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lars

83.97.73.127:19045

Attributes

auth_value
8b06149cdaa5b5a4c6c7b3663f19e609

Extracted

Family

redline

Botnet

grom

83.97.73.127:19045

Attributes

auth_value
2193aac8692a5e1ec66d9db9fa25ee00

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	s6642088.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 13 IoCs

pid	Process
4212	z8627894.exe
4240	z2087177.exe
2812	o0929780.exe
2288	p8365005.exe
772	r7819075.exe
848	s6642088.exe
1732	s6642088.exe
5116	legends.exe
4588	legends.exe
1376	legends.exe
4188	legends.exe
2344	legends.exe
1844	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
1704	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2087177.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z8627894.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z8627894.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z2087177.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 1008	2812	o0929780.exe	94
PID 772 set thread context of 4732	772	r7819075.exe	104
PID 848 set thread context of 1732	848	s6642088.exe	106
PID 5116 set thread context of 4588	5116	legends.exe	109
PID 1376 set thread context of 4188	1376	legends.exe	122
PID 2344 set thread context of 1844	2344	legends.exe	127

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1008	AppLaunch.exe
1008	AppLaunch.exe
2288	p8365005.exe
2288	p8365005.exe
4732	AppLaunch.exe
4732	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	AppLaunch.exe
Token: SeDebugPrivilege	2288	p8365005.exe
Token: SeDebugPrivilege	848	s6642088.exe
Token: SeDebugPrivilege	5116	legends.exe
Token: SeDebugPrivilege	4732	AppLaunch.exe
Token: SeDebugPrivilege	1376	legends.exe
Token: SeDebugPrivilege	2344	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	s6642088.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 4212	2256	185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe	90
PID 2256 wrote to memory of 4212	2256	185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe	90
PID 2256 wrote to memory of 4212	2256	185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe	90
PID 4212 wrote to memory of 4240	4212	z8627894.exe	91
PID 4212 wrote to memory of 4240	4212	z8627894.exe	91
PID 4212 wrote to memory of 4240	4212	z8627894.exe	91
PID 4240 wrote to memory of 2812	4240	z2087177.exe	92
PID 4240 wrote to memory of 2812	4240	z2087177.exe	92
PID 4240 wrote to memory of 2812	4240	z2087177.exe	92
PID 2812 wrote to memory of 1008	2812	o0929780.exe	94
PID 2812 wrote to memory of 1008	2812	o0929780.exe	94
PID 2812 wrote to memory of 1008	2812	o0929780.exe	94
PID 2812 wrote to memory of 1008	2812	o0929780.exe	94
PID 2812 wrote to memory of 1008	2812	o0929780.exe	94
PID 4240 wrote to memory of 2288	4240	z2087177.exe	95
PID 4240 wrote to memory of 2288	4240	z2087177.exe	95
PID 4240 wrote to memory of 2288	4240	z2087177.exe	95
PID 4212 wrote to memory of 772	4212	z8627894.exe	102
PID 4212 wrote to memory of 772	4212	z8627894.exe	102
PID 4212 wrote to memory of 772	4212	z8627894.exe	102
PID 772 wrote to memory of 4732	772	r7819075.exe	104
PID 772 wrote to memory of 4732	772	r7819075.exe	104
PID 772 wrote to memory of 4732	772	r7819075.exe	104
PID 772 wrote to memory of 4732	772	r7819075.exe	104
PID 772 wrote to memory of 4732	772	r7819075.exe	104
PID 2256 wrote to memory of 848	2256	185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe	105
PID 2256 wrote to memory of 848	2256	185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe	105
PID 2256 wrote to memory of 848	2256	185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe	105
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 848 wrote to memory of 1732	848	s6642088.exe	106
PID 1732 wrote to memory of 5116	1732	s6642088.exe	108
PID 1732 wrote to memory of 5116	1732	s6642088.exe	108
PID 1732 wrote to memory of 5116	1732	s6642088.exe	108
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 5116 wrote to memory of 4588	5116	legends.exe	109
PID 4588 wrote to memory of 4264	4588	legends.exe	110
PID 4588 wrote to memory of 4264	4588	legends.exe	110
PID 4588 wrote to memory of 4264	4588	legends.exe	110
PID 4588 wrote to memory of 2944	4588	legends.exe	112
PID 4588 wrote to memory of 2944	4588	legends.exe	112
PID 4588 wrote to memory of 2944	4588	legends.exe	112
PID 2944 wrote to memory of 3448	2944	cmd.exe	114
PID 2944 wrote to memory of 3448	2944	cmd.exe	114
PID 2944 wrote to memory of 3448	2944	cmd.exe	114
PID 2944 wrote to memory of 1444	2944	cmd.exe	115
PID 2944 wrote to memory of 1444	2944	cmd.exe	115
PID 2944 wrote to memory of 1444	2944	cmd.exe	115
PID 2944 wrote to memory of 2200	2944	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe
"C:\Users\Admin\AppData\Local\Temp\185fd95bacf2d16181117ce925764a622b6e262a3d5786cb72b96feb401cd8f0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8627894.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8627894.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2087177.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2087177.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0929780.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0929780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8365005.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8365005.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2288
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7819075.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7819075.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4732
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6642088.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6642088.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6642088.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6642088.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4588
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4264
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:2216
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:1704

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1376
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:4188

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2344
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:1844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6642088.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6642088.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6642088.exe

Filesize
965KB

MD5
49d457bdb973f51e205179ab08757969

SHA1
60520a9adc67a6bafab291d14f3c86d539ff8946

SHA256
d9be6878bfbe75dcf6d420122b75a64d1e9fce00199360b1526172da4e30a4df

SHA512
7992574dcf1c604c5aa18e7b2301314e69eb487c575a87f3c268f2ee70c30958b25371543d1e07a0960cc19b6a959a0acddfb1ee67e996cf86ab13891862bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8627894.exe

Filesize
580KB

MD5
11ef78c84a0f00aaa9f0c5cae45ac63b

SHA1
93764fafb9692ade2ee64893bcca6c832076054c

SHA256
4c35079236e1c9c098a3d064e5b85db6bf8774c1bd408b7c662c6dbc86d7cb6a

SHA512
1ee6996ab077516bfc004b4443af0ceb45ce0e5e7d25787a2a9aa04c1eae1f57f7957c8528759de394c6ca6e5d67b158c8d1b8f085c196f8acc2f441af847074

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8627894.exe

Filesize
580KB

MD5
11ef78c84a0f00aaa9f0c5cae45ac63b

SHA1
93764fafb9692ade2ee64893bcca6c832076054c

SHA256
4c35079236e1c9c098a3d064e5b85db6bf8774c1bd408b7c662c6dbc86d7cb6a

SHA512
1ee6996ab077516bfc004b4443af0ceb45ce0e5e7d25787a2a9aa04c1eae1f57f7957c8528759de394c6ca6e5d67b158c8d1b8f085c196f8acc2f441af847074

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7819075.exe

Filesize
303KB

MD5
5b9244087fae854de33a564e13a2c2f3

SHA1
a69d8a0b5aecdab4ee0bd315ea7cdabed58778bf

SHA256
b846b267e4323271ef00973def448ed1acbe54fa3d88c0eda8561c5388c32752

SHA512
b4157f836a8aa204697e30fc0c2c33fd5f902b4e7abcf5489d4fb88c2da6454e230e90f63434831c71fb44b3f80f08f6f0bfa09cad39c12db3f389f7951c0f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7819075.exe

Filesize
303KB

MD5
5b9244087fae854de33a564e13a2c2f3

SHA1
a69d8a0b5aecdab4ee0bd315ea7cdabed58778bf

SHA256
b846b267e4323271ef00973def448ed1acbe54fa3d88c0eda8561c5388c32752

SHA512
b4157f836a8aa204697e30fc0c2c33fd5f902b4e7abcf5489d4fb88c2da6454e230e90f63434831c71fb44b3f80f08f6f0bfa09cad39c12db3f389f7951c0f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2087177.exe

Filesize
274KB

MD5
f7110da93637fea954b1094fd16fa625

SHA1
7123cfc47a95445116e9e41e061170836efe746a

SHA256
b0e9aee9f576bf5ada3ddf820244f6fbaaf95c191c0d34205ae3a25d2a63016e

SHA512
36f7bca1811a36e6024a0598a0c3e5802f83688269e63ef91404274357817f9211c65e32bea5a24ecd60f56c21fb2b3c9d7af700de545da4c030194ba0e8ecfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2087177.exe

Filesize
274KB

MD5
f7110da93637fea954b1094fd16fa625

SHA1
7123cfc47a95445116e9e41e061170836efe746a

SHA256
b0e9aee9f576bf5ada3ddf820244f6fbaaf95c191c0d34205ae3a25d2a63016e

SHA512
36f7bca1811a36e6024a0598a0c3e5802f83688269e63ef91404274357817f9211c65e32bea5a24ecd60f56c21fb2b3c9d7af700de545da4c030194ba0e8ecfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0929780.exe

Filesize
145KB

MD5
8e31653c606b96a0e4e4afe9f26f2d18

SHA1
ce559db00a21cd297d45b15c9c033a3c1e47ab07

SHA256
5d5fe1965b79bed9907f6617bfbeca2185ee72b76ca721a36724cecae034c81a

SHA512
4b6adaa9d56745b0e378362d70fa5f59b63ff0aa6f837bac378eb0b5db5c1b22924d22cc4524266ed3d2f7159ce195dfec8975e88a195f059cc449e666dd9d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0929780.exe

Filesize
145KB

MD5
8e31653c606b96a0e4e4afe9f26f2d18

SHA1
ce559db00a21cd297d45b15c9c033a3c1e47ab07

SHA256
5d5fe1965b79bed9907f6617bfbeca2185ee72b76ca721a36724cecae034c81a

SHA512
4b6adaa9d56745b0e378362d70fa5f59b63ff0aa6f837bac378eb0b5db5c1b22924d22cc4524266ed3d2f7159ce195dfec8975e88a195f059cc449e666dd9d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8365005.exe

Filesize
168KB

MD5
1255c2a6e5b2089a17ec4375427b6582

SHA1
5c1277e0d7848bb586fd17b6cb5eb63a074357b9

SHA256
342ce434bde664969cd6dc7a1f8114c35d3e87ae375106ba89eb4e6ee3258a71

SHA512
95f1075550f0e47e8dfbee2d91614a044408d57db14b553bf2acb9c6eadf1f8796c2c113512a299c3f503f986337aee2ffa7e4dad738940dcde9f48c60b696a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8365005.exe

Filesize
168KB

MD5
1255c2a6e5b2089a17ec4375427b6582

SHA1
5c1277e0d7848bb586fd17b6cb5eb63a074357b9

SHA256
342ce434bde664969cd6dc7a1f8114c35d3e87ae375106ba89eb4e6ee3258a71

SHA512
95f1075550f0e47e8dfbee2d91614a044408d57db14b553bf2acb9c6eadf1f8796c2c113512a299c3f503f986337aee2ffa7e4dad738940dcde9f48c60b696a8

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/848-190-0x00000000006F0000-0x00000000007E8000-memory.dmp

Filesize
992KB

Download
memory/848-191-0x0000000007500000-0x0000000007510000-memory.dmp

Filesize
64KB

Download
memory/1008-154-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1732-213-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1732-193-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1732-196-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1732-197-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1732-199-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1844-254-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1844-255-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1844-256-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2288-168-0x0000000005C60000-0x0000000005CD6000-memory.dmp

Filesize
472KB

Download
memory/2288-166-0x00000000058F0000-0x0000000005900000-memory.dmp

Filesize
64KB

Download
memory/2288-162-0x0000000000FA0000-0x0000000000FCE000-memory.dmp

Filesize
184KB

Download
memory/2288-163-0x0000000005F20000-0x0000000006538000-memory.dmp

Filesize
6.1MB

Download
memory/2288-176-0x00000000058F0000-0x0000000005900000-memory.dmp

Filesize
64KB

Download
memory/2288-164-0x0000000005A10000-0x0000000005B1A000-memory.dmp

Filesize
1.0MB

Download
memory/2288-165-0x0000000005900000-0x0000000005912000-memory.dmp

Filesize
72KB

Download
memory/2288-171-0x0000000006540000-0x00000000065A6000-memory.dmp

Filesize
408KB

Download
memory/2288-167-0x0000000005920000-0x000000000595C000-memory.dmp

Filesize
240KB

Download
memory/2288-175-0x00000000091B0000-0x00000000096DC000-memory.dmp

Filesize
5.2MB

Download
memory/2288-174-0x0000000006CE0000-0x0000000006EA2000-memory.dmp

Filesize
1.8MB

Download
memory/2288-172-0x0000000006AC0000-0x0000000006B10000-memory.dmp

Filesize
320KB

Download
memory/2288-169-0x0000000005D80000-0x0000000005E12000-memory.dmp

Filesize
584KB

Download
memory/2288-170-0x0000000006FE0000-0x0000000007584000-memory.dmp

Filesize
5.6MB

Download
memory/4188-229-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4188-230-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4188-228-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4588-248-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4588-222-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4588-221-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4588-219-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4588-218-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4732-192-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4732-181-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5116-214-0x0000000007040000-0x0000000007050000-memory.dmp

Filesize
64KB

Download