amadey | 718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2023 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe
Size

517KB
MD5

4ab7f178296f4e4dc60cdaa2c6c57da3
SHA1

3c1ffc4be88c39ef5cb2bc1e0c3e04083cf1a83b
SHA256

718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159
SHA512

3810bc1ace8f239cffcecd9db2c0254d787230391e183167fc70acca62d4420a3a162f120f1f383cfa8eb7558fe1a5e3d51e36272af12c4b8c5c8d01e1bb630c
SSDEEP

6144:Kpy+bnr+/p0yN90QE0cQjMzxw9xAjiklSPmfgy48ZIpV5rnVb0cJj5XTvZoaqWxM:DMrvy90KcZw8j9bn4nV355tojeU5F

Score

10^/10

amadey healer redline papik dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

5.42.92.67/norm/index.php

Extracted

Family

redline

Botnet

papik

77.91.124.156:19071

Attributes

auth_value
325a615d8be5db8e2f7a4c2448fdac3a

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe	healer
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe	healer
behavioral2/memory/1756-154-0x0000000000510000-0x000000000051A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

p6253433.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p6253433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p6253433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p6253433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p6253433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p6253433.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p6253433.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 9 IoCs

Processes:

z6719019.exez2931287.exep6253433.exer7420459.exelegola.exes5025783.exelegola.exelegola.exelegola.exe

pid process

3368 z6719019.exe
4792 z2931287.exe
1756 p6253433.exe
3920 r7420459.exe
4456 legola.exe
3364 s5025783.exe
3440 legola.exe
4948 legola.exe
2816 legola.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

p6253433.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p6253433.exe

pid	process
3368	z6719019.exe
4792	z2931287.exe
1756	p6253433.exe
3920	r7420459.exe
4456	legola.exe
3364	s5025783.exe
3440	legola.exe
4948	legola.exe
2816	legola.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p6253433.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exez6719019.exez2931287.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6719019.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2931287.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4952 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4868 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

p6253433.exe

pid process

1756 p6253433.exe
1756 p6253433.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

p6253433.exe

description pid process

Token: SeDebugPrivilege 1756 p6253433.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

r7420459.exe

pid process

3920 r7420459.exe

pid	process
4952	sc.exe

pid	process
4868	schtasks.exe

pid	process
1756	p6253433.exe
1756	p6253433.exe

description	pid	process
Token: SeDebugPrivilege	1756	p6253433.exe

pid	process
3920	r7420459.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exez6719019.exez2931287.exer7420459.exelegola.execmd.exe

description	pid	process	target process
PID 2232 wrote to memory of 3368	2232	718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe	z6719019.exe
PID 2232 wrote to memory of 3368	2232	718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe	z6719019.exe
PID 2232 wrote to memory of 3368	2232	718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe	z6719019.exe
PID 3368 wrote to memory of 4792	3368	z6719019.exe	z2931287.exe
PID 3368 wrote to memory of 4792	3368	z6719019.exe	z2931287.exe
PID 3368 wrote to memory of 4792	3368	z6719019.exe	z2931287.exe
PID 4792 wrote to memory of 1756	4792	z2931287.exe	p6253433.exe
PID 4792 wrote to memory of 1756	4792	z2931287.exe	p6253433.exe
PID 4792 wrote to memory of 3920	4792	z2931287.exe	r7420459.exe
PID 4792 wrote to memory of 3920	4792	z2931287.exe	r7420459.exe
PID 4792 wrote to memory of 3920	4792	z2931287.exe	r7420459.exe
PID 3920 wrote to memory of 4456	3920	r7420459.exe	legola.exe
PID 3920 wrote to memory of 4456	3920	r7420459.exe	legola.exe
PID 3920 wrote to memory of 4456	3920	r7420459.exe	legola.exe
PID 3368 wrote to memory of 3364	3368	z6719019.exe	s5025783.exe
PID 3368 wrote to memory of 3364	3368	z6719019.exe	s5025783.exe
PID 3368 wrote to memory of 3364	3368	z6719019.exe	s5025783.exe
PID 4456 wrote to memory of 4868	4456	legola.exe	schtasks.exe
PID 4456 wrote to memory of 4868	4456	legola.exe	schtasks.exe
PID 4456 wrote to memory of 4868	4456	legola.exe	schtasks.exe
PID 4456 wrote to memory of 4936	4456	legola.exe	cmd.exe
PID 4456 wrote to memory of 4936	4456	legola.exe	cmd.exe
PID 4456 wrote to memory of 4936	4456	legola.exe	cmd.exe
PID 4936 wrote to memory of 4916	4936	cmd.exe	cmd.exe
PID 4936 wrote to memory of 4916	4936	cmd.exe	cmd.exe
PID 4936 wrote to memory of 4916	4936	cmd.exe	cmd.exe
PID 4936 wrote to memory of 4520	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 4520	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 4520	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3860	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3860	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3860	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3676	4936	cmd.exe	cmd.exe
PID 4936 wrote to memory of 3676	4936	cmd.exe	cmd.exe
PID 4936 wrote to memory of 3676	4936	cmd.exe	cmd.exe
PID 4936 wrote to memory of 3772	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3772	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3772	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3320	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3320	4936	cmd.exe	cacls.exe
PID 4936 wrote to memory of 3320	4936	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2232

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6719019.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6719019.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3368

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2931287.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2931287.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4792

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7420459.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7420459.exe
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3920

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
6⤵
- Creates scheduled task(s)
PID:4868

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4916

C:\Windows\SysWOW64\cacls.exe
CACLS "legola.exe" /P "Admin:N"
7⤵
PID:4520

C:\Windows\SysWOW64\cacls.exe
CACLS "legola.exe" /P "Admin:R" /E
7⤵
PID:3860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3676

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ebb444342c" /P "Admin:N"
7⤵
PID:3772

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ebb444342c" /P "Admin:R" /E
7⤵
PID:3320

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5025783.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5025783.exe
3⤵
- Executes dropped EXE
PID:3364

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3440

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:2816

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4952

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6719019.exe
Filesize
389KB

MD5
3172b68d5b2bb294b2fd14e1d59c44aa

SHA1
ac2c7520d4261e79a1207157b28bdcbab485eba3

SHA256
dd6b12f72f542c172e156771150d051f0e7fa9ac4defdd84cb7ff6e476e72a78

SHA512
bdf0b0ff58829d8eae011b6ddafe6f41b5a02cef656a4b172c7746e71866319cb2f81b03782bf0064c7616599f7de80eedeaa847f3fd683c3aaf33640b31828f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6719019.exe
Filesize
389KB

MD5
3172b68d5b2bb294b2fd14e1d59c44aa

SHA1
ac2c7520d4261e79a1207157b28bdcbab485eba3

SHA256
dd6b12f72f542c172e156771150d051f0e7fa9ac4defdd84cb7ff6e476e72a78

SHA512
bdf0b0ff58829d8eae011b6ddafe6f41b5a02cef656a4b172c7746e71866319cb2f81b03782bf0064c7616599f7de80eedeaa847f3fd683c3aaf33640b31828f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5025783.exe
Filesize
173KB

MD5
fa4886b5da3cd7fefea2a49c7ca1d0ea

SHA1
2701da193294c92665e8d4e9a59cfb5487f979ce

SHA256
51786be675bc0b5bc9eaef4bc8bc82d5d2ad89a9609442c06e3c3b918d52459d

SHA512
f48e4ee4a6cc33458067453090b423aec4b13a110138e647918ab6d2938a094174aae2da0e0c3a10d720ae5afa16832f20793aba2b223e708897ab87d492031c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5025783.exe
Filesize
173KB

MD5
fa4886b5da3cd7fefea2a49c7ca1d0ea

SHA1
2701da193294c92665e8d4e9a59cfb5487f979ce

SHA256
51786be675bc0b5bc9eaef4bc8bc82d5d2ad89a9609442c06e3c3b918d52459d

SHA512
f48e4ee4a6cc33458067453090b423aec4b13a110138e647918ab6d2938a094174aae2da0e0c3a10d720ae5afa16832f20793aba2b223e708897ab87d492031c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2931287.exe
Filesize
234KB

MD5
3e93fb5ac4bdf6d08ee89535300d44c6

SHA1
544e47ddb6285698e534577a6be7ffb14827dd74

SHA256
3b1fefdf2dc33007b68372954df0558d742762024f99e96040c2bbf0cd3d05b5

SHA512
245a849ce2792a7a976cf75b90690c50dd7625156dc81190fbec7c1f27f12e7be70ef029c536e15146825b0a59495e7b21dbce79382b41a8d57cd6b26f9c613b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2931287.exe
Filesize
234KB

MD5
3e93fb5ac4bdf6d08ee89535300d44c6

SHA1
544e47ddb6285698e534577a6be7ffb14827dd74

SHA256
3b1fefdf2dc33007b68372954df0558d742762024f99e96040c2bbf0cd3d05b5

SHA512
245a849ce2792a7a976cf75b90690c50dd7625156dc81190fbec7c1f27f12e7be70ef029c536e15146825b0a59495e7b21dbce79382b41a8d57cd6b26f9c613b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe
Filesize
11KB

MD5
51e67270a039039a4c132037e36ad611

SHA1
3c454da773aa33952510c9c73e9ee562677bf7f7

SHA256
738a535843cdf78cca4d3d1134f5ebcc25ef26f1b878aa83564fca383f7f48d9

SHA512
e1b72101c3980b1abdf17c3c9431a5696f05aaf6603fe31c9b20bf4e6fa5bfd169817ed3e153dab076fe15305e1632d0a265e1d3e80943e211f40fc1f20c87ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe
Filesize
11KB

MD5
51e67270a039039a4c132037e36ad611

SHA1
3c454da773aa33952510c9c73e9ee562677bf7f7

SHA256
738a535843cdf78cca4d3d1134f5ebcc25ef26f1b878aa83564fca383f7f48d9

SHA512
e1b72101c3980b1abdf17c3c9431a5696f05aaf6603fe31c9b20bf4e6fa5bfd169817ed3e153dab076fe15305e1632d0a265e1d3e80943e211f40fc1f20c87ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7420459.exe
Filesize
225KB

MD5
572bc3b41caabb31ace07045cb818787

SHA1
a8d07a2e54aee722e50a89043f69826804e41af1

SHA256
c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a

SHA512
a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7420459.exe
Filesize
225KB

MD5
572bc3b41caabb31ace07045cb818787

SHA1
a8d07a2e54aee722e50a89043f69826804e41af1

SHA256
c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a

SHA512
a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
572bc3b41caabb31ace07045cb818787

SHA1
a8d07a2e54aee722e50a89043f69826804e41af1

SHA256
c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a

SHA512
a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
572bc3b41caabb31ace07045cb818787

SHA1
a8d07a2e54aee722e50a89043f69826804e41af1

SHA256
c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a

SHA512
a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
572bc3b41caabb31ace07045cb818787

SHA1
a8d07a2e54aee722e50a89043f69826804e41af1

SHA256
c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a

SHA512
a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
572bc3b41caabb31ace07045cb818787

SHA1
a8d07a2e54aee722e50a89043f69826804e41af1

SHA256
c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a

SHA512
a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
572bc3b41caabb31ace07045cb818787

SHA1
a8d07a2e54aee722e50a89043f69826804e41af1

SHA256
c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a

SHA512
a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
572bc3b41caabb31ace07045cb818787

SHA1
a8d07a2e54aee722e50a89043f69826804e41af1

SHA256
c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a

SHA512
a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc

Download Submit
memory/1756-155-0x00007FFC015F0000-0x00007FFC020B1000-memory.dmp

Filesize
10.8MB

Download
memory/1756-157-0x00007FFC015F0000-0x00007FFC020B1000-memory.dmp

Filesize
10.8MB

Download
memory/1756-154-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/3364-175-0x0000000073B10000-0x00000000742C0000-memory.dmp

Filesize
7.7MB

Download
memory/3364-176-0x0000000005900000-0x0000000005F18000-memory.dmp

Filesize
6.1MB

Download
memory/3364-177-0x00000000053F0000-0x00000000054FA000-memory.dmp

Filesize
1.0MB

Download
memory/3364-179-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/3364-178-0x00000000052A0000-0x00000000052B2000-memory.dmp

Filesize
72KB

Download
memory/3364-180-0x0000000005320000-0x000000000535C000-memory.dmp

Filesize
240KB

Download
memory/3364-174-0x00000000007E0000-0x0000000000810000-memory.dmp

Filesize
192KB

Download
memory/3364-182-0x0000000073B10000-0x00000000742C0000-memory.dmp

Filesize
7.7MB

Download
memory/3364-183-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download