2eb291bcf22a1e0bb5c2b7814a71f958979b2f48b014ea7ab19623a62e8ef39f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voicemail.exe
Size 14.1MB
Sample260806-g2dkcavdmc
SHA256 2eb291bcf22a1e0bb5c2b7814a71f958979b2f48b014ea7ab19623a62e8ef39f
MD5 441b9eb8edfc18185e2d6a0ad4da6c60
SHA1 506e006dfdc6ebd2c764cad40f5ad671a00b2f60
SHA512 2be6c0ec81645c825341da1d2b17f6267d502be4dfcb1b1645c3f50bdb022e7034d5cef2782d3aa260d2af1a1f857317e62467312a855530c9a68717fa06c523
SSDEEP 393216:/IF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1m:crRxvoC/7a0jUxX7h1m
TLSH
T131E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery installer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	voicemail.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-PQPE0.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-DD7CK.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-AVRML.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-G3GBB.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\ResourceUpdateService\ResourceUpdateService.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-0HOQ1.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp	unzip.exe
File opened for modification	C:\PROGRA~2\ADVANC~1\settings.ini	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus3.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-O9N3T.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-KA2PD.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-TOJGD.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\ResourceUpdateService\is-H8T7L.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\_avg7api.dll	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-J2ESK.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-GINU5.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\debug.log	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\PavApi.dll	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\pavcomm.dll	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-I7C53.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\tagline.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-F43VB.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-0QRN0.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\about.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\featureres\is-0I5GV.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\247.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-SAENC.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\about.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\iscanruntime.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-U5RRC.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-GVL7R.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\247.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-IV81C.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-5VNTB.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-TRHHM.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\unins000.dat	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\247_header.bmp	unzip.exe
File created	C:\PROGRA~2\ADVANC~1\247_Config.xml	winagent.exe
File created	C:\PROGRA~2\ADVANC~1\DSC_Config.xml	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus2.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-4MH81.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\assetscan.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\unins000.dat	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-H7MMO.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\package.zip	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\tagline.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\247_header.bmp	unzip.exe

Executes dropped EXE 5 IoCs

pid	Process
2568	agent.exe
4724	agent.tmp
1580	unzip.exe
4356	unzip.exe
4664	winagent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
748	4664	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	voicemail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unzip.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x000f00000002433c-6.dat	innosetup
behavioral1/memory/2568-14-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/2568-148-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}\InprocServer32	winagent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4724	agent.tmp
4724	agent.tmp
4664	winagent.exe
4664	winagent.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeBackupPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeBackupPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeBackupPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe
Token: SeSecurityPrivilege	4664	winagent.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4724	agent.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2568	1868	voicemail.exe	86
PID 2568 wrote to memory of 4724	2568	agent.exe	87
PID 4724 wrote to memory of 1580	4724	agent.tmp	88
PID 4724 wrote to memory of 4356	4724	agent.tmp	90
PID 4724 wrote to memory of 4664	4724	agent.tmp	92

C:\Users\Admin\AppData\Local\Temp\voicemail.exe
"C:\Users\Admin\AppData\Local\Temp\voicemail.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Admin\AppData\Local\Temp\is-BEGEB.tmp\agent.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-BEGEB.tmp\agent.tmp" /SL5="$D0060,14350441,56832,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe" package.zip
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1580
  - - C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe"
      4⤵
      Executes dropped EXE
      PID:4356
  - - C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe" /autoinstall
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 1904
        5⤵
        Program crash
        
        PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4664 -ip 4664
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.lng

Path C:\PROGRA~2\ADVANC~1\1.lng
Size 32KB
SHA256 0e5882114864d4a708b472d524063867fa770958b770b67fc0af7f8ed4757ad2
MD5 e4361def38811d2f295b5686bd2c2b5b
SHA1 91002014191d2e09616f619a81c7cafb652e2815
SHA512 f1ee01ec34edfe27f5f48be84f0a36a572e709bd46d29114617785954576e71ab55d8a8090256a5efff6d2a63c1625dac0a3275b9dbc55ba69d6e1861c14a755
SSDEEP 768:MdUriNbhCz1TSobrPjgZcN6OVLjF2JgXWdo/aqmRy17U:MGriNNron0Rsg
TLSH
T1D9E2D857A30286AB1F261198B90C53E27B38818D9733262534EED15C36CCE5CD7BB5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.ini

Path C:\PROGRA~2\ADVANC~1\services.ini
Size 3KB
SHA256 b3ff7c0a671e3d6cf02c2422fd7f0705bf4e22775e1b91e1fd4cf604bfc47646
MD5 7e3633ed291fceeac2484d2e1133fee4
SHA1 5f07cab96e6c1b547959b44bab5759a89bc2a4ea
SHA512 6efa3027cebdac7f2bcb1ef4afe6fce4809071fd94415db31844fbef6a791aff2bca04b964ec5793c73d5ee51b2e05310b1d622acc1f84aa7966af26a2775f16
TLSH
T10171CC1726D0A97F217831A866D57201239F80B8DB3CD585EB9BCCDBED88C0B316E784
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 82e2a20f56a8812e83694b8a99e18d1e2b304da07b7c6176f915a59e6e0b8a20
MD5 78e5afb5ee3e0fbba53842690dfb227f
SHA1 c6958a4469e1250684b03bdb8eef1357070859e0
SHA512 8ae83dabf0e24b92ea1c5a0601c72767ac8ca436d870482b0079448354be33857947e9eae12484900827b57112d406ba103d7cf71319045c7a579568b7397e7a
TLSH
T13F1189E76B1E49476F7E70EB70253E8B06D10457EA56320490EF92C4CF5C0DB2AA8036
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 73c33956da0b6774aa36a550a0a209c2caa446807cc60fd033e52b36cb9a1f6b
MD5 2684f3d855e10dd9532cf1383bac29b8
SHA1 2e541ab29e3572f3193409e08fc21a8250e01be7
SHA512 df8cd63b9722d3a30c763629c3c207568250a79d13707a88ea73437a4fd1e98a739734c546a53afebebc2b74a25561341cd358b832aa2708ca9efd4c4ac3343a
TLSH
T1D81166E7AB1E49476E7E70EB70253E8B16D10497EA56230490EF92C48F5C0DB3AA8036
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 619e6a97943532d6b6e088de82d1188f2574386a3b064aff5e552b4deda219a9
MD5 9667680f7c8531b6520c2aa5b9003604
SHA1 42c63658ecad31cc58eb8761f7bb20cc8b0f72d9
SHA512 7dcc2d10e0211d1ec9188ac6942bf36b83d2f1eed524f2d3513737a36889780faedffd405024599abbbea9911a1f8cb0bbedb2d671bdf78ac5d5740360e90dac
TLSH
T10C116AE75F1D49476E7D70E770153D8B16D10457EA56230450DF91C48F5C0DB2A94036
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 983985369c2d6af51ad18295bf33e38e77d865ea0c4521d2e695a31cc25559cb
MD5 a9e99533d32107e448c05cf24301a893
SHA1 e0702e8521ca1ff0e29b870b57bc50af721565f1
SHA512 6ed6d9c965665382ce9cdf69e738095612542c2865368c412c9e1e4542f0f350bdc9a111b4470090520012581f64c594d1c5b2affc13984d350154b77fd33fb8
TLSH
T1951166E7AB2E49476E7E70EB70253E8B16D10457EA56230490EF92C48F5C0DB3AA8036
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 2KB
SHA256 4622012a757bc4680aa50619d1798b1a755b8f3947c2f888d77eb065dd4e3911
MD5 9dd9284b60806f925de094a4ff448aee
SHA1 6ff381cbbfcad0435933369b0776a07d96a03c07
SHA512 25fc75b33520399e18c419e8b94bd5d85803d151258787425be786fd83eabcb720948e330f4427859e6911a38107be87add4a73b3152fbcbb24428d457d5b4d8
TLSH
T1EB4173CA3CF50DB8AE42EB06B2579C64E0D970772BF0903631D35615815394BC2FC5AE
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 3KB
SHA256 951d0ab465ffe9da4f371b00b37f5e020278c7d4e7189d3b258b31a8c06cb772
MD5 12b75bbadbd840aaa481898a64f62428
SHA1 d730d4d33142720637f1e3749ec6049ceb438c73
SHA512 82aacc06519eca1eebcbdeb8076eec777a9cbfaeb834784de854f36ac51c46a7e0cc6a965f3afc81d86bda483d83d53cdb7a2e0c4bb867b229f887722d705f25
TLSH
T14E8173CB3CF81DB4AE42AB46B62BDC54F4D570B32BB0903631D35625815794BC2FC6AA
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 6KB
SHA256 c25c82406bc2879c2c2ab8a67e7f31d95b6a2ca358e0c86fef2b7606ce58368b
MD5 a01d7b6967a7d650f40813d7f45ce59d
SHA1 396ccc9334e1369de8f25a9f7ba62f8c3f344432
SHA512 609f91f406beadac6a11f42833f4ad75c9c0f5427b537741a8b90d5d722e09c6122c4fa25ec3419f12c1400c0304a63898e39fb6cfa808cdea6a4ec0014b3bea
SSDEEP 192:SyovEtF8tytItctJeE6XDUgtFztwtvtxtR:SyovEtutytItctJeE6AgtRtwtvtxtR
TLSH
T11DD196CB3CF41DB4AE426B4AB62B9C64B4D4707727B0903671E34665815790BC2FCAAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsc.bmp

Path C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp
Size 150KB
SHA256 5a8c508fd0a0a75a649ccb939454a0db0c5240f08551a179cb41e332bdbf7f18
MD5 3c4ea39c75489a593915e1dcd3ac1626
SHA1 0415d936fed4266aa7f086d48574d75a2562e4f9
SHA512 1621a580aa0830da653cdc642178fdddfccdeaf64180fc6bdabead572111edadcb3d119170a764e0dcd60bad6e8ed7f0b07736083a909a31911e188f9fc09f45
SSDEEP 96:3m0a5Yasz39rpfze+krWxu7kxxlwkLDWMq:3la5YasN163WuwxxlwkPWMq
TLSH
T187E398E4658B2B3C8ADDD261B446126E00174C9E33A5CD956D683C548EBC303FF696FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsc_header.bmp

Path C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp
Size 7KB
SHA256 a2acbb1b55df6a88829fbc4eb7881d8c39af8d4fb97d07cc9dc7bdba2229ea22
MD5 fcb4c9763f9f349690b128e04893e683
SHA1 3b9aebc5500ec0af591b94ed26fdebb06ab7ce62
SHA512 9ae7e8e16fe499048d86936a005cc84ab8293bdce4585d57cee0c5092c4ff872533b11b53be7b094ba3dd58f8190daa122e6cb2ebb20062dd18a2f1cc7f20293
SSDEEP 48:OI/ZV22222222222222dxfpupWHP6x22222222222222222222ic:OK7Lv6oc
TLSH
T1FCE10D420A3FD61C559A5C29EC55A5FD8CBB1D69DF09A1772000739BFAB0382F3D146B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini
Size 1KB
SHA256 c1df9d743555c835ba381fd072b33252445dd030228f94ccc05d122fb2c36ed5
MD5 0afd36019d5b5cf83757f4cd5ab889e5
SHA1 e41df824fcbc3f3dae4c847ea877c97862beeb8b
SHA512 ad69b6b757ed12d05f8ca16a3720976a1da0e592acbfb5369a4d1e4b26eab07eeaa8ccab32faffea9ef1ed41e12d6983e49dc7864f00c4218b84437a1abd9efc
TLSH
T1BE1179F76B2E4C47AF7E20DB70253E8B06D10457EA56210494EF92C4CF5C0EB2B94036
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini
Size 1KB
SHA256 ca869dfd5ce3ba3f8331411f6240f7d4b8e30cb33dc08e5fefa0f2895be5b2d5
MD5 05b26168c549751e9a36d06d297288e3
SHA1 e5f11512bd922d1962e8426a83bbf9f2dc2e656e
SHA512 b8a96506a37a53024cc173be1272b999cb0fb1f4e60307cdabde19f276f16f29ed1a1398b3b52904224fa896bf5912eafb739fbae9e430ab5aa956ead2224e0d
TLSH
T18A1149E75B1D49476F7D20EB71253D8B05D10457EA56221494DF92C4CF5C0DF2A94036
MD5 SHA1 SHA512 TLSH

Submit Download

unzip.exe

Path C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
Size 778KB
SHA256 7560b1365c9bcb05462a02ff7cadbdba3f231b84d7437406dd5373fc44773865
MD5 ac55e154d26abbf4f92da5d17b421cda
SHA1 a73904902364a3939ccb8e0d684138110cce44d4
SHA512 235b0e1c2c8f85a4453946c87a9dafc0834ea41b1a379225296248cb5515cc89f51b1171cea6d62f0e156123197d3e826ce2e991985567782af226baf7161e03
SSDEEP 12288:dnVouef/cwTCG5CfMks9O7cAvqP0HmskT7YLxQ3yrAx:dSuqcwRkMh93AvopT7KRrAx
TLSH
T1C3058D2139C0C03BE6B202B2487DBA2690BEBD610F755AC7A3DD0B5E5A745C25F32767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winagent.exe

Path C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
Size 13.8MB
SHA256 2aae6e6933d82ab84eaf8810f8538157850533622de14385f4c95c748cf06edc
MD5 5f636207d447b422bbf023439c5e5fe5
SHA1 17b03b5be53f1ab76aa624a4d59263894dfb197d
SHA512 5284a55760c0329ead6d8144d3b8b83f1439f8008c4a65dd8b20ff5b3e24a9be3e6f1ddc1487f7d3fee43027cdeecfaf40a94978fbc1c53a2fb56c02a5717d78
SSDEEP 98304:kRdGA1QWmHfHxAOgbg6ZgJIdgygXIl22SjmROo5Xj/uYJi43stPNSAcuOKxV6UUM:kiR5HeeIGyIw2UOo5Xzuk5ywAoo5Aby
TLSH
T142E63C303A42C57BDA9202B2997CEE9F105EAD510FBA64CBD2DC1F5E29B45D30B31A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
Size 14.0MB
SHA256 08caf67a3dc4036552d26b87773b63620b2fc12455c8477f130fae58ea77d0e4
MD5 3a64ad48a8d03e7ecc9f58355b8e393f
SHA1 2fc81038e88d8ba0d62c68e7d547c5cef036e597
SHA512 58e63d3da1d63d383fd5eaf07f15f298bf7df3078c71f2623eb85cf77ecec65c3ed5827fb5e119c80fae98d56aa538929406f137b14310036972231474d77dda
SSDEEP 393216:RF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1S:7rRxvoC/7a0jUxX7h1S
TLSH
T11DE633927D08EBBED421377486429B77178B3A74841024689E4C2CF26FA38CDF579B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.zip

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\package.zip
Size 12KB
SHA256 0f7a6342c47e78678d19092ba2cfad9faa41a17a4f738ef881ab9df33a21a7cc
MD5 1f48daf8420f1e5ea1505a30feacb015
SHA1 52150259f69543d95baeb53aae641b7176467af4
SHA512 5fee61684e715e025c47e8fb7cf17702de4c9867659bddc2c97fb2ce15b2dd6b9bf0181a83d4beba32347be652ee084b0b4aa674f03bde0937806c6638f1096d
SSDEEP 192:DWBaX8filiRVKE9awZ6cXEbQaOEx/4KLdXinaNawAawWDwCsP4mFvccCt5WGI1Zw:DS5fNV91Xyz/GKLgnaN6Ezsr/C7bI52
TLSH
T13F427D48566AE295CC1F9A7D3F476E8BA39F524240D2D506BF1C3C2C4DC2EE9836056E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BEGEB.tmp\agent.tmp
Size 690KB
SHA256 6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
MD5 a2c4d52c66b4b399facadb8cc8386745
SHA1 c326304c56a52a3e5bfbdce2fef54604a0c653e0
SHA512 2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6
SSDEEP 12288:yTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5MRxyF:6PcYn5c/rPx37/zHBA6pFptZ1CEQqMRU
TLSH
T1BDE46C32F2A0C837D4B31E789D5B82D55936BE103E38A59736E81F4C4F796817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2568-148-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2568-14-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4724-113-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4724-20-0x0000000000540000-0x0000000000541000-memory.dmp

Download