921849539fe7317e7453895f0eb3d02cce6c5b5cbaaefe45dc430ca3387c9601

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026/Es0986544622442525584.exe
Size 4.2MB
Sample260622-pg92tabz4l
SHA256 921849539fe7317e7453895f0eb3d02cce6c5b5cbaaefe45dc430ca3387c9601
MD5 1ca670e3e324f27793e05fdb94e42292
SHA1 9875469b4cfb7b76586bc67a3a4e3a8eccb26485
SHA512 2b32778aec48ef984a2f8f9171ce0c67d0a81c1b484ed61579261c218482e8a135bb952059810a540148b9aa6c08e0e6ba2a19535c351e731da820d3e7763b1e
SSDEEP 98304:5LAGlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTdr:ZpU1Ls6DjX34gSVNx
TLSH
T14926333338ACCCB2F96026305DA8536166FD6B181E34505F73BC4B2E9B2B7C5458E79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery installer

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\debug.log	winagent.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-PF0CS.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\about.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus3.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-OJTL9.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\about.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-I09M3.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-030UG.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\PavApi.dll	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-D1CLS.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-R9S3M.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\tagline.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus2.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\iscanruntime.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\247_header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-E9TIR.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-K5MTD.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-9CTUJ.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-G0J6C.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-FCRFQ.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp	unzip.exe
File opened for modification	C:\PROGRA~2\ADVANC~1\settings.ini	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\assetscan.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\pavcomm.dll	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-HM9EJ.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-HIF1B.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-OUHHU.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\tagline.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\unins000.dat	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-LF0F3.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-G2NTP.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-K76UU.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\247_header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-77U9F.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\unins000.dat	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-JS0FE.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-M1N78.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\247.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\247.bmp	unzip.exe
File created	C:\PROGRA~2\ADVANC~1\DSC_Config.xml	winagent.exe
File created	C:\PROGRA~2\ADVANC~1\247_Config.xml	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\_avg7api.dll	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-3PQT4.tmp	agent.tmp

Executes dropped EXE 5 IoCs

pid	Process
3368	agent.exe
4872	agent.tmp
1820	unzip.exe
2564	unzip.exe
5836	winagent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Es0986544622442525584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unzip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winagent.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x001200000001c561-6.dat	innosetup
behavioral2/memory/3368-12-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/3368-102-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}\InprocServer32	winagent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4872	agent.tmp
4872	agent.tmp
5836	winagent.exe
5836	winagent.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	5836	winagent.exe
Token: SeSecurityPrivilege	5836	winagent.exe
Token: SeBackupPrivilege	5836	winagent.exe
Token: SeSecurityPrivilege	5836	winagent.exe
Token: SeBackupPrivilege	5836	winagent.exe
Token: SeSecurityPrivilege	5836	winagent.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4872	agent.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 3368	5496	Es0986544622442525584.exe	88
PID 3368 wrote to memory of 4872	3368	agent.exe	89
PID 4872 wrote to memory of 1820	4872	agent.tmp	90
PID 4872 wrote to memory of 2564	4872	agent.tmp	92
PID 4872 wrote to memory of 5836	4872	agent.tmp	94

C:\Users\Admin\AppData\Local\Temp\2026\Es0986544622442525584.exe
"C:\Users\Admin\AppData\Local\Temp\2026\Es0986544622442525584.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Users\Admin\AppData\Local\Temp\is-NSLG8.tmp\agent.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-NSLG8.tmp\agent.tmp" /SL5="$9004E,3999367,56832,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe" package.zip
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1820
  - - C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe"
      4⤵
      Executes dropped EXE
      PID:2564
  - - C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe" /autoinstall
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.lng

Path C:\PROGRA~2\ADVANC~1\1.lng
Size 32KB
SHA256 0e5882114864d4a708b472d524063867fa770958b770b67fc0af7f8ed4757ad2
MD5 e4361def38811d2f295b5686bd2c2b5b
SHA1 91002014191d2e09616f619a81c7cafb652e2815
SHA512 f1ee01ec34edfe27f5f48be84f0a36a572e709bd46d29114617785954576e71ab55d8a8090256a5efff6d2a63c1625dac0a3275b9dbc55ba69d6e1861c14a755
SSDEEP 768:MdUriNbhCz1TSobrPjgZcN6OVLjF2JgXWdo/aqmRy17U:MGriNNron0Rsg
TLSH
T1D9E2D857A30286AB1F261198B90C53E27B38818D9733262534EED15C36CCE5CD7BB5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.ini

Path C:\PROGRA~2\ADVANC~1\services.ini
Size 3KB
SHA256 b3ff7c0a671e3d6cf02c2422fd7f0705bf4e22775e1b91e1fd4cf604bfc47646
MD5 7e3633ed291fceeac2484d2e1133fee4
SHA1 5f07cab96e6c1b547959b44bab5759a89bc2a4ea
SHA512 6efa3027cebdac7f2bcb1ef4afe6fce4809071fd94415db31844fbef6a791aff2bca04b964ec5793c73d5ee51b2e05310b1d622acc1f84aa7966af26a2775f16
TLSH
T10171CC1726D0A97F217831A866D57201239F80B8DB3CD585EB9BCCDBED88C0B316E784
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 dd1755a6cad3d8023e96a48b575870872e9afe220f2c5eb468605907f3456bab
MD5 cda198fafb0909299aaade3daae06d14
SHA1 8320a335e8716726e7361c192bd3688a0c948b13
SHA512 de822e14180c71bb97debe9b250486b6dea7c1057ab8552179c25e63f9176e2c7e01298774fec104dcb4a6c7be2b0c1f62dfcfd5e9c9d49ac7a30142ce1b902a
TLSH
T18221CA9EC93928566F7A70AA702A3E8512C01543F670E39441B7D2C0C74405713A403B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 2ea9862e76c873d491c8281d6c48afc37ddd608a4b703322d32245f5eff296dc
MD5 821d8c7946e64613642465be11b37da2
SHA1 f0f387fb31b21a4920a04b35bc0ad93753118b39
SHA512 205dca2e989e0f483a420bbefb2bcc4ca454ec8d270ca9b8206826bd5c4a66d6d715e9060e122fc37404ad33358c829b96a19b1aa13f456d9fe553f5107ff90c
TLSH
T1A121B99ECA392C5A6F7A70AA613A3F8512C01583F670E79456B7D2C1CB4405B13B843F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 02e615c158da60970a273428c2762edfac95e6d6069d0c991226b9c45a0facff
MD5 76600aa8741747e96395daefb93a69c8
SHA1 8ae3446e5e6f482e807b89fb176b9998fcbfc6cb
SHA512 1854345a526ba7908da8866cca05b448ab425fa91c720f83af2dc8d1e59c2dd75ea9069d21c676e80aeae9d53ce609421e9b00c96554d810ecaa219b797439fc
TLSH
T14021CA9ECA3928566F7A70AA70263E8512C01543E670E39441B7D2C0C74405713A403B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 782768a660ab51bfa7c68686763c8fc8ca3a52f5e4f58ad9c5ba6c748f965859
MD5 74008b05878cec51b9add88ada908059
SHA1 ff403b42680b21297fb74dd5089e40982ce261e9
SHA512 e30089adf582364a6693e4adbb6457a0d8d3af04a308919f00d37e9da4d2904c0e3a466eea4a05e2d67c2eea5f1e7e5667ef16414f184a2fac979c571d3ddf92
TLSH
T16C219A9EC979295A6F7A70AA71263E8512C01543E670E39455B7D2C1C74405713A453F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 c7c144938f2a684c7c1d59bb85fae8148d5a1ea30174fc71162fc4a27abc4a3d
MD5 ac7c46bddca1cc6fd52875b149a1cdf4
SHA1 db920acb33dbf288bdee582ed27f474eaed51e5f
SHA512 f347421c9ee86afdad9ada6bef2a3aab03b4efb5f1907ed918b3b0a4e355ae6ef9f3ce1f956278e0bb51f39cfd9b73f1af9d77184366f1ff45dc07c071e295c9
TLSH
T19E21CA9ECD39295A6F7A70AA702A3E8512C01543E670E39441B7D2C0CB4405713A403B
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 2KB
SHA256 44a71a0c645f2a28593dbf38b8c8b2454a8e7b3a6e6e7c36c1c32ecda7a724d5
MD5 5c3837fd720eab2f00119434eba6328c
SHA1 2fc601a218e43b3bd8c98c13b61de1912786deda
SHA512 9caf423e5be53ec0865ad5f1d9480962a3ee1555a32f678f04d43d913b0253a06fbe019420f0080733e2a9c4be944f6d484c010fae3eb05cd9240497a26e2618
TLSH
T17541A8CA6FB22EB8FEC5EF0162179F14D19051E2A77080983247E6D7B262106637CDE6
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 3KB
SHA256 5e4d901b471e1a2575e2fa361f498715125aab822841b09fce6b8d5d9ec8ccf4
MD5 f205e5691a5f27b0a07bcb3921295780
SHA1 e7cccd4d85b1a3bd61778b79fb80888985428fc3
SHA512 0489f75863d401342c0e88be0d676ec80ff80b46a955b766894eca01d053e0f136f7cc3d3c82d57ad3f9ac6b784325e798cd0431c891e7f19122d836ac2f1a61
TLSH
T1BE810AC75BB13EB4BEC5EF002617EF54919150E6A77040983297E2E7F26600963BCEE6
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 6KB
SHA256 f52e16a1280ae8e449dbad3c4b89609d6e8d414388c3a5ce27d2f13c7c5e523b
MD5 d182fd581c07d2b49502f8f3dee94792
SHA1 6977052d548e563077247cbb4e96e22c0efab718
SHA512 be9e9d56b2f29481c2ed508384fd0eca937e4862b0e1747e0da10b33e6b31a0435344a1a0ca6f9994a88e17a5e95bcf13abaa4f9040046d1c27cc5e9983ecc4e
SSDEEP 192:tiKTtFctGtct4teAGEZdUatFdtYt5tDtf:tiWt+tGtct4teAGEIatjtYt5tDtf
TLSH
T1A8D1F8CA6BB12EB4BFC5EF006617EE54919150F6A77040983392E6D7F16200D63BCEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

header.bmp

Path C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp
Size 7KB
SHA256 a2acbb1b55df6a88829fbc4eb7881d8c39af8d4fb97d07cc9dc7bdba2229ea22
MD5 fcb4c9763f9f349690b128e04893e683
SHA1 3b9aebc5500ec0af591b94ed26fdebb06ab7ce62
SHA512 9ae7e8e16fe499048d86936a005cc84ab8293bdce4585d57cee0c5092c4ff872533b11b53be7b094ba3dd58f8190daa122e6cb2ebb20062dd18a2f1cc7f20293
SSDEEP 48:OI/ZV22222222222222dxfpupWHP6x22222222222222222222ic:OK7Lv6oc
TLSH
T1FCE10D420A3FD61C559A5C29EC55A5FD8CBB1D69DF09A1772000739BFAB0382F3D146B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splash.bmp

Path C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp
Size 150KB
SHA256 195b36b5a4d6f40ac350fda0fd90aa0dc3b4f7d72c047f6679680c7c34aade27
MD5 bb2998c80d5458d727ccefdeeac0a9ea
SHA1 356c55b7d8985db5ab21401221a58e95e0ea7940
SHA512 cb724e0eb06af18c1d756bee49c9c0d38951c8b9a93371e2c733cd0b9ec05706d2b8eb228b7dab9440cdcbd0e085be5ee751259b10987e44f0273131a5792907
SSDEEP 48:wvkAk8kvdcoBzEqc96ZvEMuC6677BYkler6l38iCAe39rpkIfJBBe+zkv/////YC:t5Yasz39rpfze+krWxu7kxxlwkLDWMq
TLSH
T16AE37EE462472B3C86DED265B586416A40139C9D33B1CDA49D293C508E78307FF6EAFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini
Size 1KB
SHA256 08235a11a5855aa5230da47fdf249e60e7c6568f76ce01023556e89340cccce1
MD5 46fdc9c52c64b340f99a822f43208d9c
SHA1 dc6013650c12ca72ab6d833b9a880725eba1f7d0
SHA512 8635e9ed03d5c64e18a9db99b6b85221e394f0b6e96e9a9927372b7d793acc98009d1524dadae8ed1c0455ffd8d5dd566ac5a54af25a15b995edbf32642a0d11
TLSH
T12611B9AE8A397C569F7A309A303A3F8512C01883E671E69455B7D2C1CB4401713A803B
MD5 SHA1 SHA512 TLSH

Submit Download

unzip.exe

Path C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
Size 828KB
SHA256 ecb69cb30ee6a1111ce861c321ae7392304c3e687a94a0bd37a62fb704c7fc91
MD5 8861ea631aaebbf9121306cf2b25007f
SHA1 cbaba93f66055c69506174785460d2fdd432ebed
SHA512 e385bdb11b9760b7cbdeec5858f042edb92b2fbb5970698b33f2ff76b5d0f06b1605557ac4a859f8988aedf730f2c2c5bc3ffe1b35b51851ab7ec5af4bf84cc4
SSDEEP 24576:F+irRnD9iCygJsOcSZJv7xhWg4YXps1ZGTqM:zD5sRSZJe54s1ZGTl
TLSH
T15B057C213EC0D032E6A2017799BDBA2581BEB9710B365AC7A3DD0A1D6E745C31F3275B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winagent.exe

Path C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
Size 13.0MB
SHA256 6c6e713255a88bc1aec925bac68cb9ad9f30662df1eee1a02349f39cea06d994
MD5 5c576dfe054590a6d7fae41d99eb46e5
SHA1 3ebdb53b7bf07613e229475ea132c57996127c6e
SHA512 3683f62ce4e4b6b83ff4b79f9d9757e13c857a8103f88896eb1fda6c349b2e7f00bb5858839a256f520694cf0e7c0abc5e2069b06d39fb454d841cdf6ba5af15
SSDEEP 196608:fCG/11k/n2fOwt0artwaQTO4OkJm7zDP3:d/Hk/n2WwtmNKZkJmXDP3
TLSH
T140D63A303A42C63BEB9201B2997CAE6F545D9E510F7964D7D2CC0E5E1EB42C30B36A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
Size 4.1MB
SHA256 f829693efd0dc0c139d624cf651fbd71c98bbd97ed7ac240ef4c875dc5be0db0
MD5 46a67648e1b1e03b8158717b9b333245
SHA1 dce591d15ffc7173822e3bf475c0912a15f2e8af
SHA512 e23c581470e88c7fd2a985d237751462f4ff6569b1f134fe5a438631280ba5823fc1cbcfe9338e5cc087f5d793ffa5ea89be0982ee5e1d8be4d68a0bce0065be
SSDEEP 98304:NlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTd6:fU1Ls6DjX34gSVNU
TLSH
T150163373282D4CB5FA64363419A543112ABE2F4DAE38705A73FD4BBE9707AC509CE385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.zip

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\package.zip
Size 12KB
SHA256 8ceabc15faab31019b9cbb16cfc82f26575c5d0397dd1dc24a24729210a8f71d
MD5 240a1d4ea18d531f0a12020b246900b2
SHA1 7838d3643f407c87a13a0c3cd188d92f9f53a04c
SHA512 68297c9b870fce53187624636d3409aed81bd5a7cfdf5262a21ea1fea2304e1bb68cb8b168189f0ef3dbf934d5dc9bf6b1d2538c87f7a62b3d1e997d00dcac04
SSDEEP 192:DWBaX8filiRVKE9awZ6cXEbQaOEx/4KLdXinaNawAawWDwCsP4mFvccCt5WGI1M/:DS5fNV91Xyz/GKLgnaN6Ezsr/C7bIC6C
TLSH
T1BF427C485666E2D5CC1F9ABD3F476E8BA39F524240D28546FF1C382C0EC1EE983A156E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NSLG8.tmp\agent.tmp
Size 690KB
SHA256 6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
MD5 a2c4d52c66b4b399facadb8cc8386745
SHA1 c326304c56a52a3e5bfbdce2fef54604a0c653e0
SHA512 2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6
SSDEEP 12288:yTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5MRxyF:6PcYn5c/rPx37/zHBA6pFptZ1CEQqMRU
TLSH
T1BDE46C32F2A0C837D4B31E789D5B82D55936BE103E38A59736E81F4C4F796817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3368-102-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3368-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4872-101-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4872-19-0x0000000002270000-0x0000000002271000-memory.dmp

Download