amadey | ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2023 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exe
Size

517KB
MD5

be89e6d6095f86a6446279aa60968569
SHA1

75dbfa09c5afb88efa9bcb4faf4e0e41e43d46e9
SHA256

ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7
SHA512

33ea7fb4e982c8e7e7077df8c0dbd750aaf0df80944ebd017e8a353e5308bf9afa0b36a40a32d9a2e153a5c1026e76518a65a8305aeb2d3042dcf7acc1ea5f53
SSDEEP

6144:Kiy+bnr+rp0yN90QEDgmkSq4ME0Op6lHc64SFzI29WwmVCYC10OthM5wRSsmfcHV:aMrvy90jkSk/96oW/VRQi+MAl

Score

10^/10

amadey healer redline papik dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

5.42.92.67/norm/index.php

Extracted

Family

redline

Botnet

papik

77.91.124.156:19071

Attributes

auth_value
325a615d8be5db8e2f7a4c2448fdac3a

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9590009.exe	healer
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9590009.exe	healer
behavioral2/memory/4920-154-0x0000000000800000-0x000000000080A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

p9590009.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p9590009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p9590009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p9590009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p9590009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p9590009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p9590009.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 8 IoCs

Processes:

z1929716.exez5069298.exep9590009.exer5286558.exelegola.exes5663015.exelegola.exelegola.exe

pid process

948 z1929716.exe
1920 z5069298.exe
4920 p9590009.exe
5024 r5286558.exe
564 legola.exe
4168 s5663015.exe
1396 legola.exe
1620 legola.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

p9590009.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p9590009.exe

pid	process
948	z1929716.exe
1920	z5069298.exe
4920	p9590009.exe
5024	r5286558.exe
564	legola.exe
4168	s5663015.exe
1396	legola.exe
1620	legola.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p9590009.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

z5069298.exeba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exez1929716.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z5069298.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1929716.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4048 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

p9590009.exe

pid process

4920 p9590009.exe
4920 p9590009.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

p9590009.exe

description pid process

Token: SeDebugPrivilege 4920 p9590009.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

r5286558.exe

pid process

5024 r5286558.exe

pid	process
4048	schtasks.exe

pid	process
4920	p9590009.exe
4920	p9590009.exe

description	pid	process
Token: SeDebugPrivilege	4920	p9590009.exe

pid	process
5024	r5286558.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exez1929716.exez5069298.exer5286558.exelegola.execmd.exe

description	pid	process	target process
PID 528 wrote to memory of 948	528	ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exe	z1929716.exe
PID 528 wrote to memory of 948	528	ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exe	z1929716.exe
PID 528 wrote to memory of 948	528	ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exe	z1929716.exe
PID 948 wrote to memory of 1920	948	z1929716.exe	z5069298.exe
PID 948 wrote to memory of 1920	948	z1929716.exe	z5069298.exe
PID 948 wrote to memory of 1920	948	z1929716.exe	z5069298.exe
PID 1920 wrote to memory of 4920	1920	z5069298.exe	p9590009.exe
PID 1920 wrote to memory of 4920	1920	z5069298.exe	p9590009.exe
PID 1920 wrote to memory of 5024	1920	z5069298.exe	r5286558.exe
PID 1920 wrote to memory of 5024	1920	z5069298.exe	r5286558.exe
PID 1920 wrote to memory of 5024	1920	z5069298.exe	r5286558.exe
PID 5024 wrote to memory of 564	5024	r5286558.exe	legola.exe
PID 5024 wrote to memory of 564	5024	r5286558.exe	legola.exe
PID 5024 wrote to memory of 564	5024	r5286558.exe	legola.exe
PID 948 wrote to memory of 4168	948	z1929716.exe	s5663015.exe
PID 948 wrote to memory of 4168	948	z1929716.exe	s5663015.exe
PID 948 wrote to memory of 4168	948	z1929716.exe	s5663015.exe
PID 564 wrote to memory of 4048	564	legola.exe	schtasks.exe
PID 564 wrote to memory of 4048	564	legola.exe	schtasks.exe
PID 564 wrote to memory of 4048	564	legola.exe	schtasks.exe
PID 564 wrote to memory of 1672	564	legola.exe	cmd.exe
PID 564 wrote to memory of 1672	564	legola.exe	cmd.exe
PID 564 wrote to memory of 1672	564	legola.exe	cmd.exe
PID 1672 wrote to memory of 4424	1672	cmd.exe	cmd.exe
PID 1672 wrote to memory of 4424	1672	cmd.exe	cmd.exe
PID 1672 wrote to memory of 4424	1672	cmd.exe	cmd.exe
PID 1672 wrote to memory of 652	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 652	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 652	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 1724	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 1724	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 1724	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 4160	1672	cmd.exe	cmd.exe
PID 1672 wrote to memory of 4160	1672	cmd.exe	cmd.exe
PID 1672 wrote to memory of 4160	1672	cmd.exe	cmd.exe
PID 1672 wrote to memory of 1112	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 1112	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 1112	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 4340	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 4340	1672	cmd.exe	cacls.exe
PID 1672 wrote to memory of 4340	1672	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7exe_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:528

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1929716.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1929716.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5069298.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5069298.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9590009.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9590009.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r5286558.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r5286558.exe
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
6⤵
- Creates scheduled task(s)
PID:4048

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4424

C:\Windows\SysWOW64\cacls.exe
CACLS "legola.exe" /P "Admin:N"
7⤵
PID:652

C:\Windows\SysWOW64\cacls.exe
CACLS "legola.exe" /P "Admin:R" /E
7⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4160

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ebb444342c" /P "Admin:N"
7⤵
PID:1112

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ebb444342c" /P "Admin:R" /E
7⤵
PID:4340

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5663015.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5663015.exe
3⤵
- Executes dropped EXE
PID:4168

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:1620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1929716.exe
Filesize
390KB

MD5
e6007b4b7eac5a7dc20fea86410eca71

SHA1
7710765f9ca4ef64e74597ec15a1f7d124255b59

SHA256
ac1ec461b7980ffd8f0f0b4b1a97aa91fc07c9f6d7b27658583f82f0de834431

SHA512
aae9e45876aef1872ac420e8a05eaca617ae6c7504964927ae5cdcbd8d7e58780b80daf21fbb3def37a4749a0b32dcc558e435a5f23bdc7970ae1a2bd2124180

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1929716.exe
Filesize
390KB

MD5
e6007b4b7eac5a7dc20fea86410eca71

SHA1
7710765f9ca4ef64e74597ec15a1f7d124255b59

SHA256
ac1ec461b7980ffd8f0f0b4b1a97aa91fc07c9f6d7b27658583f82f0de834431

SHA512
aae9e45876aef1872ac420e8a05eaca617ae6c7504964927ae5cdcbd8d7e58780b80daf21fbb3def37a4749a0b32dcc558e435a5f23bdc7970ae1a2bd2124180

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5663015.exe
Filesize
173KB

MD5
489bfc645b14f82c99c197e297a14b34

SHA1
35c8842c7e733fa58332d1216001cf945a0ad70b

SHA256
d8ef44b12b297bd2b245f3403acbe9ee96fd03acfd9d58baf7328aa7b007bff3

SHA512
d63e144f28c855c8f03a71336f490e4c3194cd021b7229810c7beaa821bbbb4464f28cc1f9182e6774d1d6465b9f43525c32489ae8aa046eec9b935d9b0bd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5663015.exe
Filesize
173KB

MD5
489bfc645b14f82c99c197e297a14b34

SHA1
35c8842c7e733fa58332d1216001cf945a0ad70b

SHA256
d8ef44b12b297bd2b245f3403acbe9ee96fd03acfd9d58baf7328aa7b007bff3

SHA512
d63e144f28c855c8f03a71336f490e4c3194cd021b7229810c7beaa821bbbb4464f28cc1f9182e6774d1d6465b9f43525c32489ae8aa046eec9b935d9b0bd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5069298.exe
Filesize
234KB

MD5
ca68e2022abd5b321f63841e7c392eb0

SHA1
175e209555a0aaf9755b8a108c4d7af53f1f3e4e

SHA256
0dddedd672db00a72bf5d305156b890df2841ae88de6da8bec6ecd73b295a59c

SHA512
c3d54586749858e5f56ce793695209ea3e5c444ae676dea67c3be94ba5a3603d6dd0b303d8ea2d3d836303dca5ae06f67fb0e008c7cc40bb4acb142bd7f95287

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5069298.exe
Filesize
234KB

MD5
ca68e2022abd5b321f63841e7c392eb0

SHA1
175e209555a0aaf9755b8a108c4d7af53f1f3e4e

SHA256
0dddedd672db00a72bf5d305156b890df2841ae88de6da8bec6ecd73b295a59c

SHA512
c3d54586749858e5f56ce793695209ea3e5c444ae676dea67c3be94ba5a3603d6dd0b303d8ea2d3d836303dca5ae06f67fb0e008c7cc40bb4acb142bd7f95287

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9590009.exe
Filesize
11KB

MD5
67369e7b49da79f802e07489260ce88a

SHA1
9dfedc73f6ea2ab163aaa38ce118c5f125650af2

SHA256
cd0f756e67b429b0d2d2b81ba12b7d8a5725cde7ab6c742f00109ebb98c9c7dd

SHA512
6c30afb8caa5980d580902970bb6d33e7d92b36c2f5a76707b5ad0d5d6ecf7c851ea492ec28aa0e1c65952cb12d8bec12f1b596f7a05badfe6c64afa931bfedc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9590009.exe
Filesize
11KB

MD5
67369e7b49da79f802e07489260ce88a

SHA1
9dfedc73f6ea2ab163aaa38ce118c5f125650af2

SHA256
cd0f756e67b429b0d2d2b81ba12b7d8a5725cde7ab6c742f00109ebb98c9c7dd

SHA512
6c30afb8caa5980d580902970bb6d33e7d92b36c2f5a76707b5ad0d5d6ecf7c851ea492ec28aa0e1c65952cb12d8bec12f1b596f7a05badfe6c64afa931bfedc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r5286558.exe
Filesize
225KB

MD5
3ad785de8e7a3e32040f15a85a8b1a7c

SHA1
3e0dc5f1e624c9855461a4f7093978a3fb44b415

SHA256
de84fcbd9b2487256cce8e74c705fa3ef776a7b0bb3796c48a264d77f475629f

SHA512
bb94295c81e3433fdec2e139da58858ead7c4523741844dd32197d147ea0d60dfdae42e1b4f987e830b8a94c7d5c599ff4bccf0ef50034f7a422ba4f6496b07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r5286558.exe
Filesize
225KB

MD5
3ad785de8e7a3e32040f15a85a8b1a7c

SHA1
3e0dc5f1e624c9855461a4f7093978a3fb44b415

SHA256
de84fcbd9b2487256cce8e74c705fa3ef776a7b0bb3796c48a264d77f475629f

SHA512
bb94295c81e3433fdec2e139da58858ead7c4523741844dd32197d147ea0d60dfdae42e1b4f987e830b8a94c7d5c599ff4bccf0ef50034f7a422ba4f6496b07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
3ad785de8e7a3e32040f15a85a8b1a7c

SHA1
3e0dc5f1e624c9855461a4f7093978a3fb44b415

SHA256
de84fcbd9b2487256cce8e74c705fa3ef776a7b0bb3796c48a264d77f475629f

SHA512
bb94295c81e3433fdec2e139da58858ead7c4523741844dd32197d147ea0d60dfdae42e1b4f987e830b8a94c7d5c599ff4bccf0ef50034f7a422ba4f6496b07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
3ad785de8e7a3e32040f15a85a8b1a7c

SHA1
3e0dc5f1e624c9855461a4f7093978a3fb44b415

SHA256
de84fcbd9b2487256cce8e74c705fa3ef776a7b0bb3796c48a264d77f475629f

SHA512
bb94295c81e3433fdec2e139da58858ead7c4523741844dd32197d147ea0d60dfdae42e1b4f987e830b8a94c7d5c599ff4bccf0ef50034f7a422ba4f6496b07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
3ad785de8e7a3e32040f15a85a8b1a7c

SHA1
3e0dc5f1e624c9855461a4f7093978a3fb44b415

SHA256
de84fcbd9b2487256cce8e74c705fa3ef776a7b0bb3796c48a264d77f475629f

SHA512
bb94295c81e3433fdec2e139da58858ead7c4523741844dd32197d147ea0d60dfdae42e1b4f987e830b8a94c7d5c599ff4bccf0ef50034f7a422ba4f6496b07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
3ad785de8e7a3e32040f15a85a8b1a7c

SHA1
3e0dc5f1e624c9855461a4f7093978a3fb44b415

SHA256
de84fcbd9b2487256cce8e74c705fa3ef776a7b0bb3796c48a264d77f475629f

SHA512
bb94295c81e3433fdec2e139da58858ead7c4523741844dd32197d147ea0d60dfdae42e1b4f987e830b8a94c7d5c599ff4bccf0ef50034f7a422ba4f6496b07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
Filesize
225KB

MD5
3ad785de8e7a3e32040f15a85a8b1a7c

SHA1
3e0dc5f1e624c9855461a4f7093978a3fb44b415

SHA256
de84fcbd9b2487256cce8e74c705fa3ef776a7b0bb3796c48a264d77f475629f

SHA512
bb94295c81e3433fdec2e139da58858ead7c4523741844dd32197d147ea0d60dfdae42e1b4f987e830b8a94c7d5c599ff4bccf0ef50034f7a422ba4f6496b07c

Download Submit
memory/4168-176-0x0000000005C60000-0x0000000006278000-memory.dmp

Filesize
6.1MB

Download
memory/4168-174-0x0000000000AB0000-0x0000000000AE0000-memory.dmp

Filesize
192KB

Download
memory/4168-175-0x0000000072CD0000-0x0000000073480000-memory.dmp

Filesize
7.7MB

Download
memory/4168-177-0x0000000005750000-0x000000000585A000-memory.dmp

Filesize
1.0MB

Download
memory/4168-178-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/4168-179-0x0000000005570000-0x0000000005582000-memory.dmp

Filesize
72KB

Download
memory/4168-180-0x00000000055D0000-0x000000000560C000-memory.dmp

Filesize
240KB

Download
memory/4168-181-0x0000000072CD0000-0x0000000073480000-memory.dmp

Filesize
7.7MB

Download
memory/4168-182-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/4920-157-0x00007FFB3A720000-0x00007FFB3B1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4920-155-0x00007FFB3A720000-0x00007FFB3B1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4920-154-0x0000000000800000-0x000000000080A000-memory.dmp

Filesize
40KB

Download