amadey | e16a59100f66e733a434025d1ef1e37abe5c73fbae1841b6d3b26b19de0e3762

Analysis

max time kernel
144s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2023 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe
Size

787KB
MD5

68d8bd660ae36f0dcd4df4301491a49f
SHA1

a514e8a226b3db2979899d60469c500fd0562c59
SHA256

497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb
SHA512

03da332b0df7ae16abcf3e44af5887226eff595c01ba86838297f73e270b5a2d11ebedd417fe666c13b434f52a60d3109ea416bd7d30099f68338424f234a2c5
SSDEEP

12288:jMrEy90hg0B/wK+I0a/GNus5THgYaQ4Q2eJPoSUejGDlcUUndcwEhsli:jyH0Bl70ak5DgGdvoSUejGDlMndchso

Score

10^/10

amadey redline maxi rovno discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rovno

83.97.73.130:19061

Attributes

auth_value
88306b072bfae0d9e44ed86a222b439d

Extracted

Family

redline

Botnet

maxi

83.97.73.130:19061

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

amadey

Version

3.84

77.91.68.63/doma/net/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

b4132921.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b4132921.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b4132921.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	b4132921.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b4132921.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b4132921.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b4132921.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d8050857.exerugen.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	d8050857.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	rugen.exe

Executes dropped EXE 11 IoCs

Processes:

v4833239.exev3962061.exev4978460.exea7799278.exeb4132921.exec7182530.exed8050857.exerugen.exee7893310.exerugen.exerugen.exe

pid	process
2632	v4833239.exe
4844	v3962061.exe
2184	v4978460.exe
4164	a7799278.exe
1548	b4132921.exe
3368	c7182530.exe
4272	d8050857.exe
2180	rugen.exe
4824	e7893310.exe
4168	rugen.exe
3724	rugen.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2452 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2452	rundll32.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

b4132921.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	b4132921.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	b4132921.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exev4833239.exev3962061.exev4978460.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4833239.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4833239.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v3962061.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3962061.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4978460.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v4978460.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1556 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a7799278.exeb4132921.exec7182530.exee7893310.exe

pid process

4164 a7799278.exe
4164 a7799278.exe
1548 b4132921.exe
1548 b4132921.exe
3368 c7182530.exe
3368 c7182530.exe
4824 e7893310.exe
4824 e7893310.exe

pid	process
1556	schtasks.exe

pid	process
4164	a7799278.exe
4164	a7799278.exe
1548	b4132921.exe
1548	b4132921.exe
3368	c7182530.exe
3368	c7182530.exe
4824	e7893310.exe
4824	e7893310.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a7799278.exeb4132921.exec7182530.exee7893310.exe

description	pid	process
Token: SeDebugPrivilege	4164	a7799278.exe
Token: SeDebugPrivilege	1548	b4132921.exe
Token: SeDebugPrivilege	3368	c7182530.exe
Token: SeDebugPrivilege	4824	e7893310.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d8050857.exe

pid process

4272 d8050857.exe

pid	process
4272	d8050857.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exev4833239.exev3962061.exev4978460.exed8050857.exerugen.execmd.exe

description	pid	process	target process
PID 3940 wrote to memory of 2632	3940	497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe	v4833239.exe
PID 3940 wrote to memory of 2632	3940	497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe	v4833239.exe
PID 3940 wrote to memory of 2632	3940	497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe	v4833239.exe
PID 2632 wrote to memory of 4844	2632	v4833239.exe	v3962061.exe
PID 2632 wrote to memory of 4844	2632	v4833239.exe	v3962061.exe
PID 2632 wrote to memory of 4844	2632	v4833239.exe	v3962061.exe
PID 4844 wrote to memory of 2184	4844	v3962061.exe	v4978460.exe
PID 4844 wrote to memory of 2184	4844	v3962061.exe	v4978460.exe
PID 4844 wrote to memory of 2184	4844	v3962061.exe	v4978460.exe
PID 2184 wrote to memory of 4164	2184	v4978460.exe	a7799278.exe
PID 2184 wrote to memory of 4164	2184	v4978460.exe	a7799278.exe
PID 2184 wrote to memory of 4164	2184	v4978460.exe	a7799278.exe
PID 2184 wrote to memory of 1548	2184	v4978460.exe	b4132921.exe
PID 2184 wrote to memory of 1548	2184	v4978460.exe	b4132921.exe
PID 2184 wrote to memory of 1548	2184	v4978460.exe	b4132921.exe
PID 4844 wrote to memory of 3368	4844	v3962061.exe	c7182530.exe
PID 4844 wrote to memory of 3368	4844	v3962061.exe	c7182530.exe
PID 4844 wrote to memory of 3368	4844	v3962061.exe	c7182530.exe
PID 2632 wrote to memory of 4272	2632	v4833239.exe	d8050857.exe
PID 2632 wrote to memory of 4272	2632	v4833239.exe	d8050857.exe
PID 2632 wrote to memory of 4272	2632	v4833239.exe	d8050857.exe
PID 4272 wrote to memory of 2180	4272	d8050857.exe	rugen.exe
PID 4272 wrote to memory of 2180	4272	d8050857.exe	rugen.exe
PID 4272 wrote to memory of 2180	4272	d8050857.exe	rugen.exe
PID 3940 wrote to memory of 4824	3940	497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe	e7893310.exe
PID 3940 wrote to memory of 4824	3940	497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe	e7893310.exe
PID 3940 wrote to memory of 4824	3940	497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe	e7893310.exe
PID 2180 wrote to memory of 1556	2180	rugen.exe	schtasks.exe
PID 2180 wrote to memory of 1556	2180	rugen.exe	schtasks.exe
PID 2180 wrote to memory of 1556	2180	rugen.exe	schtasks.exe
PID 2180 wrote to memory of 3720	2180	rugen.exe	cmd.exe
PID 2180 wrote to memory of 3720	2180	rugen.exe	cmd.exe
PID 2180 wrote to memory of 3720	2180	rugen.exe	cmd.exe
PID 3720 wrote to memory of 2464	3720	cmd.exe	cmd.exe
PID 3720 wrote to memory of 2464	3720	cmd.exe	cmd.exe
PID 3720 wrote to memory of 2464	3720	cmd.exe	cmd.exe
PID 3720 wrote to memory of 2696	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 2696	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 2696	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 2612	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 2612	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 2612	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 3392	3720	cmd.exe	cmd.exe
PID 3720 wrote to memory of 3392	3720	cmd.exe	cmd.exe
PID 3720 wrote to memory of 3392	3720	cmd.exe	cmd.exe
PID 3720 wrote to memory of 4584	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 4584	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 4584	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 4052	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 4052	3720	cmd.exe	cacls.exe
PID 3720 wrote to memory of 4052	3720	cmd.exe	cacls.exe
PID 2180 wrote to memory of 2452	2180	rugen.exe	rundll32.exe
PID 2180 wrote to memory of 2452	2180	rugen.exe	rundll32.exe
PID 2180 wrote to memory of 2452	2180	rugen.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe
"C:\Users\Admin\AppData\Local\Temp\497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4833239.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4833239.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3962061.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3962061.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4978460.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4978460.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7799278.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7799278.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4132921.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4132921.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7182530.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7182530.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3368
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8050857.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8050857.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
      "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2180
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1556
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3720
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2464
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "rugen.exe" /P "Admin:N"
        6⤵
        
        PID:2696
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "rugen.exe" /P "Admin:R" /E
        6⤵
        
        PID:2612
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\200f691d32" /P "Admin:N"
        6⤵
        
        PID:4584
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3392
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\200f691d32" /P "Admin:R" /E
        6⤵
        
        PID:4052
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:2452
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7893310.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7893310.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4824

C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
1⤵
- Executes dropped EXE
PID:4168

C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
1⤵
- Executes dropped EXE
PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
2KB

MD5
9b756bc85e5324eb8f87a69e3f9959ab

SHA1
1778b2e2d6a00c421578a284db1e743931611d66

SHA256
e347a39e49ca8c835cc47d3f039230969e7c4156089f2e83e8a0aed1df88016e

SHA512
c897af3307e3c3163762021f49934ac5fbeab27f123e814bc390bdf1f0ed46671afeadcc87a8a4b18ddf13f4abd0d8ef00343af91ff999d7d447c96505d866d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

Filesize
205KB

MD5
d07ba8a664d4975c09c5f3f7466d63b2

SHA1
18000001c51e5ae6331fe0af325ab7afe3be3805

SHA256
b14b683234bd237221ad730c33a2053a7606dcc3396ffc6cb6853f9fdde3123d

SHA512
e0869634f2f3da631dd4584ee0af7c52ea881408434714a3ce5eb5eda39ddf1be94a9418d727950c7db5231c616c8dcaacb3652d28b7069865fbbe18a9639f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

Filesize
205KB

MD5
d07ba8a664d4975c09c5f3f7466d63b2

SHA1
18000001c51e5ae6331fe0af325ab7afe3be3805

SHA256
b14b683234bd237221ad730c33a2053a7606dcc3396ffc6cb6853f9fdde3123d

SHA512
e0869634f2f3da631dd4584ee0af7c52ea881408434714a3ce5eb5eda39ddf1be94a9418d727950c7db5231c616c8dcaacb3652d28b7069865fbbe18a9639f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

Filesize
205KB

MD5
d07ba8a664d4975c09c5f3f7466d63b2

SHA1
18000001c51e5ae6331fe0af325ab7afe3be3805

SHA256
b14b683234bd237221ad730c33a2053a7606dcc3396ffc6cb6853f9fdde3123d

SHA512
e0869634f2f3da631dd4584ee0af7c52ea881408434714a3ce5eb5eda39ddf1be94a9418d727950c7db5231c616c8dcaacb3652d28b7069865fbbe18a9639f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

Filesize
205KB

MD5
d07ba8a664d4975c09c5f3f7466d63b2

SHA1
18000001c51e5ae6331fe0af325ab7afe3be3805

SHA256
b14b683234bd237221ad730c33a2053a7606dcc3396ffc6cb6853f9fdde3123d

SHA512
e0869634f2f3da631dd4584ee0af7c52ea881408434714a3ce5eb5eda39ddf1be94a9418d727950c7db5231c616c8dcaacb3652d28b7069865fbbe18a9639f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

Filesize
205KB

MD5
d07ba8a664d4975c09c5f3f7466d63b2

SHA1
18000001c51e5ae6331fe0af325ab7afe3be3805

SHA256
b14b683234bd237221ad730c33a2053a7606dcc3396ffc6cb6853f9fdde3123d

SHA512
e0869634f2f3da631dd4584ee0af7c52ea881408434714a3ce5eb5eda39ddf1be94a9418d727950c7db5231c616c8dcaacb3652d28b7069865fbbe18a9639f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7893310.exe

Filesize
255KB

MD5
ce0fa4a6a2738ca934076ceee984d8a5

SHA1
f0b082a70cd05730b5da45917145e69ebe7ed5de

SHA256
5109f9343cfb707886f307849cacb4bccf7cc22aca9287acc37226a5d937cef7

SHA512
617504bda52d75f3877e0515f473873c033217d803058f600a46177dcfb440803fd80a3f871d5ad523c7f954f018854b6ed587bfcefbd194e04d30ada1100935

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7893310.exe

Filesize
255KB

MD5
ce0fa4a6a2738ca934076ceee984d8a5

SHA1
f0b082a70cd05730b5da45917145e69ebe7ed5de

SHA256
5109f9343cfb707886f307849cacb4bccf7cc22aca9287acc37226a5d937cef7

SHA512
617504bda52d75f3877e0515f473873c033217d803058f600a46177dcfb440803fd80a3f871d5ad523c7f954f018854b6ed587bfcefbd194e04d30ada1100935

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4833239.exe

Filesize
588KB

MD5
3a77675e8366a62779d5353dda580d3a

SHA1
aef0b123829ddb58ebb140be86bdcc14d7a346ab

SHA256
267450f7e17b8e31771f78e91890bd863d9bb3a9ebb91adf5287f969c4cef46f

SHA512
592017a44f6531dd81ed1067cb403604503a505e8840af4ed5013dc96d6af7fb7c755ffdb65610b3997487ab28090aa320ee8d70146a64d72548fdc958da02aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4833239.exe

Filesize
588KB

MD5
3a77675e8366a62779d5353dda580d3a

SHA1
aef0b123829ddb58ebb140be86bdcc14d7a346ab

SHA256
267450f7e17b8e31771f78e91890bd863d9bb3a9ebb91adf5287f969c4cef46f

SHA512
592017a44f6531dd81ed1067cb403604503a505e8840af4ed5013dc96d6af7fb7c755ffdb65610b3997487ab28090aa320ee8d70146a64d72548fdc958da02aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8050857.exe

Filesize
205KB

MD5
d07ba8a664d4975c09c5f3f7466d63b2

SHA1
18000001c51e5ae6331fe0af325ab7afe3be3805

SHA256
b14b683234bd237221ad730c33a2053a7606dcc3396ffc6cb6853f9fdde3123d

SHA512
e0869634f2f3da631dd4584ee0af7c52ea881408434714a3ce5eb5eda39ddf1be94a9418d727950c7db5231c616c8dcaacb3652d28b7069865fbbe18a9639f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8050857.exe

Filesize
205KB

MD5
d07ba8a664d4975c09c5f3f7466d63b2

SHA1
18000001c51e5ae6331fe0af325ab7afe3be3805

SHA256
b14b683234bd237221ad730c33a2053a7606dcc3396ffc6cb6853f9fdde3123d

SHA512
e0869634f2f3da631dd4584ee0af7c52ea881408434714a3ce5eb5eda39ddf1be94a9418d727950c7db5231c616c8dcaacb3652d28b7069865fbbe18a9639f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3962061.exe

Filesize
416KB

MD5
813fe8ae13a4dab9e3c7e0191a0a4d97

SHA1
4542686f24e1ac4e35c64868ea55ba36addd0ceb

SHA256
11c88e0bbf8da709f505d0808d9b8803a34444000b1de9dfa87378b6795c6afd

SHA512
acce79661b3ce2a1e5b700a26afc9a67bf4501c1161fc0ac8084e1ae4cbb9e83b3d452fad880f04620f437e259e8545602a60c8bd258724c2046796ee7e9595b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3962061.exe

Filesize
416KB

MD5
813fe8ae13a4dab9e3c7e0191a0a4d97

SHA1
4542686f24e1ac4e35c64868ea55ba36addd0ceb

SHA256
11c88e0bbf8da709f505d0808d9b8803a34444000b1de9dfa87378b6795c6afd

SHA512
acce79661b3ce2a1e5b700a26afc9a67bf4501c1161fc0ac8084e1ae4cbb9e83b3d452fad880f04620f437e259e8545602a60c8bd258724c2046796ee7e9595b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7182530.exe

Filesize
172KB

MD5
61f8b015e0f0be1a253e6d1ff61568d8

SHA1
512ee7da17e5f30b06fd9f6c94300af00598aa4e

SHA256
be5f01fabfc4a6eeda42cfe3e043021538134859e0706d85ad7e3f133c2743ea

SHA512
6df11477b4e9a64199a04241a1dd2e395fe1c045ee689b82d3945f8288557c46866454f2529701ed0a1b9a98e0274e163db6eee12e99056e1eb807ef1cdc897f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7182530.exe

Filesize
172KB

MD5
61f8b015e0f0be1a253e6d1ff61568d8

SHA1
512ee7da17e5f30b06fd9f6c94300af00598aa4e

SHA256
be5f01fabfc4a6eeda42cfe3e043021538134859e0706d85ad7e3f133c2743ea

SHA512
6df11477b4e9a64199a04241a1dd2e395fe1c045ee689b82d3945f8288557c46866454f2529701ed0a1b9a98e0274e163db6eee12e99056e1eb807ef1cdc897f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4978460.exe

Filesize
261KB

MD5
becd14a2a888653bbedf2e3b40cf3ffd

SHA1
48e29027f6d29383adad75efa068a202a5cc29ff

SHA256
4e852f7942524676e911909438759e3c984c2caf5b0e576895dfed2eb2863459

SHA512
4c1c01e7904ed6ac7b1fbdd05c2d85040273b1e76924c5f72bae1d6aca384a34ef66fd39f174a1b6112a4f9b1dc7ad81c37bc559ab49433ac1885f4a9f1692e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4978460.exe

Filesize
261KB

MD5
becd14a2a888653bbedf2e3b40cf3ffd

SHA1
48e29027f6d29383adad75efa068a202a5cc29ff

SHA256
4e852f7942524676e911909438759e3c984c2caf5b0e576895dfed2eb2863459

SHA512
4c1c01e7904ed6ac7b1fbdd05c2d85040273b1e76924c5f72bae1d6aca384a34ef66fd39f174a1b6112a4f9b1dc7ad81c37bc559ab49433ac1885f4a9f1692e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7799278.exe

Filesize
255KB

MD5
33569735b87a9c6bebc5632c59197486

SHA1
2ee77cdaa4d4c9b482e43a9df24b85fd24ac00e9

SHA256
e4a50f334784e31370a4a1a4ab6b3fa37ad50f6e2c14192edd9fb074cb5abf06

SHA512
c018531f6b9315e3ac03cd349cf5283ae4d1de112f24167324cf57781551f0901617882f639d63ad1b198a54160541f4b08d5d82a2f99169c5dcc11e5dc0ba21

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7799278.exe

Filesize
255KB

MD5
33569735b87a9c6bebc5632c59197486

SHA1
2ee77cdaa4d4c9b482e43a9df24b85fd24ac00e9

SHA256
e4a50f334784e31370a4a1a4ab6b3fa37ad50f6e2c14192edd9fb074cb5abf06

SHA512
c018531f6b9315e3ac03cd349cf5283ae4d1de112f24167324cf57781551f0901617882f639d63ad1b198a54160541f4b08d5d82a2f99169c5dcc11e5dc0ba21

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7799278.exe

Filesize
255KB

MD5
33569735b87a9c6bebc5632c59197486

SHA1
2ee77cdaa4d4c9b482e43a9df24b85fd24ac00e9

SHA256
e4a50f334784e31370a4a1a4ab6b3fa37ad50f6e2c14192edd9fb074cb5abf06

SHA512
c018531f6b9315e3ac03cd349cf5283ae4d1de112f24167324cf57781551f0901617882f639d63ad1b198a54160541f4b08d5d82a2f99169c5dcc11e5dc0ba21

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4132921.exe

Filesize
94KB

MD5
6842c862d3abeace146bee9bb131c364

SHA1
66432a635c01662a3121c0d0cc7f7d65c86a0701

SHA256
58fc05aa4283ed9854d3d41044a00e39738f5c95732e8117950a700c1be7b297

SHA512
1d43a38ed81795a919f74d4fb6acd70b46b234f14196f44edfb1a9cb8aa40621fbb4642af88d235405dc198334d1d5670e3850011c54dc7cb91b48e3f93f1a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4132921.exe

Filesize
94KB

MD5
6842c862d3abeace146bee9bb131c364

SHA1
66432a635c01662a3121c0d0cc7f7d65c86a0701

SHA256
58fc05aa4283ed9854d3d41044a00e39738f5c95732e8117950a700c1be7b297

SHA512
1d43a38ed81795a919f74d4fb6acd70b46b234f14196f44edfb1a9cb8aa40621fbb4642af88d235405dc198334d1d5670e3850011c54dc7cb91b48e3f93f1a1b

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
83fc14fb36516facb19e0e96286f7f48

SHA1
40082ca06de4c377585cd164fb521bacadb673da

SHA256
08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

SHA512
ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
83fc14fb36516facb19e0e96286f7f48

SHA1
40082ca06de4c377585cd164fb521bacadb673da

SHA256
08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

SHA512
ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
83fc14fb36516facb19e0e96286f7f48

SHA1
40082ca06de4c377585cd164fb521bacadb673da

SHA256
08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

SHA512
ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1548-183-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/3368-193-0x0000000005670000-0x0000000005680000-memory.dmp

Filesize
64KB

Download
memory/3368-192-0x0000000000C90000-0x0000000000CC0000-memory.dmp

Filesize
192KB

Download
memory/4164-166-0x0000000004BF0000-0x0000000004CFA000-memory.dmp

Filesize
1.0MB

Download
memory/4164-171-0x00000000050A0000-0x0000000005132000-memory.dmp

Filesize
584KB

Download
memory/4164-176-0x0000000006670000-0x0000000006B9C000-memory.dmp

Filesize
5.2MB

Download
memory/4164-175-0x0000000006490000-0x0000000006652000-memory.dmp

Filesize
1.8MB

Download
memory/4164-174-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4164-173-0x0000000005850000-0x00000000058B6000-memory.dmp

Filesize
408KB

Download
memory/4164-172-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/4164-177-0x0000000006E70000-0x0000000006EC0000-memory.dmp

Filesize
320KB

Download
memory/4164-161-0x0000000000550000-0x0000000000580000-memory.dmp

Filesize
192KB

Download
memory/4164-165-0x00000000051D0000-0x00000000057E8000-memory.dmp

Filesize
6.1MB

Download
memory/4164-170-0x0000000004F20000-0x0000000004F96000-memory.dmp

Filesize
472KB

Download
memory/4164-169-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4164-168-0x0000000004D40000-0x0000000004D7C000-memory.dmp

Filesize
240KB

Download
memory/4164-167-0x0000000004D20000-0x0000000004D32000-memory.dmp

Filesize
72KB

Download
memory/4824-215-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/4824-211-0x00000000005C0000-0x00000000005F0000-memory.dmp

Filesize
192KB

Download