a4fe031e16b78b6ea7e125cde3466587fc79af0ec148ae768f8abf00ed9ab6f6

Analysis

max time kernel
323s
max time network
332s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/09/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GraalSetup.exe
Size

2.8MB
MD5

31fc30307b60ca588c737930d73ad2ea
SHA1

88769a6b9103afff138bf6841cd46f3c0ca0632c
SHA256

a4fe031e16b78b6ea7e125cde3466587fc79af0ec148ae768f8abf00ed9ab6f6
SHA512

a702d02a64555c746c0eabe4bfe0022271354af330e4467fab23c75d391650a91f7b1b5da8c67a9c34f2d9f72a95e6df6f8ca916a5173f596172adb184466f9e
SSDEEP

49152:hlY1+c+OUi7KbKsfZ0/m1ilI3VPOpI7pwSQeBhHDGjPz2MZYYLcYpNjE:hl/c+c2b1xSha3VBDBhjSy3CTjE

Score

9^/10

discovery evasion upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GraalSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Graal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Graal.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Graal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Graal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Graal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GraalSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GraalSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Graal.exe

Executes dropped EXE 3 IoCs

pid	Process
236	ExeReplacer.exe
4104	Graal.exe
516	Graal.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	GraalSetup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	Graal.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	Graal.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2520-1-0x0000000010000000-0x0000000010096000-memory.dmp	upx
behavioral1/memory/2520-6-0x0000000010000000-0x0000000010096000-memory.dmp	upx
behavioral1/memory/2520-5-0x0000000010000000-0x0000000010096000-memory.dmp	upx
behavioral1/memory/2520-2-0x0000000010000000-0x0000000010096000-memory.dmp	upx
behavioral1/memory/4104-30-0x0000000010000000-0x0000000010096000-memory.dmp	upx
behavioral1/memory/4104-31-0x0000000010000000-0x0000000010096000-memory.dmp	upx
behavioral1/memory/516-92-0x0000000010000000-0x0000000010096000-memory.dmp	upx
behavioral1/memory/516-96-0x0000000010000000-0x0000000010096000-memory.dmp	upx
behavioral1/memory/516-97-0x0000000010000000-0x0000000010096000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2520	GraalSetup.exe
4104	Graal.exe
516	Graal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GraalSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExeReplacer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Graal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Graal.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\EditFlags = 02000000	GraalSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\Shell\open\command	GraalSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\DefaultIcon\ = "\"C:\\Users\\Admin\\Graal\\Graal.exe\""	Graal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal	GraalSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\EditFlags = 02000000	Graal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\Shell\open\command	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\ = "URL:GRAAL Protocol"	Graal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\Shell\open\command	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\GraalSetup.exe\" \"%0\""	GraalSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\DefaultIcon	GraalSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\ = "URL:GRAAL Protocol"	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\URL Protocol	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\GraalSetup.exe\""	GraalSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\ = "URL:GRAAL Protocol"	GraalSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\Shell\open	GraalSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\DefaultIcon\ = "\"C:\\Users\\Admin\\Graal\\Graal.exe\""	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\Shell\open\command\ = "\"C:\\Users\\Admin\\Graal\\Graal.exe\" \"%0\""	Graal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\EditFlags = 02000000	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\Shell\open\command\ = "\"C:\\Users\\Admin\\Graal\\Graal.exe\" \"%0\""	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\URL Protocol	GraalSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\Shell	GraalSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\DefaultIcon	Graal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal	Graal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\URL Protocol	Graal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\graal\DefaultIcon	Graal.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2520	GraalSetup.exe
2520	GraalSetup.exe
4104	Graal.exe
4104	Graal.exe
516	Graal.exe
516	Graal.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
2520	GraalSetup.exe
2520	GraalSetup.exe
4104	Graal.exe
4104	Graal.exe
4104	Graal.exe
4104	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2520	GraalSetup.exe
2520	GraalSetup.exe
4104	Graal.exe
4104	Graal.exe
4104	Graal.exe
4104	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe
516	Graal.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 236	2520	GraalSetup.exe	73
PID 2520 wrote to memory of 236	2520	GraalSetup.exe	73
PID 2520 wrote to memory of 236	2520	GraalSetup.exe	73
PID 2520 wrote to memory of 4104	2520	GraalSetup.exe	74
PID 2520 wrote to memory of 4104	2520	GraalSetup.exe	74
PID 2520 wrote to memory of 4104	2520	GraalSetup.exe	74

C:\Users\Admin\AppData\Local\Temp\GraalSetup.exe
"C:\Users\Admin\AppData\Local\Temp\GraalSetup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\Graal\ExeReplacer.exe
  "C:\Users\Admin\Graal\ExeReplacer.exe" 2 "C:\Users\Admin\AppData\Local\Temp\GraalSetup.exe" "C:\Users\Admin\Graal\Graal.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:236
- C:\Users\Admin\Graal\Graal.exe
  "C:\Users\Admin\Graal\Graal.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4104

C:\Users\Admin\Graal\Graal.exe
"C:\Users\Admin\Graal\Graal.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Graal\ExeReplacer.exe

Filesize
122KB

MD5
cfb2d8e56882a018203724e9b2c4df29

SHA1
8dd327285bb39c1f7026d2d7dcf41e2d0575d692

SHA256
17954953691edd40d4dbfb67f0884dafb095b4263868f188029f5f2c48b77ea9

SHA512
f8df1a7a239e6b069f87d79f035d209c548f6b97742a88c88d75702041a60ac4a309c1d304a8c368218a8e7d95526ecb3386ab65921ac6bf6b212544c2016b59

Download Submit
C:\Users\Admin\Graal\Graal.exe

Filesize
2.8MB

MD5
31fc30307b60ca588c737930d73ad2ea

SHA1
88769a6b9103afff138bf6841cd46f3c0ca0632c

SHA256
a4fe031e16b78b6ea7e125cde3466587fc79af0ec148ae768f8abf00ed9ab6f6

SHA512
a702d02a64555c746c0eabe4bfe0022271354af330e4467fab23c75d391650a91f7b1b5da8c67a9c34f2d9f72a95e6df6f8ca916a5173f596172adb184466f9e

Download Submit
C:\Users\Admin\Graal\game_config.txt

Filesize
1KB

MD5
28da4d187c5552e429d7fa86df1a0e8e

SHA1
4140a8a4c2a314d5bf83677acc0dbbe33fc55e25

SHA256
dacceda0fe3c43ad29ba16bff3d9a1bb3a32808d5dfc43d4a82786e84652111b

SHA512
99fe3f1a9dea4b089bc57c144948fc09d8d09885d28225dbff27f14b2610f4aecfb65e9d2ffca68de8636a5a733d8137aab7bf21e91140185ee1ce29fdc0c792

Download Submit
C:\Users\Admin\Graal\game_console.log

Filesize
812B

MD5
3ff5414ba03cef67ad5cb9705289a339

SHA1
698f4fada2e17e2ee65718e022bfa755105588c5

SHA256
2421049bc898fc003e51a82176cdf7d0a457279978ea0bf7ebdf99b0eddde03e

SHA512
0e2d59e3ce6ee165af0351bbb169f22086b38921c616e5c2eba7f57a546ca90b4ad2f44d92bbf91040ad16fadc825eafb45d0816a3ca5d08f5085e3c1fe3164f

Download Submit
C:\Users\Admin\Graal\game_console.log

Filesize
4KB

MD5
149c4087c7de56362f58f273ebd9a279

SHA1
9808984afb5fa8fd6e6487a64b26dd8a5c97360b

SHA256
9f54cbc6cf61d7544decfcc9eddc82f7f3e136c87b7dac715da9e862a46bc0e6

SHA512
0ccd271695e48cccf0ac66632046a8d1a72641bc0bb5030a4a3af6c2dbac744d353b711e218f5fac0e66bc952d192b193ab3053d4bb38af0821e35bf029832c0

Download Submit
C:\Users\Admin\Graal\levels\ganis\carried.gani

Filesize
7KB

MD5
8e7b6ac969ea3cc13ee6cf243a87cdae

SHA1
7299fffe5aec85ee2a0441b4a41f745fa1a6bcc1

SHA256
278d6626256c627ca6f3a81baa643de030c2dc844e7ba22759a4e77f9ea6c566

SHA512
8a289c65c9431b716d5652a6aa905032bae7ae42621a4419c7fdd2ef84170e1e9eda5886fb944d801193cf8cd74e3a19b71e1b19169bf93e3f6fc5157b6a2ce9

Download Submit
C:\Users\Admin\Graal\levels\ganis\idle.gani

Filesize
7KB

MD5
87cc2a9dc646f4bdc1ed195cec941760

SHA1
7544e289c087f1c6e8d7766b3dba0a86777caef2

SHA256
816d20216bf9749f40cfa9d49aa89618fa9a64832e3c81104862131cd08578a6

SHA512
6ec29bdd9a7a9d2ed41d98f2af1614ae00c38dd80e7a0b5ea7b38257aaf4bd4cbc479994570656206cbf9a23458a99f4e89169ba48ac2ac93908ea2860a1df75

Download Submit
C:\Users\Admin\Graal\levels\ganis\ride.gani

Filesize
9KB

MD5
27c807a3e8e61ac3c2148cb57c3d2847

SHA1
b18941080982411eb3252fb0ee9c2458186722d7

SHA256
9257890c4a58b83fd965fd3018ef7d91e169c8d8edcd76d648dc42b5b5a22e31

SHA512
44af828ece0042a2a243734b39da2eb58e6a258601d22bbcd9c99ef545a262a5236e811a549b2973d04dbda89c8e82d5dbda53b1f88d95a405ebb5231f2b45e9

Download Submit
C:\Users\Admin\Graal\levels\heads\head0.png

Filesize
1KB

MD5
f9a415ee3eef551fe63748ffc556388d

SHA1
9396dc6f19de6e08935b3ca306dff5758837d16b

SHA256
538d2c7245a78f8990caaf66764a24764755d6ae4eab0b29a4c116f950c099f8

SHA512
b263b54d165a55bcc01a15d295dc76b7d4ae1a46cd30b24df02e8a3a828b9d8eea48459d11aa1fa170e9d6c4100f983a66d16d940cec8bac7b3d98af80719fb7

Download Submit
C:\Users\Admin\Graal\levels\images\downloads\bcalarmclock.png

Filesize
1KB

MD5
3d66a801ff3f0f14ccc5dee6395d8d48

SHA1
e301ebdf7a2018fb0619584fe72cb247a2f80f4e

SHA256
43ecc70f2a5becf604668e1bdb51abcedb6ef1bcc6f98c460a1a5d80c6cb705a

SHA512
5f8735eb2e80d325644df388a695f7dddf98069441c80fecc43c32a2d5be6978db6efeff6ddb53c8da3f895ce53911ea3db5fe4585bcb4861757710101be42fe

Download Submit
C:\Users\Admin\Graal\updatepackages\basepackage.gupd

Filesize
229B

MD5
2ee998ef044d38a7d6f32dcd3c343000

SHA1
8509add652b06bd8d4019dacbb1660e5dafd4fb8

SHA256
418c7866a6acaa9cd75d2075e46a77adb341732542191814b77d7fdefe98fb10

SHA512
a5b4bc902db8e3742f13a97f2aed6a6933f9192003f4bba2f70363b9805a47ac847fc805db4cf14e9de6413e20987ade497dcb39f28db3ede97ca9907a815221

Download Submit
C:\Users\Admin\Graal\updatepackages\basepackage_linux.gupd

Filesize
394B

MD5
3b0dc314fd3a8ee773308d6a05848fbc

SHA1
8d7ed80ada9ec5934080c63f6bf51a43e84e54a8

SHA256
203384bd88553ed0d8aa23793c00f86430ba707655baa6157c8a09bc43518b6a

SHA512
2e5922abc7a61991a5a4e50f597f05ab13df32c08a55713d5418ae4ba5fc5a0d4f324f6aaedc74a76c3fa195a6d62ac4df96fd87c23452c2f819d16dd8fada7d

Download Submit
C:\Users\Admin\Graal\updatepackages\basepackage_mac.gupd

Filesize
420B

MD5
be9a180c356bc35a7ddb5eae2b56dd92

SHA1
50327582820f4ab7d01df68f479ec668f960106b

SHA256
f760b0c5b6ec731033aeee4fa5ffd6a851c9654f399afb68fc8ae1c2147966dd

SHA512
82b4c861b9cf8ae35ce3ac786ddfb9485be2e8589b69ce629e2574a51dbd3b861b387932dc53a57d60a7cd37ee1a6fdbd259c9c1f95814258c244ece811b4090

Download Submit
C:\Users\Admin\Graal\updatepackages\basepackage_win.gupd

Filesize
457B

MD5
3a144f61d72197dadfccd474432ca90a

SHA1
1af15c64731dface7915fadfb588b70160a1ea04

SHA256
c8c7aec516e5b1b8236ee31ed4bd7678f04aaa7a2f87fdc748761ea1772a77e6

SHA512
1ac2a70f9269e9bd63dafb6ec0eac34dbba9046ea7b735a7c801c740d35696bfdcbc5ea4f30239eb17b0fc5388e19a505091ba3a4c3dc613fba45ae4d495349d

Download Submit
C:\Users\Admin\Graal\weblevels\606eb9c4caea30161adf1f8afc3945e0\black.nw-14900.code

Filesize
300B

MD5
c636f0fc8bac148a39eb6d65d1e2a4be

SHA1
bb937b806ed12535de31c43648e22ddc84902955

SHA256
bba44bf6de6776e00013f7c926dde19336bdb7760d55b965c42926dfb20ddf51

SHA512
534e9757a696bad7949cd48f4e2e6ad9586bd8b938316cc7c7ec7d08e4f70016c462b3beff061ad0ff1b0eebdbf5c788b9631cc0e314f6aa860d1f1281aaff58

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045F2LogWindow.code

Filesize
3KB

MD5
a16192cce0034de7357953b5f34849a4

SHA1
bfcfacca74d822177d3ca95babde72184f926410

SHA256
99718b128aecf6195b3992087d07615ad94f9a4b24dc92aa8a13c1511cc12b48

SHA512
14421fed19efd935782c08e799b0c84c5013874e4381abc70e3ebaa7ff7d024b33f795e7ad4195fdae28e6982f2aae661249489c440eab0ec716c8a29f92a40b

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045IRC_Installer.code

Filesize
4KB

MD5
bc782ad835ca1cc9d97af24e3a1bd4d1

SHA1
566641da40c8fc5200559d25a60efbbe69a20e17

SHA256
119dcde3490cd42768ea4387e477bacec73879b005371b0592835daf34517a8f

SHA512
e946b367e3e20f4a48e0c19548e84f2a613bd49047f3cb38f21ddde8f6d56f5bbfe61fe77e96352d37850aa1a745ffa63522954a8b885ecd762db7eab9342055

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045IRC_InstallerGUI.code

Filesize
10KB

MD5
cbfeaea83fcb92fb193ed0dc33e9d6d8

SHA1
7f1bcb9b4f2ddcc2c496217001f87fa0da175a27

SHA256
ba00e39d1ac5d832416d62aa4282016c63ef1d236e03aad9e58931ed0ea4a908

SHA512
329dbe9140242ce5ed6d27924ae2845c857a059b7936cc1193718f328bdc5b57b9f78dd9d1ec87926b589c3b34e48e873ddd7f7e2a718408d54d517a95acb5bf

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045LoadingScreen3D.code

Filesize
1KB

MD5
62e39cf6f0612e3258730dfbc7f81bdb

SHA1
e19fdd3540b5970e5981674a1b32c4c7bbdf137c

SHA256
59f8c8990aa69a6b3899452c1eb1b2a20506869363426d2416c899b8c76fb1ac

SHA512
e0ef6af40b11abb091b99ce1601993141c6d26b2ed7ed0a5231a0b39def40b77c96f76ae9cf351726aaffc0d068512d132ddafed6d1501482749b48f44ab961d

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045New_IRC_Login2.code

Filesize
6KB

MD5
436b213b2973340b76e9aeaede28ef28

SHA1
7e4fd016d727b696e1047dff9646c3abaeb202d1

SHA256
4a1567e002cb66b8bf341733019470d4993f8bff5a58dc132508f205deb453e9

SHA512
23ee08a714de5137441199d2f51d78b91dcdae0fa2e10b22a9a4ae779bedef249f4e4b89f486435368306ab36c05aa3de42ead8076829c737dddf8e67a283668

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045Playerlist.code

Filesize
31KB

MD5
877f7c5809cefc46fe27bf244c004056

SHA1
44672f5a2feadc1b8696ba7f4f73cd626aa2354f

SHA256
3d02684a56c3761abf74d81779f126fbcc527253974b6214aec2658753a82e33

SHA512
5dc7830bdaa41c2ce2239e3710f2e6d955068c8b33656d26bac7d236af2bdb6a724d3f2e71d44d6662daaf393aadb4e3328a64fd11018ca8b78a22b9656d3fee

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045Serverlist.code

Filesize
38KB

MD5
686e2a3eb62c38ab6a5c491178e7122a

SHA1
8a9504247a4cff4b79c1c3ab83ea0e74948cc7c9

SHA256
d08b907e0ec763365a4f302a86803bcee2cb666363063e63800124d1574d2820

SHA512
f7bd6fd2a63be526781eb6e925cbd6015483995f9d2067d2ddda1e43be0d73c2f0f456d0007de00890e0e4cd6c8a30a5ddc5f5aefbbbc8e875d2bc9bae6271e6

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045Serverlist_Chat.code

Filesize
13KB

MD5
0c075b633fa9f2cb20802b9fb55a62ad

SHA1
0518573e89e0586525f7f5ddb40e905c22c57cbb

SHA256
df23fdcccff04d51f9704750373eff2ad7bc4ef5cd09456e4081b8e42981dac3

SHA512
9a072d66255e71ed7f7a7cbfde8b7f0663e2025887e130e2eaddad4e5ab2604de035489b51d06bcf5047f9aaa5fa1de54c5d8f7568976f9dac39b3c35db190b5

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045Serverlist_Events.code

Filesize
14KB

MD5
5ea3b8110318b82676464f2ce7cd4814

SHA1
4fbd86eebac4e06dcc9833931b423e37fd56649d

SHA256
4fa38a68457db6fee0877067aa10e9f81eb5046960051d6e0dfa5f0012bdee7a

SHA512
6ec4a9e1ff966bff9d63b7870a2fab08ec82b97e499250495e30a7685d1d058018f38449001f545897e189a765c0a5f1b2640ff68f10276c6c3d3419e91e70bf

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045Serverlist_LoadLevel.code

Filesize
2KB

MD5
6b16ce580bf2ffcab73f5733c534ed0e

SHA1
604d6bdfa3e4cdf30fdd984d1eef4104f2a611ba

SHA256
eabaf6455b63ea0b4da50ab73d6c22d2a607dc0570fea2cc6a34764317b29b72

SHA512
9e0ee0bb481bc5adabf2df44a099e5ead7ae139668d45ec164529ff6ea65610012052bed986c913ddc93e5933723eed070b6bba48f8a6a44469b4b1ef10c5f3a

Download Submit
C:\Users\Admin\Graal\weblevels\weapons\loginserver%046graalonline%046com%05814900%044loginserver2%046graalonline%046com%05814900%044loginserver3%046graalonline%046com%05814900\%045Serverlist_Observer.code

Filesize
2KB

MD5
03dddfba5f897ba0272354615a19ecba

SHA1
d8acbd9b4f27754cbd6e1a702d2631b3c86e20a2

SHA256
30cec0f14b97dfe0ae59fa0b30c0175e74b458afec103c65134b51606106594d

SHA512
349722acf1ee6e824eaed3b6c404b51033c6ef62f3854f32b404eb0d1cbe02e5d58214b30c7d293f8a03687577a6ec10c0da71cea6e93f3ffccbc6f37e6ccaee

Download Submit
memory/516-92-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/516-1093-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-96-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/516-1106-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-91-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1104-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1103-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1102-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1101-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1100-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1098-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1097-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1096-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1095-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1094-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-133-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-134-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-97-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/516-1092-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1091-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1025-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1078-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1079-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1081-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1082-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1083-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1084-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1085-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1086-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1087-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1088-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/516-1089-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/2520-6-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/2520-5-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/2520-2-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/2520-25-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/2520-0-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/2520-1-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/4104-31-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/4104-68-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/4104-30-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/4104-69-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/4104-77-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/4104-78-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/4104-80-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/4104-89-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/4104-23-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download