amadey | e5db33a91b7e4fd54196dad1042df50860dc815fdd1fb88a5e093ea2597cb196

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.8MB
MD5

b6041e0fe108db5e8addcf6d6b4da4bf
SHA1

4f6d688e4294362965c5e74999cd6f4c24566956
SHA256

e5db33a91b7e4fd54196dad1042df50860dc815fdd1fb88a5e093ea2597cb196
SHA512

7f64d463e9540a3625b5e68b4afdf4237b0241c144c5fb047d86bfb8491a51f68c34c57566d09b67013b10325a5da0b04664a30539d125ce6b85438846fa1b95
SSDEEP

49152:YjBUKhKl0VrRLsa7d/yVaFHd25wLSEC3ymriMz:Yj/KlYRQa7dyVuw5wLSE6ymriM

Score

10^/10

amadey asyncrat nightingale fed3aa collection credential_access discovery evasion execution persistence rat stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Nightingale stealer
Nightingale stealer is an information stealer written in C#.
stealer nightingale

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	neon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	neon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	axplong.exe

Executes dropped EXE 7 IoCs

pid	Process
4956	axplong.exe
4932	neon.exe
1820	axplong.exe
5024	neon.exe
4396	neon.exe
3080	axplong.exe
2228	axplong.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine	axplong.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3212	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
48	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4128	file.exe
4956	axplong.exe
1820	axplong.exe
3080	axplong.exe
2228	axplong.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4932 set thread context of 2484	4932	neon.exe	95
PID 4932 set thread context of 1688	4932	neon.exe	101

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neon.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2396	cmd.exe
2076	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2076	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4128	file.exe
4128	file.exe
4956	axplong.exe
4956	axplong.exe
4932	neon.exe
4932	neon.exe
1820	axplong.exe
1820	axplong.exe
4932	neon.exe
4932	neon.exe
5024	neon.exe
4396	neon.exe
4396	neon.exe
4396	neon.exe
4932	neon.exe
4932	neon.exe
3080	axplong.exe
3080	axplong.exe
4932	neon.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe
1688	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	neon.exe
Token: SeDebugPrivilege	5024	neon.exe
Token: SeDebugPrivilege	4396	neon.exe
Token: SeDebugPrivilege	1688	InstallUtil.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4128	file.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4956	4128	file.exe	82
PID 4128 wrote to memory of 4956	4128	file.exe	82
PID 4128 wrote to memory of 4956	4128	file.exe	82
PID 4956 wrote to memory of 4932	4956	axplong.exe	83
PID 4956 wrote to memory of 4932	4956	axplong.exe	83
PID 4932 wrote to memory of 2396	4932	neon.exe	90
PID 4932 wrote to memory of 2396	4932	neon.exe	90
PID 2396 wrote to memory of 2076	2396	cmd.exe	92
PID 2396 wrote to memory of 2076	2396	cmd.exe	92
PID 4932 wrote to memory of 2484	4932	neon.exe	95
PID 4932 wrote to memory of 2484	4932	neon.exe	95
PID 4932 wrote to memory of 2484	4932	neon.exe	95
PID 4932 wrote to memory of 2484	4932	neon.exe	95
PID 4932 wrote to memory of 2484	4932	neon.exe	95
PID 4932 wrote to memory of 2484	4932	neon.exe	95
PID 4932 wrote to memory of 2484	4932	neon.exe	95
PID 2396 wrote to memory of 4200	2396	cmd.exe	96
PID 2396 wrote to memory of 4200	2396	cmd.exe	96
PID 4932 wrote to memory of 5024	4932	neon.exe	99
PID 4932 wrote to memory of 5024	4932	neon.exe	99
PID 4932 wrote to memory of 5024	4932	neon.exe	99
PID 5024 wrote to memory of 4396	5024	neon.exe	100
PID 5024 wrote to memory of 4396	5024	neon.exe	100
PID 5024 wrote to memory of 4396	5024	neon.exe	100
PID 4932 wrote to memory of 1688	4932	neon.exe	101
PID 4932 wrote to memory of 1688	4932	neon.exe	101
PID 4932 wrote to memory of 1688	4932	neon.exe	101
PID 4932 wrote to memory of 1688	4932	neon.exe	101
PID 4932 wrote to memory of 1688	4932	neon.exe	101
PID 4932 wrote to memory of 1688	4932	neon.exe	101
PID 1688 wrote to memory of 3212	1688	InstallUtil.exe	103
PID 1688 wrote to memory of 3212	1688	InstallUtil.exe	103
PID 1688 wrote to memory of 1628	1688	InstallUtil.exe	105
PID 1688 wrote to memory of 1628	1688	InstallUtil.exe	105

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
    "C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 7
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2076
    - - C:\Windows\system32\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
        5⤵
        Adds Run key to start application
        
        PID:4200
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\neon.exe
      "C:\Users\Admin\AppData\Local\Temp\neon.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4396
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:1688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1820

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3080

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\neon.exe.log

Filesize
1KB

MD5
7dca233df92b3884663fa5a40db8d49c

SHA1
208b8f27b708c4e06ac37f974471cc7b29c29b60

SHA256
90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c

SHA512
d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d3235ed022a42ec4338123ab87144afa

SHA1
5058608bc0deb720a585a2304a8f7cf63a50a315

SHA256
10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

SHA512
236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

Filesize
3.5MB

MD5
b3fd0e1003b1cd38402b6d32829f6135

SHA1
c9cedd6322fb83457f56b64b4624b07e2786f702

SHA256
e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31

SHA512
04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
b6041e0fe108db5e8addcf6d6b4da4bf

SHA1
4f6d688e4294362965c5e74999cd6f4c24566956

SHA256
e5db33a91b7e4fd54196dad1042df50860dc815fdd1fb88a5e093ea2597cb196

SHA512
7f64d463e9540a3625b5e68b4afdf4237b0241c144c5fb047d86bfb8491a51f68c34c57566d09b67013b10325a5da0b04664a30539d125ce6b85438846fa1b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3s0frewq.1ws.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.exe

Filesize
76KB

MD5
0e362e7005823d0bec3719b902ed6d62

SHA1
590d860b909804349e0cdc2f1662b37bd62f7463

SHA256
2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

SHA512
518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.txt

Filesize
64B

MD5
d8e72b9b1d67c2fab70820d24909fd29

SHA1
8a0d951096c6b91ae4c3c57f1aa6686e206764e9

SHA256
872a3a60f4b799cb37a494b47550fe33516b639f8e59f9c2fd633447a69e4c11

SHA512
ac430152e760842e7bf4d34bb35f3751f31589a45ee1f96bb7dea70e1a1647bdffd1e5203492d083a3a1b714434704d6f266bc173c53eb6a3e25b8578e0336c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.txt

Filesize
67B

MD5
df2590d35e24f0e18539e2f3daba8feb

SHA1
d5ae37b509449c5194428fdd0f80442d4a5f5e38

SHA256
0f7e70f9776508627db6029541dff91446beb0f757f9665c0adadb15aaa46530

SHA512
cd4d7acb5500c0852690c2da6551e37472b31d84277e6c14e7bd4b93e05b3ada43e4b0e72d8212029adff07ae993274967f932b0241ed23f8b6e907b242c2716

Download Submit
memory/1688-449-0x0000021C4DE00000-0x0000021C4DE2C000-memory.dmp

Filesize
176KB

Download
memory/1688-448-0x0000000040000000-0x0000000040030000-memory.dmp

Filesize
192KB

Download
memory/1688-512-0x0000021C66D70000-0x0000021C66DE6000-memory.dmp

Filesize
472KB

Download
memory/1688-514-0x0000021C66600000-0x0000021C6661E000-memory.dmp

Filesize
120KB

Download
memory/1688-513-0x0000021C4DE80000-0x0000021C4DEC0000-memory.dmp

Filesize
256KB

Download
memory/1820-47-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/1820-49-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/2228-792-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/2228-794-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/3080-383-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/3212-520-0x000002097FEF0000-0x000002097FF12000-memory.dmp

Filesize
136KB

Download
memory/4128-0-0x00000000003A0000-0x000000000084C000-memory.dmp

Filesize
4.7MB

Download
memory/4128-18-0x00000000003A0000-0x000000000084C000-memory.dmp

Filesize
4.7MB

Download
memory/4128-4-0x00000000003A0000-0x000000000084C000-memory.dmp

Filesize
4.7MB

Download
memory/4128-3-0x00000000003A0000-0x000000000084C000-memory.dmp

Filesize
4.7MB

Download
memory/4128-2-0x00000000003A1000-0x00000000003CF000-memory.dmp

Filesize
184KB

Download
memory/4128-1-0x00000000776F4000-0x00000000776F6000-memory.dmp

Filesize
8KB

Download
memory/4932-81-0x0000000022F50000-0x000000002368F000-memory.dmp

Filesize
7.2MB

Download
memory/4932-87-0x000000001FFD0000-0x000000001FFE8000-memory.dmp

Filesize
96KB

Download
memory/4932-56-0x00000000017C0000-0x0000000001A89000-memory.dmp

Filesize
2.8MB

Download
memory/4932-60-0x0000000002220000-0x00000000022BB000-memory.dmp

Filesize
620KB

Download
memory/4932-62-0x0000000002490000-0x000000000253A000-memory.dmp

Filesize
680KB

Download
memory/4932-61-0x0000000002360000-0x000000000248A000-memory.dmp

Filesize
1.2MB

Download
memory/4932-65-0x0000000000F20000-0x0000000000F2A000-memory.dmp

Filesize
40KB

Download
memory/4932-64-0x0000000000FE0000-0x0000000000FF2000-memory.dmp

Filesize
72KB

Download
memory/4932-63-0x00000000022C0000-0x0000000002315000-memory.dmp

Filesize
340KB

Download
memory/4932-74-0x0000000003960000-0x0000000003A60000-memory.dmp

Filesize
1024KB

Download
memory/4932-76-0x000000001F9E0000-0x000000001FB0A000-memory.dmp

Filesize
1.2MB

Download
memory/4932-79-0x000000001FF00000-0x000000001FF9E000-memory.dmp

Filesize
632KB

Download
memory/4932-80-0x0000000020090000-0x00000000201DE000-memory.dmp

Filesize
1.3MB

Download
memory/4932-78-0x000000001FE70000-0x000000001FEF3000-memory.dmp

Filesize
524KB

Download
memory/4932-77-0x000000001FB10000-0x000000001FE65000-memory.dmp

Filesize
3.3MB

Download
memory/4932-75-0x0000000003C60000-0x0000000003C90000-memory.dmp

Filesize
192KB

Download
memory/4932-59-0x0000000001D80000-0x0000000001E1E000-memory.dmp

Filesize
632KB

Download
memory/4932-72-0x00000000037B0000-0x00000000038BB000-memory.dmp

Filesize
1.0MB

Download
memory/4932-73-0x00000000038C0000-0x000000000395D000-memory.dmp

Filesize
628KB

Download
memory/4932-71-0x0000000003780000-0x00000000037AB000-memory.dmp

Filesize
172KB

Download
memory/4932-70-0x0000000003750000-0x0000000003772000-memory.dmp

Filesize
136KB

Download
memory/4932-69-0x0000000003690000-0x000000000374D000-memory.dmp

Filesize
756KB

Download
memory/4932-67-0x00000000030E0000-0x0000000003281000-memory.dmp

Filesize
1.6MB

Download
memory/4932-66-0x0000000002610000-0x00000000030D1000-memory.dmp

Filesize
10.8MB

Download
memory/4932-68-0x00000000025D0000-0x00000000025E6000-memory.dmp

Filesize
88KB

Download
memory/4932-90-0x0000000023F00000-0x0000000023F19000-memory.dmp

Filesize
100KB

Download
memory/4932-89-0x0000000023EF0000-0x0000000023EFC000-memory.dmp

Filesize
48KB

Download
memory/4932-88-0x0000000023EB0000-0x0000000023EE4000-memory.dmp

Filesize
208KB

Download
memory/4932-91-0x00000000249E0000-0x0000000024A90000-memory.dmp

Filesize
704KB

Download
memory/4932-58-0x0000000001CD0000-0x0000000001D7C000-memory.dmp

Filesize
688KB

Download
memory/4932-86-0x0000000022EE0000-0x0000000022F07000-memory.dmp

Filesize
156KB

Download
memory/4932-85-0x000000001FFB0000-0x000000001FFCF000-memory.dmp

Filesize
124KB

Download
memory/4932-84-0x0000000022E30000-0x0000000022EDD000-memory.dmp

Filesize
692KB

Download
memory/4932-83-0x00000000053C0000-0x00000000053EC000-memory.dmp

Filesize
176KB

Download
memory/4932-82-0x0000000023690000-0x0000000023E20000-memory.dmp

Filesize
7.6MB

Download
memory/4932-92-0x0000000024C10000-0x0000000024DB9000-memory.dmp

Filesize
1.7MB

Download
memory/4932-93-0x00000000253A0000-0x00000000254B5000-memory.dmp

Filesize
1.1MB

Download
memory/4932-96-0x0000000024B00000-0x0000000024B08000-memory.dmp

Filesize
32KB

Download
memory/4932-95-0x00000000254C0000-0x0000000025743000-memory.dmp

Filesize
2.5MB

Download
memory/4932-94-0x0000000024DC0000-0x0000000024E8D000-memory.dmp

Filesize
820KB

Download
memory/4932-97-0x00000000264C0000-0x0000000026674000-memory.dmp

Filesize
1.7MB

Download
memory/4932-41-0x00000000008F0000-0x0000000000C6C000-memory.dmp

Filesize
3.5MB

Download
memory/4932-57-0x0000000001BA0000-0x0000000001C30000-memory.dmp

Filesize
576KB

Download
memory/4932-42-0x0000000023F20000-0x0000000023FBE000-memory.dmp

Filesize
632KB

Download
memory/4932-52-0x0000000026EC0000-0x0000000026EDA000-memory.dmp

Filesize
104KB

Download
memory/4932-55-0x0000000001600000-0x00000000016BE000-memory.dmp

Filesize
760KB

Download
memory/4932-54-0x0000000000F70000-0x0000000000FD5000-memory.dmp

Filesize
404KB

Download
memory/4932-53-0x0000000026EE0000-0x0000000026EE6000-memory.dmp

Filesize
24KB

Download
memory/4956-51-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/4956-45-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/4956-44-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/4956-43-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/4956-98-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/4956-22-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/4956-21-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/4956-20-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/4956-19-0x0000000000EF1000-0x0000000000F1F000-memory.dmp

Filesize
184KB

Download
memory/4956-16-0x0000000000EF0000-0x000000000139C000-memory.dmp

Filesize
4.7MB

Download
memory/5024-246-0x00000000049D0000-0x0000000004A6C000-memory.dmp

Filesize
624KB

Download
memory/5024-245-0x0000000000010000-0x000000000002A000-memory.dmp

Filesize
104KB

Download