redline | d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe
Size

1.0MB
MD5

bea05734bae1ef92329ea8e823acde8e
SHA1

c5dc3173b796e5b83e9b031b97a72c57b14942d1
SHA256

d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373
SHA512

c49aa53361cca6f8802d69f1977e658d29cc09e7fb7c01f3c093f99f792059c231e4f57c937fa4f820444344616920f28bb9237cf31a91c7412e95126b292439
SSDEEP

24576:JyDeb/Mj+DUOejykMM8slxS8jjUAR7OFJL3Q/hH4yoys+b8cI:8iAqAvXMMNUAOQ/hYyoY8c

Score

10^/10

redline brain lusa discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lusa

83.97.73.126:19046

Attributes

auth_value
c9df946711e01c378b42221de692acbd

Extracted

Family

redline

Botnet

brain

83.97.73.126:19046

Attributes

auth_value
5fb8269baadec0c49899b9a7a0c8851f

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	s9034403.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legends.exe

Executes dropped EXE 15 IoCs

pid	Process
3548	z4621820.exe
1340	z3883617.exe
3408	o5674303.exe
2252	p8126857.exe
1528	r2012324.exe
1356	s9034403.exe
2656	s9034403.exe
2580	legends.exe
1408	legends.exe
4880	legends.exe
4436	legends.exe
3968	legends.exe
3260	legends.exe
2308	legends.exe
4392	legends.exe

Loads dropped DLL 1 IoCs

pid	Process
968	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z4621820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4621820.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z3883617.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z3883617.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 3084	3408	o5674303.exe	88
PID 1528 set thread context of 3836	1528	r2012324.exe	98
PID 1356 set thread context of 2656	1356	s9034403.exe	100
PID 2580 set thread context of 1408	2580	legends.exe	103
PID 4880 set thread context of 4436	4880	legends.exe	116
PID 3968 set thread context of 2308	3968	legends.exe	120

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3084	AppLaunch.exe
3084	AppLaunch.exe
2252	p8126857.exe
2252	p8126857.exe
3836	AppLaunch.exe
3836	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	AppLaunch.exe
Token: SeDebugPrivilege	2252	p8126857.exe
Token: SeDebugPrivilege	1356	s9034403.exe
Token: SeDebugPrivilege	2580	legends.exe
Token: SeDebugPrivilege	3836	AppLaunch.exe
Token: SeDebugPrivilege	4880	legends.exe
Token: SeDebugPrivilege	3968	legends.exe
Token: SeDebugPrivilege	4392	legends.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	s9034403.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 3548	368	d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe	84
PID 368 wrote to memory of 3548	368	d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe	84
PID 368 wrote to memory of 3548	368	d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe	84
PID 3548 wrote to memory of 1340	3548	z4621820.exe	85
PID 3548 wrote to memory of 1340	3548	z4621820.exe	85
PID 3548 wrote to memory of 1340	3548	z4621820.exe	85
PID 1340 wrote to memory of 3408	1340	z3883617.exe	86
PID 1340 wrote to memory of 3408	1340	z3883617.exe	86
PID 1340 wrote to memory of 3408	1340	z3883617.exe	86
PID 3408 wrote to memory of 3084	3408	o5674303.exe	88
PID 3408 wrote to memory of 3084	3408	o5674303.exe	88
PID 3408 wrote to memory of 3084	3408	o5674303.exe	88
PID 3408 wrote to memory of 3084	3408	o5674303.exe	88
PID 3408 wrote to memory of 3084	3408	o5674303.exe	88
PID 1340 wrote to memory of 2252	1340	z3883617.exe	89
PID 1340 wrote to memory of 2252	1340	z3883617.exe	89
PID 1340 wrote to memory of 2252	1340	z3883617.exe	89
PID 3548 wrote to memory of 1528	3548	z4621820.exe	96
PID 3548 wrote to memory of 1528	3548	z4621820.exe	96
PID 3548 wrote to memory of 1528	3548	z4621820.exe	96
PID 1528 wrote to memory of 3836	1528	r2012324.exe	98
PID 1528 wrote to memory of 3836	1528	r2012324.exe	98
PID 1528 wrote to memory of 3836	1528	r2012324.exe	98
PID 1528 wrote to memory of 3836	1528	r2012324.exe	98
PID 1528 wrote to memory of 3836	1528	r2012324.exe	98
PID 368 wrote to memory of 1356	368	d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe	99
PID 368 wrote to memory of 1356	368	d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe	99
PID 368 wrote to memory of 1356	368	d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe	99
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 1356 wrote to memory of 2656	1356	s9034403.exe	100
PID 2656 wrote to memory of 2580	2656	s9034403.exe	102
PID 2656 wrote to memory of 2580	2656	s9034403.exe	102
PID 2656 wrote to memory of 2580	2656	s9034403.exe	102
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 2580 wrote to memory of 1408	2580	legends.exe	103
PID 1408 wrote to memory of 4732	1408	legends.exe	104
PID 1408 wrote to memory of 4732	1408	legends.exe	104
PID 1408 wrote to memory of 4732	1408	legends.exe	104
PID 1408 wrote to memory of 3900	1408	legends.exe	106
PID 1408 wrote to memory of 3900	1408	legends.exe	106
PID 1408 wrote to memory of 3900	1408	legends.exe	106
PID 3900 wrote to memory of 3380	3900	cmd.exe	108
PID 3900 wrote to memory of 3380	3900	cmd.exe	108
PID 3900 wrote to memory of 3380	3900	cmd.exe	108
PID 3900 wrote to memory of 1612	3900	cmd.exe	109
PID 3900 wrote to memory of 1612	3900	cmd.exe	109
PID 3900 wrote to memory of 1612	3900	cmd.exe	109
PID 3900 wrote to memory of 3368	3900	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe
"C:\Users\Admin\AppData\Local\Temp\d18b2aaa9a4ba1ba742f36940272f308a1a350ac9035891fc1d34a1ea2b42373.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4621820.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4621820.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3883617.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3883617.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5674303.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5674303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8126857.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8126857.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2252
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2012324.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2012324.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3836
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9034403.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9034403.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9034403.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9034403.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
      "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        
        C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1408
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4732
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:N"
        7⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legends.exe" /P "Admin:R" /E
        7⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:N"
        7⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\41bde21dc7" /P "Admin:R" /E
        7⤵
        
        PID:4536
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:968

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4880
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:4436

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3968
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  - Executes dropped EXE
  PID:2308

C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4392
- C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
  2⤵
  PID:3660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9034403.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9034403.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s9034403.exe

Filesize
966KB

MD5
69f5636203f055ecd5615cbff1acb986

SHA1
3e1dbbe0d25bcf3a3a57390a49192764c9071ca5

SHA256
be33c1e0ac9a106459aebb1ceb79cb1e80e95fad63eee38454e81d55fa43e2b2

SHA512
a67acdfa3e4503105b9d08860c061cc641ffa2de8fbb237579d1656000a3305a90492d56228f64c38071463b1cda1c4051b3a037e35bde5bc29c1fa7845159ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4621820.exe

Filesize
606KB

MD5
3462125ef8ed78f50d68d02b00b7aed3

SHA1
7afb7c5931a0c28977afc19c19cde5bac14970dd

SHA256
dc134df0dcd1d5c4a6f6fc88260e8d3ab4513aa51922d197343c7632b7a0f88c

SHA512
f40ec4d1d86e526725c67de431d413aafef4cb9798088fbf7a677c680bad4514804485528cdc35ccbec145e92f643825fc85f7f0d612af04d730d98bda540039

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4621820.exe

Filesize
606KB

MD5
3462125ef8ed78f50d68d02b00b7aed3

SHA1
7afb7c5931a0c28977afc19c19cde5bac14970dd

SHA256
dc134df0dcd1d5c4a6f6fc88260e8d3ab4513aa51922d197343c7632b7a0f88c

SHA512
f40ec4d1d86e526725c67de431d413aafef4cb9798088fbf7a677c680bad4514804485528cdc35ccbec145e92f643825fc85f7f0d612af04d730d98bda540039

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2012324.exe

Filesize
303KB

MD5
4e21267e5cf1e122695c37a4b8627644

SHA1
bdf7798b32020df8d45548d9c7c245b3ccf13646

SHA256
4306d806b62fa292d9ef67fd400601821bbcbd79d75ccb8971794efe57be73be

SHA512
4a1cc6c971f2be6c19b7b8c8a02be333403dd1d1851dd4f5079d610a82cfa08843ae48d35ae1eb1b1e48559762d54786fd6b4569752a3c784c2a0b3a7828330b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2012324.exe

Filesize
303KB

MD5
4e21267e5cf1e122695c37a4b8627644

SHA1
bdf7798b32020df8d45548d9c7c245b3ccf13646

SHA256
4306d806b62fa292d9ef67fd400601821bbcbd79d75ccb8971794efe57be73be

SHA512
4a1cc6c971f2be6c19b7b8c8a02be333403dd1d1851dd4f5079d610a82cfa08843ae48d35ae1eb1b1e48559762d54786fd6b4569752a3c784c2a0b3a7828330b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3883617.exe

Filesize
276KB

MD5
bdade0cf760202aed463b37fe99650c2

SHA1
0bc759a16ce4a3d46494e22b24ee218d33c9480a

SHA256
51f0949b41765375437eaf2e6caafc7701411d1ebcc9921bd1f97246225e5d99

SHA512
7a593abbdd6c1a2cad329bc11a88a1e9b2e732985d679fa07ec7faf97cd6f144798970b8c0e984a7e984ad134ab42021584d3d280576552545cb5e5b5ac51f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3883617.exe

Filesize
276KB

MD5
bdade0cf760202aed463b37fe99650c2

SHA1
0bc759a16ce4a3d46494e22b24ee218d33c9480a

SHA256
51f0949b41765375437eaf2e6caafc7701411d1ebcc9921bd1f97246225e5d99

SHA512
7a593abbdd6c1a2cad329bc11a88a1e9b2e732985d679fa07ec7faf97cd6f144798970b8c0e984a7e984ad134ab42021584d3d280576552545cb5e5b5ac51f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5674303.exe

Filesize
147KB

MD5
6cbb87d8e1a87e862223e0c00bb29591

SHA1
f4fd2ba033aa37b2c4d379493fc370068f37eb9e

SHA256
64f5ca688c8fadb227bd5314d94e7236c0c9c49c37deea3ceb5977e3373026e4

SHA512
15de524fb1798b260b970efcadf8e154e41cb6410d1cf67fa2b13883f6040705d99e2c437255aba708b84f099cfa46a7d45145d91fd26bffa3e0c74815f528af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o5674303.exe

Filesize
147KB

MD5
6cbb87d8e1a87e862223e0c00bb29591

SHA1
f4fd2ba033aa37b2c4d379493fc370068f37eb9e

SHA256
64f5ca688c8fadb227bd5314d94e7236c0c9c49c37deea3ceb5977e3373026e4

SHA512
15de524fb1798b260b970efcadf8e154e41cb6410d1cf67fa2b13883f6040705d99e2c437255aba708b84f099cfa46a7d45145d91fd26bffa3e0c74815f528af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8126857.exe

Filesize
168KB

MD5
4ad3baf3298f696c90684053fb2852b1

SHA1
48b912f5ad175a127960b8cdf5c1f1031cfb68ab

SHA256
dad8f89f2bd57be568fb2331c735e39ed34507352ddba3adc3acd843dae7ab93

SHA512
a4aa2d61191359023a65b58f0f0f7f4f83d3b3ea3e05406a92fbf661cc588e109c17496fe81989da006464593810bfc04ee6bd679d42918b02d1b6990a338102

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8126857.exe

Filesize
168KB

MD5
4ad3baf3298f696c90684053fb2852b1

SHA1
48b912f5ad175a127960b8cdf5c1f1031cfb68ab

SHA256
dad8f89f2bd57be568fb2331c735e39ed34507352ddba3adc3acd843dae7ab93

SHA512
a4aa2d61191359023a65b58f0f0f7f4f83d3b3ea3e05406a92fbf661cc588e109c17496fe81989da006464593810bfc04ee6bd679d42918b02d1b6990a338102

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73c0c85e39b9a63b42f6c4ff6d634f8b

SHA1
efb047b4177ad78268f6fc8bf959f58f1123eb51

SHA256
477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

SHA512
ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1356-192-0x0000000007610000-0x0000000007620000-memory.dmp

Filesize
64KB

Download
memory/1356-190-0x00000000006F0000-0x00000000007E8000-memory.dmp

Filesize
992KB

Download
memory/1408-218-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1408-249-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1408-222-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1408-221-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1408-219-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2252-170-0x000000000A7E0000-0x000000000A846000-memory.dmp

Filesize
408KB

Download
memory/2252-165-0x000000000A3F0000-0x000000000A402000-memory.dmp

Filesize
72KB

Download
memory/2252-175-0x000000000C450000-0x000000000C97C000-memory.dmp

Filesize
5.2MB

Download
memory/2252-174-0x000000000B720000-0x000000000B8E2000-memory.dmp

Filesize
1.8MB

Download
memory/2252-167-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/2252-166-0x000000000A450000-0x000000000A48C000-memory.dmp

Filesize
240KB

Download
memory/2252-172-0x000000000B460000-0x000000000B4B0000-memory.dmp

Filesize
320KB

Download
memory/2252-169-0x000000000A880000-0x000000000A912000-memory.dmp

Filesize
584KB

Download
memory/2252-176-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/2252-168-0x000000000A760000-0x000000000A7D6000-memory.dmp

Filesize
472KB

Download
memory/2252-162-0x0000000000540000-0x000000000056E000-memory.dmp

Filesize
184KB

Download
memory/2252-171-0x000000000B970000-0x000000000BF14000-memory.dmp

Filesize
5.6MB

Download
memory/2252-163-0x000000000A9A0000-0x000000000AFB8000-memory.dmp

Filesize
6.1MB

Download
memory/2252-164-0x000000000A4C0000-0x000000000A5CA000-memory.dmp

Filesize
1.0MB

Download
memory/2308-257-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-258-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-259-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2580-214-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Filesize
64KB

Download
memory/2656-197-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2656-193-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2656-196-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2656-199-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2656-213-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3084-154-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3836-191-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/3836-181-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3968-253-0x0000000006DB0000-0x0000000006DC0000-memory.dmp

Filesize
64KB

Download
memory/4436-231-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4436-230-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4436-229-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4880-226-0x0000000007130000-0x0000000007140000-memory.dmp

Filesize
64KB

Download