921849539fe7317e7453895f0eb3d02cce6c5b5cbaaefe45dc430ca3387c9601

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026/Es0986544622442525584.exe
Size 4.2MB
Sample260622-phlevabz5q
SHA256 921849539fe7317e7453895f0eb3d02cce6c5b5cbaaefe45dc430ca3387c9601
MD5 1ca670e3e324f27793e05fdb94e42292
SHA1 9875469b4cfb7b76586bc67a3a4e3a8eccb26485
SHA512 2b32778aec48ef984a2f8f9171ce0c67d0a81c1b484ed61579261c218482e8a135bb952059810a540148b9aa6c08e0e6ba2a19535c351e731da820d3e7763b1e
SSDEEP 98304:5LAGlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTdr:ZpU1Ls6DjX34gSVNx
TLSH
T14926333338ACCCB2F96026305DA8536166FD6B181E34505F73BC4B2E9B2B7C5458E79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery installer

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-1JRMN.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\tagline.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\tagline.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\iscanruntime.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-JF3D7.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\247.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\unins000.dat	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-GJBB7.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-F553A.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-A7OBU.tmp	agent.tmp
File created	C:\PROGRA~2\ADVANC~1\DSC_Config.xml	winagent.exe
File opened for modification	C:\PROGRA~2\ADVANC~1\settings.ini	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\assetscan.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-EK5PM.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-CM2RU.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-0NSCI.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\unins000.dat	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\247_header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\debug.log	winagent.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-PCB35.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-SQ68E.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus2.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-3EEQL.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus3.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-O2ORI.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\pavcomm.dll	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-P2EN3.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\about.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-0DQ66.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\PavApi.dll	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-REDFJ.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-DO4FD.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-QL76H.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-1QJ94.tmp	agent.tmp
File created	C:\PROGRA~2\ADVANC~1\247_Config.xml	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\_avg7api.dll	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-TELN3.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-5N61P.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-5U67O.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\247.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\about.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\247_header.bmp	unzip.exe

Executes dropped EXE 5 IoCs

pid	Process
3352	agent.exe
5100	agent.tmp
3944	unzip.exe
4484	unzip.exe
2136	winagent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Es0986544622442525584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unzip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winagent.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x0004000000016b4a-6.dat	innosetup
behavioral2/memory/3352-12-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/3352-103-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}\InprocServer32	winagent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5100	agent.tmp
5100	agent.tmp
2136	winagent.exe
2136	winagent.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	2136	winagent.exe
Token: SeSecurityPrivilege	2136	winagent.exe
Token: SeBackupPrivilege	2136	winagent.exe
Token: SeSecurityPrivilege	2136	winagent.exe
Token: SeBackupPrivilege	2136	winagent.exe
Token: SeSecurityPrivilege	2136	winagent.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5100	agent.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3352	4308	Es0986544622442525584.exe	88
PID 3352 wrote to memory of 5100	3352	agent.exe	89
PID 5100 wrote to memory of 3944	5100	agent.tmp	90
PID 5100 wrote to memory of 4484	5100	agent.tmp	92
PID 5100 wrote to memory of 2136	5100	agent.tmp	94

C:\Users\Admin\AppData\Local\Temp\2026\Es0986544622442525584.exe
"C:\Users\Admin\AppData\Local\Temp\2026\Es0986544622442525584.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Users\Admin\AppData\Local\Temp\is-4V95L.tmp\agent.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-4V95L.tmp\agent.tmp" /SL5="$702C6,3999367,56832,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe" package.zip
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3944
  - - C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe"
      4⤵
      Executes dropped EXE
      PID:4484
  - - C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe" /autoinstall
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.lng

Path C:\PROGRA~2\ADVANC~1\1.lng
Size 32KB
SHA256 0e5882114864d4a708b472d524063867fa770958b770b67fc0af7f8ed4757ad2
MD5 e4361def38811d2f295b5686bd2c2b5b
SHA1 91002014191d2e09616f619a81c7cafb652e2815
SHA512 f1ee01ec34edfe27f5f48be84f0a36a572e709bd46d29114617785954576e71ab55d8a8090256a5efff6d2a63c1625dac0a3275b9dbc55ba69d6e1861c14a755
SSDEEP 768:MdUriNbhCz1TSobrPjgZcN6OVLjF2JgXWdo/aqmRy17U:MGriNNron0Rsg
TLSH
T1D9E2D857A30286AB1F261198B90C53E27B38818D9733262534EED15C36CCE5CD7BB5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.ini

Path C:\PROGRA~2\ADVANC~1\services.ini
Size 3KB
SHA256 b3ff7c0a671e3d6cf02c2422fd7f0705bf4e22775e1b91e1fd4cf604bfc47646
MD5 7e3633ed291fceeac2484d2e1133fee4
SHA1 5f07cab96e6c1b547959b44bab5759a89bc2a4ea
SHA512 6efa3027cebdac7f2bcb1ef4afe6fce4809071fd94415db31844fbef6a791aff2bca04b964ec5793c73d5ee51b2e05310b1d622acc1f84aa7966af26a2775f16
TLSH
T10171CC1726D0A97F217831A866D57201239F80B8DB3CD585EB9BCCDBED88C0B316E784
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 b334ba00a47b647d925081ccadc9d489a284d4e92fb574cec551932646cc51ea
MD5 595f2060929d395ad5609cf9823ea231
SHA1 4455ccb75bc65bb1dc76c6de16893722bac882ea
SHA512 cd24f5657b53449df090bed213d7f61c4a51772346fd7b14762cf4d9a9290b4bd1a34deceac77d759fd98794135743903377c93f37ca4f51054f86538807e753
TLSH
T1E321CA9ECD79295A6F7A70AA702A3E8512C01543E670E39441B7D1C0CB4405713A443B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 d55315f57451391ec0cd09571ac0b8277cfcfebcb00164f01e53143b95a943be
MD5 5ef196c31fc94980c3bbda69979401ff
SHA1 f2912c7ab803b8f4d856944ac7073279e8693973
SHA512 54a8ca953a26c4cc0e048f765b31a4dd29501be52df6a2dd1f63d39c54bf6c0854d66f90c42baa67a13067defba006409d0f42f599decf0543a7be2b6bb5774d
TLSH
T13B21CA9EC97929566F7A70AA70263E8512C01543E670E39481B7D1C0C74405713A443B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 b3e106a8d52a9fd7edf311159186029dcef1ef8cd501e9b957967652a7e87dce
MD5 cb4ad77153c6f3ae4949f79f9f1183d9
SHA1 15a60842e2e1e1a558631142993745bef6bbe45d
SHA512 dd3fe010a0aafd7bdd465ebedb2d5525a8f2a57697ffa4ad5521b8951f16943fc4c1d1632afe8e3b0343cee9a7e930c91308aaa6dd0c4755b9c17fe81fa19c82
TLSH
T14721B99ECE392C5A6F7A70AA613A3F8512C01587F670E39456B7D2C1CB4405B13B843F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 362ea5c43af804766890060b5c30d24a7f9e0e407002625e8ff0f14b06ff7342
MD5 1299249f6b97ba537b9be65466cc7617
SHA1 9c7f8168ed1f06b39d149a25b9b230cc2f469eab
SHA512 8d12b34bc2561110b571ef88bebd6a10749f91059aa190146d482e923bbba5fa0c689ebbb54fd59e6fb62204a01dc4355fa75904cefd63084e0232dc0c82815d
TLSH
T1A621CA9ECA7929566F7A70AA702A3E8512C01543E670E39481B7D1C0C74405713A443B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 2134e785b1477af4ad38540d3a21a24d3b7b7c688c06411851372a73333a8594
MD5 d0f50c56f17dd710c96f20d44a8907e5
SHA1 8b2bd66dafc3fe7fde046d6d5d423f57306cc807
SHA512 238f4f9efa0338d359825d701a681ffa7d9b1de56206e726d78e958a6a604c5fe876f0de96bc82c73a767d51abf8dc3dbe42662d02ed9963cc51c384879e5121
TLSH
T12D21CA9ECE7929566F7A70AA702A3E8512C01543E670E39441B7D1C0CB4405713A443B
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 2KB
SHA256 be383ce8d27007abd56d0e329376f43f20c660d5b2410a49c671cb3eb5608ac2
MD5 4097b5366706664db5a23c0d3cfeb093
SHA1 e8745b343c8fce033bbe58206343bbe8451f6ae7
SHA512 54f2ad8e5c59d3f9ec4734752376a9dafac9a4fb3c03108d3a1ec7e760b6c5c21ba86db511abf540ef868041027936efcb6ce95aaac7ebb34c78d9dba28f9235
TLSH
T1D4414DCB0CF26EB48F26EA05729DFC15D8B0103A9B74909436A2E697F572146E1FC536
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 3KB
SHA256 cb2a89031ee03f505e4d847b77b01a417f33f84fee53cb62fcb347e244036e85
MD5 e388360bf31aeb5bd30eb25b9d35f753
SHA1 96f1ab3301a3b1ef6053862985f39779a6e33568
SHA512 0f01f40b4d4fef760c833f9825ed62a14c3b33cd440e1cd6f6f8e3391e66af492ce44a2f1cd8d3a8f141415e74ab555b508771d2558c84c895ca72648b3a67b4
TLSH
T1F8814ECB0CB13BB08F67BE08265EFD55D8B011368B74909436A2E6A7F576009E1FC676
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 5KB
SHA256 41a64d44b54f00bbe87fe21dd33b48ce5b9dd1cc26280543658711eaf200d647
MD5 09c46a516d913e6978e43f352e8098e1
SHA1 b430fcd443023751209dec87f07c0e3501109748
SHA512 7cb1872c0fc477bfa7e97e3b8c21a851543adf8e9d1081f4c1d561ebe20fdfd25dda522aea479572a484ef621ab03c768c6be50c98dacc02300e1d1941f908a4
SSDEEP 96:oHI/wdkmwH6tF8tuvtRxtRtj1E++X9X9tGjdPchwU1tF5tt4ti3:gMatF8tYtntRtdjdPmwU1tF5tSti
TLSH
T1D6C13ACB0CB13AB08F667A09325EFD55D8B01136CB74909436E6E2A7F17600AE5FC676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

header.bmp

Path C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp
Size 7KB
SHA256 a2acbb1b55df6a88829fbc4eb7881d8c39af8d4fb97d07cc9dc7bdba2229ea22
MD5 fcb4c9763f9f349690b128e04893e683
SHA1 3b9aebc5500ec0af591b94ed26fdebb06ab7ce62
SHA512 9ae7e8e16fe499048d86936a005cc84ab8293bdce4585d57cee0c5092c4ff872533b11b53be7b094ba3dd58f8190daa122e6cb2ebb20062dd18a2f1cc7f20293
SSDEEP 48:OI/ZV22222222222222dxfpupWHP6x22222222222222222222ic:OK7Lv6oc
TLSH
T1FCE10D420A3FD61C559A5C29EC55A5FD8CBB1D69DF09A1772000739BFAB0382F3D146B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splash.bmp

Path C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp
Size 150KB
SHA256 195b36b5a4d6f40ac350fda0fd90aa0dc3b4f7d72c047f6679680c7c34aade27
MD5 bb2998c80d5458d727ccefdeeac0a9ea
SHA1 356c55b7d8985db5ab21401221a58e95e0ea7940
SHA512 cb724e0eb06af18c1d756bee49c9c0d38951c8b9a93371e2c733cd0b9ec05706d2b8eb228b7dab9440cdcbd0e085be5ee751259b10987e44f0273131a5792907
SSDEEP 48:wvkAk8kvdcoBzEqc96ZvEMuC6677BYkler6l38iCAe39rpkIfJBBe+zkv/////YC:t5Yasz39rpfze+krWxu7kxxlwkLDWMq
TLSH
T16AE37EE462472B3C86DED265B586416A40139C9D33B1CDA49D293C508E78307FF6EAFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini
Size 1KB
SHA256 1e82c7dea3c62ed2697cf3631da429176eb688f94d46e66a836a947fd1c1e405
MD5 56306fd9f73c4eefce7fe6e19ae159c0
SHA1 3fa0b6cd1b253baf5cfc71732fb835044addee3e
SHA512 0d3171f6d5f09bf06ed19d1610b2ec742a050de232a15e5e30b74b075201a7db21536964eae435cc9fe14a56c2429c80cd9018c7835c15865b2d9b8436976cb2
TLSH
T1DE11B99EC93928565F7A30AA61363F8512C01583E670E29456B7D2C1CB4401B13A843F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini
Size 1KB
SHA256 08235a11a5855aa5230da47fdf249e60e7c6568f76ce01023556e89340cccce1
MD5 46fdc9c52c64b340f99a822f43208d9c
SHA1 dc6013650c12ca72ab6d833b9a880725eba1f7d0
SHA512 8635e9ed03d5c64e18a9db99b6b85221e394f0b6e96e9a9927372b7d793acc98009d1524dadae8ed1c0455ffd8d5dd566ac5a54af25a15b995edbf32642a0d11
TLSH
T12611B9AE8A397C569F7A309A303A3F8512C01883E671E69455B7D2C1CB4401713A803B
MD5 SHA1 SHA512 TLSH

Submit Download

unzip.exe

Path C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
Size 828KB
SHA256 ecb69cb30ee6a1111ce861c321ae7392304c3e687a94a0bd37a62fb704c7fc91
MD5 8861ea631aaebbf9121306cf2b25007f
SHA1 cbaba93f66055c69506174785460d2fdd432ebed
SHA512 e385bdb11b9760b7cbdeec5858f042edb92b2fbb5970698b33f2ff76b5d0f06b1605557ac4a859f8988aedf730f2c2c5bc3ffe1b35b51851ab7ec5af4bf84cc4
SSDEEP 24576:F+irRnD9iCygJsOcSZJv7xhWg4YXps1ZGTqM:zD5sRSZJe54s1ZGTl
TLSH
T15B057C213EC0D032E6A2017799BDBA2581BEB9710B365AC7A3DD0A1D6E745C31F3275B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winagent.exe

Path C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
Size 13.0MB
SHA256 6c6e713255a88bc1aec925bac68cb9ad9f30662df1eee1a02349f39cea06d994
MD5 5c576dfe054590a6d7fae41d99eb46e5
SHA1 3ebdb53b7bf07613e229475ea132c57996127c6e
SHA512 3683f62ce4e4b6b83ff4b79f9d9757e13c857a8103f88896eb1fda6c349b2e7f00bb5858839a256f520694cf0e7c0abc5e2069b06d39fb454d841cdf6ba5af15
SSDEEP 196608:fCG/11k/n2fOwt0artwaQTO4OkJm7zDP3:d/Hk/n2WwtmNKZkJmXDP3
TLSH
T140D63A303A42C63BEB9201B2997CAE6F545D9E510F7964D7D2CC0E5E1EB42C30B36A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
Size 4.1MB
SHA256 f829693efd0dc0c139d624cf651fbd71c98bbd97ed7ac240ef4c875dc5be0db0
MD5 46a67648e1b1e03b8158717b9b333245
SHA1 dce591d15ffc7173822e3bf475c0912a15f2e8af
SHA512 e23c581470e88c7fd2a985d237751462f4ff6569b1f134fe5a438631280ba5823fc1cbcfe9338e5cc087f5d793ffa5ea89be0982ee5e1d8be4d68a0bce0065be
SSDEEP 98304:NlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTd6:fU1Ls6DjX34gSVNU
TLSH
T150163373282D4CB5FA64363419A543112ABE2F4DAE38705A73FD4BBE9707AC509CE385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.zip

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\package.zip
Size 12KB
SHA256 8ceabc15faab31019b9cbb16cfc82f26575c5d0397dd1dc24a24729210a8f71d
MD5 240a1d4ea18d531f0a12020b246900b2
SHA1 7838d3643f407c87a13a0c3cd188d92f9f53a04c
SHA512 68297c9b870fce53187624636d3409aed81bd5a7cfdf5262a21ea1fea2304e1bb68cb8b168189f0ef3dbf934d5dc9bf6b1d2538c87f7a62b3d1e997d00dcac04
SSDEEP 192:DWBaX8filiRVKE9awZ6cXEbQaOEx/4KLdXinaNawAawWDwCsP4mFvccCt5WGI1M/:DS5fNV91Xyz/GKLgnaN6Ezsr/C7bIC6C
TLSH
T1BF427C485666E2D5CC1F9ABD3F476E8BA39F524240D28546FF1C382C0EC1EE983A156E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4V95L.tmp\agent.tmp
Size 690KB
SHA256 6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
MD5 a2c4d52c66b4b399facadb8cc8386745
SHA1 c326304c56a52a3e5bfbdce2fef54604a0c653e0
SHA512 2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6
SSDEEP 12288:yTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5MRxyF:6PcYn5c/rPx37/zHBA6pFptZ1CEQqMRU
TLSH
T1BDE46C32F2A0C837D4B31E789D5B82D55936BE103E38A59736E81F4C4F796817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3352-103-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3352-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5100-102-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5100-19-0x0000000000780000-0x0000000000781000-memory.dmp

Download