amadey | d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2023 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exe
Size

517KB
MD5

b5c0db40d5cc43c8200673bfc15b405b
SHA1

68b3a7cef1539aab4701eb4f00f87a02fa3bd79f
SHA256

d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3
SHA512

954f0deb089f13993707cb1c8000b4a331403f1201cb248c6779f4571bbbfac84b4d96c85e322c4ba440eb7d3623adeb79fe43bce294432ff7f7ef233313cb25
SSDEEP

12288:uMrPy90CQKer0ByotoffKx5rV81v8bHx/3Q74sLuh:RyAKIitK+5rYv89fsah

Score

10^/10

amadey healer redline papik dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

5.42.92.67/norm/index.php

Extracted

Family

redline

Botnet

papik

77.91.124.156:19071

Attributes

auth_value
325a615d8be5db8e2f7a4c2448fdac3a

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1785015.exe	healer
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1785015.exe	healer
behavioral2/memory/4816-154-0x0000000000630000-0x000000000063A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

p1785015.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p1785015.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p1785015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p1785015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p1785015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p1785015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p1785015.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 8 IoCs

Processes:

z3250662.exez2676918.exep1785015.exer3393560.exelegola.exes8725950.exelegola.exelegola.exe

pid process

2860 z3250662.exe
2408 z2676918.exe
4816 p1785015.exe
3892 r3393560.exe
1240 legola.exe
4564 s8725950.exe
1480 legola.exe
3900 legola.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

p1785015.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p1785015.exe

pid	process
2860	z3250662.exe
2408	z2676918.exe
4816	p1785015.exe
3892	r3393560.exe
1240	legola.exe
4564	s8725950.exe
1480	legola.exe
3900	legola.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p1785015.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exez3250662.exez2676918.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z3250662.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2676918.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2096 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

p1785015.exe

pid process

4816 p1785015.exe
4816 p1785015.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

p1785015.exe

description pid process

Token: SeDebugPrivilege 4816 p1785015.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

r3393560.exe

pid process

3892 r3393560.exe

pid	process
2096	schtasks.exe

pid	process
4816	p1785015.exe
4816	p1785015.exe

description	pid	process
Token: SeDebugPrivilege	4816	p1785015.exe

pid	process
3892	r3393560.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exez3250662.exez2676918.exer3393560.exelegola.execmd.exe

description	pid	process	target process
PID 748 wrote to memory of 2860	748	d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exe	z3250662.exe
PID 748 wrote to memory of 2860	748	d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exe	z3250662.exe
PID 748 wrote to memory of 2860	748	d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exe	z3250662.exe
PID 2860 wrote to memory of 2408	2860	z3250662.exe	z2676918.exe
PID 2860 wrote to memory of 2408	2860	z3250662.exe	z2676918.exe
PID 2860 wrote to memory of 2408	2860	z3250662.exe	z2676918.exe
PID 2408 wrote to memory of 4816	2408	z2676918.exe	p1785015.exe
PID 2408 wrote to memory of 4816	2408	z2676918.exe	p1785015.exe
PID 2408 wrote to memory of 3892	2408	z2676918.exe	r3393560.exe
PID 2408 wrote to memory of 3892	2408	z2676918.exe	r3393560.exe
PID 2408 wrote to memory of 3892	2408	z2676918.exe	r3393560.exe
PID 3892 wrote to memory of 1240	3892	r3393560.exe	legola.exe
PID 3892 wrote to memory of 1240	3892	r3393560.exe	legola.exe
PID 3892 wrote to memory of 1240	3892	r3393560.exe	legola.exe
PID 2860 wrote to memory of 4564	2860	z3250662.exe	s8725950.exe
PID 2860 wrote to memory of 4564	2860	z3250662.exe	s8725950.exe
PID 2860 wrote to memory of 4564	2860	z3250662.exe	s8725950.exe
PID 1240 wrote to memory of 2096	1240	legola.exe	schtasks.exe
PID 1240 wrote to memory of 2096	1240	legola.exe	schtasks.exe
PID 1240 wrote to memory of 2096	1240	legola.exe	schtasks.exe
PID 1240 wrote to memory of 5036	1240	legola.exe	cmd.exe
PID 1240 wrote to memory of 5036	1240	legola.exe	cmd.exe
PID 1240 wrote to memory of 5036	1240	legola.exe	cmd.exe
PID 5036 wrote to memory of 4944	5036	cmd.exe	cmd.exe
PID 5036 wrote to memory of 4944	5036	cmd.exe	cmd.exe
PID 5036 wrote to memory of 4944	5036	cmd.exe	cmd.exe
PID 5036 wrote to memory of 456	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 456	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 456	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 1576	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 1576	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 1576	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 3756	5036	cmd.exe	cmd.exe
PID 5036 wrote to memory of 3756	5036	cmd.exe	cmd.exe
PID 5036 wrote to memory of 3756	5036	cmd.exe	cmd.exe
PID 5036 wrote to memory of 4076	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 4076	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 4076	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 2092	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 2092	5036	cmd.exe	cacls.exe
PID 5036 wrote to memory of 2092	5036	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3exe_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3250662.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3250662.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2676918.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2676918.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1785015.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1785015.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3393560.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3393560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1240
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2096
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        7⤵
        
        PID:456
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        7⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        7⤵
        
        PID:2092
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s8725950.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s8725950.exe
    3⤵
    - Executes dropped EXE
    PID:4564

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:1480

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3250662.exe

Filesize
390KB

MD5
eb3254907cc561de52b46aa8fa27cb6b

SHA1
dc07deed0d99047ac68562fe98571aaa84c5fb48

SHA256
e0ac034a571efabc3a1f794ad1cac029866e87a3b8db300c610395967fd38432

SHA512
9b2480e53bcbd9cee11a5c692b6c59dc4a4d35fb7adaf590cd2cdd1dede0cd9ff8eda19b907f479352d680c2f623349afda95ccddfc0c04617a52ee02c0acbc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3250662.exe

Filesize
390KB

MD5
eb3254907cc561de52b46aa8fa27cb6b

SHA1
dc07deed0d99047ac68562fe98571aaa84c5fb48

SHA256
e0ac034a571efabc3a1f794ad1cac029866e87a3b8db300c610395967fd38432

SHA512
9b2480e53bcbd9cee11a5c692b6c59dc4a4d35fb7adaf590cd2cdd1dede0cd9ff8eda19b907f479352d680c2f623349afda95ccddfc0c04617a52ee02c0acbc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s8725950.exe

Filesize
173KB

MD5
114cf8ea12a9f6a073041bb27876d5c7

SHA1
dfe3f1ad7075cf5c359fe1f8cba98fcaefc56519

SHA256
e407ad16823cc23941ed1296142cf640e6768c67077bb93b0a74fa0ec86c7b5e

SHA512
327170e76655ae072e328e8ddc19206e1e332605a38cf2a7576a964951c0201e8489ad1d6099bc6964ec7fee78a3664f9315702bf041ff1b859a27a3c186cf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s8725950.exe

Filesize
173KB

MD5
114cf8ea12a9f6a073041bb27876d5c7

SHA1
dfe3f1ad7075cf5c359fe1f8cba98fcaefc56519

SHA256
e407ad16823cc23941ed1296142cf640e6768c67077bb93b0a74fa0ec86c7b5e

SHA512
327170e76655ae072e328e8ddc19206e1e332605a38cf2a7576a964951c0201e8489ad1d6099bc6964ec7fee78a3664f9315702bf041ff1b859a27a3c186cf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2676918.exe

Filesize
234KB

MD5
07a5037c94ea0037a09bfedeb2e6f473

SHA1
b20b9447a87684297b411913c9e3031ede59af0c

SHA256
22eec59cb9bb7f7a81c0e02e378da378d6c8ad68d77dcb57c692c604a0232c30

SHA512
b756c599624573d527efe59a74e4992ce1780b02bba789e96974af301e18e9a74a3fe697b6e767d96574d07c85736679ff2e5c6eb705897559f4888629fcb1b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2676918.exe

Filesize
234KB

MD5
07a5037c94ea0037a09bfedeb2e6f473

SHA1
b20b9447a87684297b411913c9e3031ede59af0c

SHA256
22eec59cb9bb7f7a81c0e02e378da378d6c8ad68d77dcb57c692c604a0232c30

SHA512
b756c599624573d527efe59a74e4992ce1780b02bba789e96974af301e18e9a74a3fe697b6e767d96574d07c85736679ff2e5c6eb705897559f4888629fcb1b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1785015.exe

Filesize
11KB

MD5
a9a9b032259d39964aefe070a190c7dd

SHA1
f33fe4fa32548e45a442266288de7426f35d109b

SHA256
05774bd7f40ef00f3143fd3b036894cfb4c549db08436bdbd466082882249458

SHA512
20cae14b1eff0c15f78189bdd0d71410edfc707a706e8da68e9476a4a62e0810eae50b74532ba4e1f31bc35e9ad6f58095c1f06680bcc075c364369f88d0b27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1785015.exe

Filesize
11KB

MD5
a9a9b032259d39964aefe070a190c7dd

SHA1
f33fe4fa32548e45a442266288de7426f35d109b

SHA256
05774bd7f40ef00f3143fd3b036894cfb4c549db08436bdbd466082882249458

SHA512
20cae14b1eff0c15f78189bdd0d71410edfc707a706e8da68e9476a4a62e0810eae50b74532ba4e1f31bc35e9ad6f58095c1f06680bcc075c364369f88d0b27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3393560.exe

Filesize
225KB

MD5
621f1209260353b9773b010358b4899c

SHA1
e0c2ad3df39f11b03ca308fd9f33d21ec56e050e

SHA256
77aa24d194e5d91b5ecd586dd0061f4023913ee548beafdbbed97f52f50194af

SHA512
6f486cd1e6d1fece8617af16068e51223e229b66269421ebd90516747756ea0d19a66267a33e9aad792f90cdb8b328d9936ca4101b22b39c00f3f20a9022173e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3393560.exe

Filesize
225KB

MD5
621f1209260353b9773b010358b4899c

SHA1
e0c2ad3df39f11b03ca308fd9f33d21ec56e050e

SHA256
77aa24d194e5d91b5ecd586dd0061f4023913ee548beafdbbed97f52f50194af

SHA512
6f486cd1e6d1fece8617af16068e51223e229b66269421ebd90516747756ea0d19a66267a33e9aad792f90cdb8b328d9936ca4101b22b39c00f3f20a9022173e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
621f1209260353b9773b010358b4899c

SHA1
e0c2ad3df39f11b03ca308fd9f33d21ec56e050e

SHA256
77aa24d194e5d91b5ecd586dd0061f4023913ee548beafdbbed97f52f50194af

SHA512
6f486cd1e6d1fece8617af16068e51223e229b66269421ebd90516747756ea0d19a66267a33e9aad792f90cdb8b328d9936ca4101b22b39c00f3f20a9022173e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
621f1209260353b9773b010358b4899c

SHA1
e0c2ad3df39f11b03ca308fd9f33d21ec56e050e

SHA256
77aa24d194e5d91b5ecd586dd0061f4023913ee548beafdbbed97f52f50194af

SHA512
6f486cd1e6d1fece8617af16068e51223e229b66269421ebd90516747756ea0d19a66267a33e9aad792f90cdb8b328d9936ca4101b22b39c00f3f20a9022173e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
621f1209260353b9773b010358b4899c

SHA1
e0c2ad3df39f11b03ca308fd9f33d21ec56e050e

SHA256
77aa24d194e5d91b5ecd586dd0061f4023913ee548beafdbbed97f52f50194af

SHA512
6f486cd1e6d1fece8617af16068e51223e229b66269421ebd90516747756ea0d19a66267a33e9aad792f90cdb8b328d9936ca4101b22b39c00f3f20a9022173e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
621f1209260353b9773b010358b4899c

SHA1
e0c2ad3df39f11b03ca308fd9f33d21ec56e050e

SHA256
77aa24d194e5d91b5ecd586dd0061f4023913ee548beafdbbed97f52f50194af

SHA512
6f486cd1e6d1fece8617af16068e51223e229b66269421ebd90516747756ea0d19a66267a33e9aad792f90cdb8b328d9936ca4101b22b39c00f3f20a9022173e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Filesize
225KB

MD5
621f1209260353b9773b010358b4899c

SHA1
e0c2ad3df39f11b03ca308fd9f33d21ec56e050e

SHA256
77aa24d194e5d91b5ecd586dd0061f4023913ee548beafdbbed97f52f50194af

SHA512
6f486cd1e6d1fece8617af16068e51223e229b66269421ebd90516747756ea0d19a66267a33e9aad792f90cdb8b328d9936ca4101b22b39c00f3f20a9022173e

Download Submit
memory/4564-176-0x0000000005910000-0x0000000005F28000-memory.dmp

Filesize
6.1MB

Download
memory/4564-174-0x0000000000830000-0x0000000000860000-memory.dmp

Filesize
192KB

Download
memory/4564-175-0x0000000072FF0000-0x00000000737A0000-memory.dmp

Filesize
7.7MB

Download
memory/4564-177-0x0000000005400000-0x000000000550A000-memory.dmp

Filesize
1.0MB

Download
memory/4564-179-0x0000000005310000-0x0000000005322000-memory.dmp

Filesize
72KB

Download
memory/4564-178-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/4564-180-0x0000000005370000-0x00000000053AC000-memory.dmp

Filesize
240KB

Download
memory/4564-181-0x0000000072FF0000-0x00000000737A0000-memory.dmp

Filesize
7.7MB

Download
memory/4564-182-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/4816-157-0x00007FFAE38E0000-0x00007FFAE43A1000-memory.dmp

Filesize
10.8MB

Download
memory/4816-155-0x00007FFAE38E0000-0x00007FFAE43A1000-memory.dmp

Filesize
10.8MB

Download
memory/4816-154-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download