amadey | bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2023 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exe
Size

517KB
MD5

cea342a1376b4a54cd73d443ac13e4dc
SHA1

5b6c97b7d29f6caac4af78534d1056426e0a6bcc
SHA256

bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735
SHA512

b279e9f7b15eda10028a9d1351b05dd09a551749694c491dba312f7c84439df4d9057421ab8a9049dd15314577702130d1157d8686f3893c76bef7019ae23fd8
SSDEEP

12288:tMrVy90d1J2GtaKALStJnFAbjwsZH2Dj:UyQKGUKA61FAb/ZW3

Score

10^/10

amadey healer redline papik dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

5.42.92.67/norm/index.php

Extracted

Family

redline

Botnet

papik

77.91.124.156:19071

Attributes

auth_value
325a615d8be5db8e2f7a4c2448fdac3a

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0145078.exe	healer
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0145078.exe	healer
behavioral2/memory/4324-154-0x0000000000F10000-0x0000000000F1A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

p0145078.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p0145078.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p0145078.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p0145078.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p0145078.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p0145078.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p0145078.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 8 IoCs

Processes:

z9227226.exez8769550.exep0145078.exer1306343.exelegola.exes1724712.exelegola.exelegola.exe

pid process

1296 z9227226.exe
3764 z8769550.exe
4324 p0145078.exe
2112 r1306343.exe
4176 legola.exe
220 s1724712.exe
1240 legola.exe
3644 legola.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

p0145078.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p0145078.exe

pid	process
1296	z9227226.exe
3764	z8769550.exe
4324	p0145078.exe
2112	r1306343.exe
4176	legola.exe
220	s1724712.exe
1240	legola.exe
3644	legola.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p0145078.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exez9227226.exez8769550.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9227226.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z8769550.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3228 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

p0145078.exe

pid process

4324 p0145078.exe
4324 p0145078.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

p0145078.exe

description pid process

Token: SeDebugPrivilege 4324 p0145078.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

r1306343.exe

pid process

2112 r1306343.exe

pid	process
3228	schtasks.exe

pid	process
4324	p0145078.exe
4324	p0145078.exe

description	pid	process
Token: SeDebugPrivilege	4324	p0145078.exe

pid	process
2112	r1306343.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exez9227226.exez8769550.exer1306343.exelegola.execmd.exe

description	pid	process	target process
PID 1820 wrote to memory of 1296	1820	bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exe	z9227226.exe
PID 1820 wrote to memory of 1296	1820	bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exe	z9227226.exe
PID 1820 wrote to memory of 1296	1820	bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exe	z9227226.exe
PID 1296 wrote to memory of 3764	1296	z9227226.exe	z8769550.exe
PID 1296 wrote to memory of 3764	1296	z9227226.exe	z8769550.exe
PID 1296 wrote to memory of 3764	1296	z9227226.exe	z8769550.exe
PID 3764 wrote to memory of 4324	3764	z8769550.exe	p0145078.exe
PID 3764 wrote to memory of 4324	3764	z8769550.exe	p0145078.exe
PID 3764 wrote to memory of 2112	3764	z8769550.exe	r1306343.exe
PID 3764 wrote to memory of 2112	3764	z8769550.exe	r1306343.exe
PID 3764 wrote to memory of 2112	3764	z8769550.exe	r1306343.exe
PID 2112 wrote to memory of 4176	2112	r1306343.exe	legola.exe
PID 2112 wrote to memory of 4176	2112	r1306343.exe	legola.exe
PID 2112 wrote to memory of 4176	2112	r1306343.exe	legola.exe
PID 1296 wrote to memory of 220	1296	z9227226.exe	s1724712.exe
PID 1296 wrote to memory of 220	1296	z9227226.exe	s1724712.exe
PID 1296 wrote to memory of 220	1296	z9227226.exe	s1724712.exe
PID 4176 wrote to memory of 3228	4176	legola.exe	schtasks.exe
PID 4176 wrote to memory of 3228	4176	legola.exe	schtasks.exe
PID 4176 wrote to memory of 3228	4176	legola.exe	schtasks.exe
PID 4176 wrote to memory of 2984	4176	legola.exe	cmd.exe
PID 4176 wrote to memory of 2984	4176	legola.exe	cmd.exe
PID 4176 wrote to memory of 2984	4176	legola.exe	cmd.exe
PID 2984 wrote to memory of 3404	2984	cmd.exe	cmd.exe
PID 2984 wrote to memory of 3404	2984	cmd.exe	cmd.exe
PID 2984 wrote to memory of 3404	2984	cmd.exe	cmd.exe
PID 2984 wrote to memory of 872	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 872	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 872	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 1100	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 1100	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 1100	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 2260	2984	cmd.exe	cmd.exe
PID 2984 wrote to memory of 2260	2984	cmd.exe	cmd.exe
PID 2984 wrote to memory of 2260	2984	cmd.exe	cmd.exe
PID 2984 wrote to memory of 4288	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 4288	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 4288	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 392	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 392	2984	cmd.exe	cacls.exe
PID 2984 wrote to memory of 392	2984	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735exe_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1820

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9227226.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9227226.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1296

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8769550.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8769550.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3764

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0145078.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0145078.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1306343.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1306343.exe
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2112

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
6⤵
- Creates scheduled task(s)
PID:3228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3404

C:\Windows\SysWOW64\cacls.exe
CACLS "legola.exe" /P "Admin:N"
7⤵
PID:872

C:\Windows\SysWOW64\cacls.exe
CACLS "legola.exe" /P "Admin:R" /E
7⤵
PID:1100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:2260

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ebb444342c" /P "Admin:N"
7⤵
PID:4288

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ebb444342c" /P "Admin:R" /E
7⤵
PID:392

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724712.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724712.exe
3⤵
- Executes dropped EXE
PID:220

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:1240

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9227226.exe
Filesize
390KB

MD5
b483f5c27876d00ecfacb2d878d39b17

SHA1
2ed219b09c5ca0799c5fdfc2d8df782156988cc8

SHA256
fd421778c46c09993406c5e000b97ff43fe737d8a739287ded01e8bf1557d4e0

SHA512
48bcc26f9717233dc8e37aa0adad4420ca33b728c2579702a9ae4d4bac93f318165a45f142fa22223c1a3cc9f3dc75b180c5452227ff93f24a52f4770e9b79ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9227226.exe
Filesize
390KB

MD5
b483f5c27876d00ecfacb2d878d39b17

SHA1
2ed219b09c5ca0799c5fdfc2d8df782156988cc8

SHA256
fd421778c46c09993406c5e000b97ff43fe737d8a739287ded01e8bf1557d4e0

SHA512
48bcc26f9717233dc8e37aa0adad4420ca33b728c2579702a9ae4d4bac93f318165a45f142fa22223c1a3cc9f3dc75b180c5452227ff93f24a52f4770e9b79ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724712.exe
Filesize
174KB

MD5
d6f4044fdb27b4a3814530f9eddc9863

SHA1
bfdc999ac6fdb4c0552cda2a7bf65665d9f22e08

SHA256
0f100c3ad6ffc2351ce0ccc2a9e6eb93ea0d3853c5d18410908a46d6d8e11500

SHA512
ef5652fe0467aa5e4e53072bc7af340511fa16b540500770ec6e6fc0c9bbf1f455f220601a406f71f4d3c12fe66330361f9cab5a590ec4a612a018aaeac63422

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1724712.exe
Filesize
174KB

MD5
d6f4044fdb27b4a3814530f9eddc9863

SHA1
bfdc999ac6fdb4c0552cda2a7bf65665d9f22e08

SHA256
0f100c3ad6ffc2351ce0ccc2a9e6eb93ea0d3853c5d18410908a46d6d8e11500

SHA512
ef5652fe0467aa5e4e53072bc7af340511fa16b540500770ec6e6fc0c9bbf1f455f220601a406f71f4d3c12fe66330361f9cab5a590ec4a612a018aaeac63422

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8769550.exe
Filesize
234KB

MD5
8c8d12c41ce43a06afd8c51a2ba14a89

SHA1
68714a31d85215970a49852da66f667d6071cd14

SHA256
373d51f23b2b73a99e2571d91d701fb67e1be8f6687dd7d5c0b9a520ca2563d8

SHA512
7a51288f631df3e70973c54d07e1eff5c6f5eda1eb899508627b4d16ac686ccc530358c1f43d598d6bc26458eaf4c17d33e9c3b00497a75af0815d7e75541363

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8769550.exe
Filesize
234KB

MD5
8c8d12c41ce43a06afd8c51a2ba14a89

SHA1
68714a31d85215970a49852da66f667d6071cd14

SHA256
373d51f23b2b73a99e2571d91d701fb67e1be8f6687dd7d5c0b9a520ca2563d8

SHA512
7a51288f631df3e70973c54d07e1eff5c6f5eda1eb899508627b4d16ac686ccc530358c1f43d598d6bc26458eaf4c17d33e9c3b00497a75af0815d7e75541363

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0145078.exe
Filesize
11KB

MD5
56b4a852b461d855ac1977f83b55a208

SHA1
47232acb7c0b43569d0266809dba961f0eff623e

SHA256
f587605f62a8f7e8e8082f8859603266c4e23b78be929f9f7f4ab21757174184

SHA512
55c36e5bad0d021f573a566618dac977a49f6342f6feb139f083ed16f5f8649b6777edc3b473784d9c4c14252cd4dd64fbdfb9bae9fcd6b4b2896e96fd9df482

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0145078.exe
Filesize
11KB

MD5
56b4a852b461d855ac1977f83b55a208

SHA1
47232acb7c0b43569d0266809dba961f0eff623e

SHA256
f587605f62a8f7e8e8082f8859603266c4e23b78be929f9f7f4ab21757174184

SHA512
55c36e5bad0d021f573a566618dac977a49f6342f6feb139f083ed16f5f8649b6777edc3b473784d9c4c14252cd4dd64fbdfb9bae9fcd6b4b2896e96fd9df482

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1306343.exe
Filesize
225KB

MD5
e931c96b120d7eeab4a1ee796b205576

SHA1
8f9c69cf6e574dfdad0fb1a04685b0c3f6bae51f

SHA256
c8957cf83194ea0307b1368782a6cb3a217206c394a96a3dd83f27ee895ce5f2

SHA512
850b35591e8b672150866db4ebd2783ae02c83bb75607c1e36575b993407402deb0cb0ef9a88c08a48b9ac54f26d9e8191d3035ad177ec207e01a81e6e67089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1306343.exe
Filesize
225KB

MD5
e931c96b120d7eeab4a1ee796b205576

SHA1
8f9c69cf6e574dfdad0fb1a04685b0c3f6bae51f

SHA256
c8957cf83194ea0307b1368782a6cb3a217206c394a96a3dd83f27ee895ce5f2

SHA512
850b35591e8b672150866db4ebd2783ae02c83bb75607c1e36575b993407402deb0cb0ef9a88c08a48b9ac54f26d9e8191d3035ad177ec207e01a81e6e67089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
e931c96b120d7eeab4a1ee796b205576

SHA1
8f9c69cf6e574dfdad0fb1a04685b0c3f6bae51f

SHA256
c8957cf83194ea0307b1368782a6cb3a217206c394a96a3dd83f27ee895ce5f2

SHA512
850b35591e8b672150866db4ebd2783ae02c83bb75607c1e36575b993407402deb0cb0ef9a88c08a48b9ac54f26d9e8191d3035ad177ec207e01a81e6e67089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
e931c96b120d7eeab4a1ee796b205576

SHA1
8f9c69cf6e574dfdad0fb1a04685b0c3f6bae51f

SHA256
c8957cf83194ea0307b1368782a6cb3a217206c394a96a3dd83f27ee895ce5f2

SHA512
850b35591e8b672150866db4ebd2783ae02c83bb75607c1e36575b993407402deb0cb0ef9a88c08a48b9ac54f26d9e8191d3035ad177ec207e01a81e6e67089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
e931c96b120d7eeab4a1ee796b205576

SHA1
8f9c69cf6e574dfdad0fb1a04685b0c3f6bae51f

SHA256
c8957cf83194ea0307b1368782a6cb3a217206c394a96a3dd83f27ee895ce5f2

SHA512
850b35591e8b672150866db4ebd2783ae02c83bb75607c1e36575b993407402deb0cb0ef9a88c08a48b9ac54f26d9e8191d3035ad177ec207e01a81e6e67089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
e931c96b120d7eeab4a1ee796b205576

SHA1
8f9c69cf6e574dfdad0fb1a04685b0c3f6bae51f

SHA256
c8957cf83194ea0307b1368782a6cb3a217206c394a96a3dd83f27ee895ce5f2

SHA512
850b35591e8b672150866db4ebd2783ae02c83bb75607c1e36575b993407402deb0cb0ef9a88c08a48b9ac54f26d9e8191d3035ad177ec207e01a81e6e67089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
e931c96b120d7eeab4a1ee796b205576

SHA1
8f9c69cf6e574dfdad0fb1a04685b0c3f6bae51f

SHA256
c8957cf83194ea0307b1368782a6cb3a217206c394a96a3dd83f27ee895ce5f2

SHA512
850b35591e8b672150866db4ebd2783ae02c83bb75607c1e36575b993407402deb0cb0ef9a88c08a48b9ac54f26d9e8191d3035ad177ec207e01a81e6e67089f

Download Submit
memory/220-176-0x0000000005500000-0x0000000005B18000-memory.dmp

Filesize
6.1MB

Download
memory/220-174-0x0000000000500000-0x0000000000530000-memory.dmp

Filesize
192KB

Download
memory/220-175-0x0000000073300000-0x0000000073AB0000-memory.dmp

Filesize
7.7MB

Download
memory/220-177-0x0000000004FF0000-0x00000000050FA000-memory.dmp

Filesize
1.0MB

Download
memory/220-179-0x0000000004D80000-0x0000000004D92000-memory.dmp

Filesize
72KB

Download
memory/220-178-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/220-180-0x0000000004F20000-0x0000000004F5C000-memory.dmp

Filesize
240KB

Download
memory/220-181-0x0000000073300000-0x0000000073AB0000-memory.dmp

Filesize
7.7MB

Download
memory/220-182-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/4324-157-0x00007FFA308E0000-0x00007FFA313A1000-memory.dmp

Filesize
10.8MB

Download
memory/4324-155-0x00007FFA308E0000-0x00007FFA313A1000-memory.dmp

Filesize
10.8MB

Download
memory/4324-154-0x0000000000F10000-0x0000000000F1A000-memory.dmp

Filesize
40KB

Download