amadey | 5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe
Size

517KB
MD5

25e2ba0b451e093fa9514de45f114c1a
SHA1

2fbf15dd85cc1d55d9c8919903f6decea7d13a89
SHA256

5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487
SHA512

95eef637f813bb4db02d7d1b641f9db6425d352e29703903ecae34e5cc391ec478ed0832b86a36dabdd94d12ca80a0da30cda26c4e3a6d244c12c77ce41349f6
SSDEEP

6144:K8y+bnr+Fp0yN90QEmo2N7+mB4rZ9t0B6Bh9GZcrcoeagT8D2cmKPPzQITeSTe0F:EMrpy90i6xGZycysbKPMIT1Teg

Score

10^/10

amadey healer redline papik dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

5.42.92.67/norm/index.php

Extracted

Family

redline

Botnet

papik

77.91.124.156:19071

Attributes

auth_value
325a615d8be5db8e2f7a4c2448fdac3a

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016cd0-78.dat	healer
behavioral1/files/0x0007000000016cd0-80.dat	healer
behavioral1/files/0x0007000000016cd0-81.dat	healer
behavioral1/memory/2092-82-0x00000000011B0000-0x00000000011BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p2026611.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p2026611.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p2026611.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p2026611.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p2026611.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p2026611.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 9 IoCs

pid	Process
320	z4446453.exe
2660	z3952456.exe
2092	p2026611.exe
2940	r6576991.exe
2972	legola.exe
2888	s1724315.exe
2980	legola.exe
1900	legola.exe
876	legola.exe

Loads dropped DLL 11 IoCs

pid	Process
1260	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe
320	z4446453.exe
320	z4446453.exe
2660	z3952456.exe
2660	z3952456.exe
2660	z3952456.exe
2940	r6576991.exe
2940	r6576991.exe
2972	legola.exe
320	z4446453.exe
2888	s1724315.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	p2026611.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p2026611.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4446453.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z3952456.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	p2026611.exe
2092	p2026611.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	p2026611.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	r6576991.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 320	1260	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe	28
PID 1260 wrote to memory of 320	1260	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe	28
PID 1260 wrote to memory of 320	1260	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe	28
PID 1260 wrote to memory of 320	1260	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe	28
PID 1260 wrote to memory of 320	1260	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe	28
PID 1260 wrote to memory of 320	1260	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe	28
PID 1260 wrote to memory of 320	1260	5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe	28
PID 320 wrote to memory of 2660	320	z4446453.exe	29
PID 320 wrote to memory of 2660	320	z4446453.exe	29
PID 320 wrote to memory of 2660	320	z4446453.exe	29
PID 320 wrote to memory of 2660	320	z4446453.exe	29
PID 320 wrote to memory of 2660	320	z4446453.exe	29
PID 320 wrote to memory of 2660	320	z4446453.exe	29
PID 320 wrote to memory of 2660	320	z4446453.exe	29
PID 2660 wrote to memory of 2092	2660	z3952456.exe	30
PID 2660 wrote to memory of 2092	2660	z3952456.exe	30
PID 2660 wrote to memory of 2092	2660	z3952456.exe	30
PID 2660 wrote to memory of 2092	2660	z3952456.exe	30
PID 2660 wrote to memory of 2092	2660	z3952456.exe	30
PID 2660 wrote to memory of 2092	2660	z3952456.exe	30
PID 2660 wrote to memory of 2092	2660	z3952456.exe	30
PID 2660 wrote to memory of 2940	2660	z3952456.exe	31
PID 2660 wrote to memory of 2940	2660	z3952456.exe	31
PID 2660 wrote to memory of 2940	2660	z3952456.exe	31
PID 2660 wrote to memory of 2940	2660	z3952456.exe	31
PID 2660 wrote to memory of 2940	2660	z3952456.exe	31
PID 2660 wrote to memory of 2940	2660	z3952456.exe	31
PID 2660 wrote to memory of 2940	2660	z3952456.exe	31
PID 2940 wrote to memory of 2972	2940	r6576991.exe	32
PID 2940 wrote to memory of 2972	2940	r6576991.exe	32
PID 2940 wrote to memory of 2972	2940	r6576991.exe	32
PID 2940 wrote to memory of 2972	2940	r6576991.exe	32
PID 2940 wrote to memory of 2972	2940	r6576991.exe	32
PID 2940 wrote to memory of 2972	2940	r6576991.exe	32
PID 2940 wrote to memory of 2972	2940	r6576991.exe	32
PID 2972 wrote to memory of 2856	2972	legola.exe	34
PID 2972 wrote to memory of 2856	2972	legola.exe	34
PID 2972 wrote to memory of 2856	2972	legola.exe	34
PID 2972 wrote to memory of 2856	2972	legola.exe	34
PID 2972 wrote to memory of 2856	2972	legola.exe	34
PID 2972 wrote to memory of 2856	2972	legola.exe	34
PID 2972 wrote to memory of 2856	2972	legola.exe	34
PID 320 wrote to memory of 2888	320	z4446453.exe	33
PID 320 wrote to memory of 2888	320	z4446453.exe	33
PID 320 wrote to memory of 2888	320	z4446453.exe	33
PID 320 wrote to memory of 2888	320	z4446453.exe	33
PID 320 wrote to memory of 2888	320	z4446453.exe	33
PID 320 wrote to memory of 2888	320	z4446453.exe	33
PID 320 wrote to memory of 2888	320	z4446453.exe	33
PID 2972 wrote to memory of 2708	2972	legola.exe	36
PID 2972 wrote to memory of 2708	2972	legola.exe	36
PID 2972 wrote to memory of 2708	2972	legola.exe	36
PID 2972 wrote to memory of 2708	2972	legola.exe	36
PID 2972 wrote to memory of 2708	2972	legola.exe	36
PID 2972 wrote to memory of 2708	2972	legola.exe	36
PID 2972 wrote to memory of 2708	2972	legola.exe	36
PID 2708 wrote to memory of 2764	2708	cmd.exe	38
PID 2708 wrote to memory of 2764	2708	cmd.exe	38
PID 2708 wrote to memory of 2764	2708	cmd.exe	38
PID 2708 wrote to memory of 2764	2708	cmd.exe	38
PID 2708 wrote to memory of 2764	2708	cmd.exe	38
PID 2708 wrote to memory of 2764	2708	cmd.exe	38
PID 2708 wrote to memory of 2764	2708	cmd.exe	38
PID 2708 wrote to memory of 2324	2708	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487exe_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4446453.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4446453.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3952456.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3952456.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p2026611.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p2026611.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r6576991.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r6576991.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2856
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        7⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        7⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        7⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        7⤵
        
        PID:1488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724315.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724315.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2888

C:\Windows\system32\taskeng.exe
taskeng.exe {D8DCA143-D00B-4EF9-8EF5-6F9EC7E8428B} S-1-5-21-377084978-2088738870-2818360375-1000:DSWJWADP\Admin:Interactive:[1]
1⤵
PID:2160
- C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
  C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
  C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
  C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
  2⤵
  - Executes dropped EXE
  PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4446453.exe

Filesize
390KB

MD5
6d9051b230d6842c359bb97c7da3b4b1

SHA1
eb2733e22ff4ab43d3daf2f3668e34b1a8600192

SHA256
695c2d3207b24c56ca4f2593190eea0fb189f8788f61792e227509e50c4993d9

SHA512
4fe5ae48a8859f5e74fb7508fd9de3f0025863b34382dd39f606ab41c923296bd599bc77b3b0108f45d441a15670ec5cf6cde316721d75f88046138d49e8d279

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4446453.exe

Filesize
390KB

MD5
6d9051b230d6842c359bb97c7da3b4b1

SHA1
eb2733e22ff4ab43d3daf2f3668e34b1a8600192

SHA256
695c2d3207b24c56ca4f2593190eea0fb189f8788f61792e227509e50c4993d9

SHA512
4fe5ae48a8859f5e74fb7508fd9de3f0025863b34382dd39f606ab41c923296bd599bc77b3b0108f45d441a15670ec5cf6cde316721d75f88046138d49e8d279

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724315.exe

Filesize
173KB

MD5
ef82df00cd2bc660e2c532619272becf

SHA1
ef8ca907485118d08967c8175d74e221ad0c3335

SHA256
8657b2de5805de7e7c152b30bd49cb9554667d41e956d4e8fc91993901d7b554

SHA512
c15fd880850765d196eb0e1b78093a242001c7f9f533ac47cbfc4ac3506fb323fa8c73f88ced7ba162a5f19e27f4ae82aa12d9d15baa67143b2055e37e7a0baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724315.exe

Filesize
173KB

MD5
ef82df00cd2bc660e2c532619272becf

SHA1
ef8ca907485118d08967c8175d74e221ad0c3335

SHA256
8657b2de5805de7e7c152b30bd49cb9554667d41e956d4e8fc91993901d7b554

SHA512
c15fd880850765d196eb0e1b78093a242001c7f9f533ac47cbfc4ac3506fb323fa8c73f88ced7ba162a5f19e27f4ae82aa12d9d15baa67143b2055e37e7a0baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3952456.exe

Filesize
234KB

MD5
c4d10840779adc414ee96f1b5ffdb124

SHA1
5853ecf8cfbc8ec4df0bf2e93cd8de95f3b56ef2

SHA256
23a874a9a04f7dc908011c13a0bf25f7707798549e965c813e721ecac423d2ed

SHA512
ecd7485fbd1eee78b50e10fbd609c005e95554ea647a8f6b7e6505870ac40db3790f87edfd765b64b72f3e2567e791a06150c836faa6c07a656395800fe5b389

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3952456.exe

Filesize
234KB

MD5
c4d10840779adc414ee96f1b5ffdb124

SHA1
5853ecf8cfbc8ec4df0bf2e93cd8de95f3b56ef2

SHA256
23a874a9a04f7dc908011c13a0bf25f7707798549e965c813e721ecac423d2ed

SHA512
ecd7485fbd1eee78b50e10fbd609c005e95554ea647a8f6b7e6505870ac40db3790f87edfd765b64b72f3e2567e791a06150c836faa6c07a656395800fe5b389

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p2026611.exe

Filesize
11KB

MD5
55218d8e1e5cdb61ae6befbdc9512a10

SHA1
3ea09ee21a9bcbd34259ceb6e0557593c156e15f

SHA256
ebb183b3653aa1c44e8e1205767f4a8e38b219003a3c58cff8d2d59d6342cb4b

SHA512
d3e463aa4dbca9d0bb91606296551013e32c5749fab8ecefaee6d98067143eee846a0ecd477307feed5547c182649468be316e6295963ae6a8ec85f860d92a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p2026611.exe

Filesize
11KB

MD5
55218d8e1e5cdb61ae6befbdc9512a10

SHA1
3ea09ee21a9bcbd34259ceb6e0557593c156e15f

SHA256
ebb183b3653aa1c44e8e1205767f4a8e38b219003a3c58cff8d2d59d6342cb4b

SHA512
d3e463aa4dbca9d0bb91606296551013e32c5749fab8ecefaee6d98067143eee846a0ecd477307feed5547c182649468be316e6295963ae6a8ec85f860d92a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r6576991.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r6576991.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4446453.exe

Filesize
390KB

MD5
6d9051b230d6842c359bb97c7da3b4b1

SHA1
eb2733e22ff4ab43d3daf2f3668e34b1a8600192

SHA256
695c2d3207b24c56ca4f2593190eea0fb189f8788f61792e227509e50c4993d9

SHA512
4fe5ae48a8859f5e74fb7508fd9de3f0025863b34382dd39f606ab41c923296bd599bc77b3b0108f45d441a15670ec5cf6cde316721d75f88046138d49e8d279

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4446453.exe

Filesize
390KB

MD5
6d9051b230d6842c359bb97c7da3b4b1

SHA1
eb2733e22ff4ab43d3daf2f3668e34b1a8600192

SHA256
695c2d3207b24c56ca4f2593190eea0fb189f8788f61792e227509e50c4993d9

SHA512
4fe5ae48a8859f5e74fb7508fd9de3f0025863b34382dd39f606ab41c923296bd599bc77b3b0108f45d441a15670ec5cf6cde316721d75f88046138d49e8d279

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724315.exe

Filesize
173KB

MD5
ef82df00cd2bc660e2c532619272becf

SHA1
ef8ca907485118d08967c8175d74e221ad0c3335

SHA256
8657b2de5805de7e7c152b30bd49cb9554667d41e956d4e8fc91993901d7b554

SHA512
c15fd880850765d196eb0e1b78093a242001c7f9f533ac47cbfc4ac3506fb323fa8c73f88ced7ba162a5f19e27f4ae82aa12d9d15baa67143b2055e37e7a0baa

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724315.exe

Filesize
173KB

MD5
ef82df00cd2bc660e2c532619272becf

SHA1
ef8ca907485118d08967c8175d74e221ad0c3335

SHA256
8657b2de5805de7e7c152b30bd49cb9554667d41e956d4e8fc91993901d7b554

SHA512
c15fd880850765d196eb0e1b78093a242001c7f9f533ac47cbfc4ac3506fb323fa8c73f88ced7ba162a5f19e27f4ae82aa12d9d15baa67143b2055e37e7a0baa

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3952456.exe

Filesize
234KB

MD5
c4d10840779adc414ee96f1b5ffdb124

SHA1
5853ecf8cfbc8ec4df0bf2e93cd8de95f3b56ef2

SHA256
23a874a9a04f7dc908011c13a0bf25f7707798549e965c813e721ecac423d2ed

SHA512
ecd7485fbd1eee78b50e10fbd609c005e95554ea647a8f6b7e6505870ac40db3790f87edfd765b64b72f3e2567e791a06150c836faa6c07a656395800fe5b389

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3952456.exe

Filesize
234KB

MD5
c4d10840779adc414ee96f1b5ffdb124

SHA1
5853ecf8cfbc8ec4df0bf2e93cd8de95f3b56ef2

SHA256
23a874a9a04f7dc908011c13a0bf25f7707798549e965c813e721ecac423d2ed

SHA512
ecd7485fbd1eee78b50e10fbd609c005e95554ea647a8f6b7e6505870ac40db3790f87edfd765b64b72f3e2567e791a06150c836faa6c07a656395800fe5b389

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\p2026611.exe

Filesize
11KB

MD5
55218d8e1e5cdb61ae6befbdc9512a10

SHA1
3ea09ee21a9bcbd34259ceb6e0557593c156e15f

SHA256
ebb183b3653aa1c44e8e1205767f4a8e38b219003a3c58cff8d2d59d6342cb4b

SHA512
d3e463aa4dbca9d0bb91606296551013e32c5749fab8ecefaee6d98067143eee846a0ecd477307feed5547c182649468be316e6295963ae6a8ec85f860d92a17

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\r6576991.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\r6576991.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
d08d74a6f008828ef403cadb806a59b1

SHA1
2d8f0d91d9367b580bb73098d3beec80156e69db

SHA256
f436848da4238143e8c1b84ac5d57d68e9683b31c7409eb8ed1a2b3d204d9c7c

SHA512
d2788faec217d573d99beadc21125e2b6fb77f6f7163a9c51acc03c9ab00e704b1787453053aca1e1114f823ced20ae8410969418781dc26d13f5cdc073e47ce

Download Submit
memory/2092-86-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-83-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-82-0x00000000011B0000-0x00000000011BA000-memory.dmp

Filesize
40KB

Download
memory/2888-107-0x00000000010E0000-0x0000000001110000-memory.dmp

Filesize
192KB

Download
memory/2888-108-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download