b67701e67c4106b459f1c42eb9bbb317b6aa0742359ed428792ed3c68b3ef133

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_946404150a40783c692a71042ef1d628_darkgate_elex_gcleaner_wannacry.exe
Size 4.2MB
Sample260823-fb2ntasglg
SHA256 b67701e67c4106b459f1c42eb9bbb317b6aa0742359ed428792ed3c68b3ef133
MD5 946404150a40783c692a71042ef1d628
SHA1 a7505c4a35fd03b709e7d70509e77ebef6dbbc80
SHA512 812fb384a869b229f41b24b022fc693599180069aa36690dd0db0c818f9f74dee1bb2b73d63f6d2f41ce09e037c437ae3ccc28c8d2c1a9557fa4365cb08a9bc1
SSDEEP 98304:8LAGlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTdc:k1U1Ls6DjX34gSVNG
TLSH
T16126333338ACCCB2F96025305DA8536166FD6B181E34905F73BC4B2E9F2B6C5458E79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery installer

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-9CMLC.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-HGF1Q.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-UNGDS.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\247.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\iscanruntime.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-843UE.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-HI841.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\247_header.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-LED58.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-ITSPM.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-9D630.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-B03PC.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\debug.log	winagent.exe
File created	C:\PROGRA~2\ADVANC~1\247_Config.xml	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\_avg7api.dll	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus2.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-SOES4.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\assetscan.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-1T8HT.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-CLUFF.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\247.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-I4D2C.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp	unzip.exe
File created	C:\PROGRA~2\ADVANC~1\DSC_Config.xml	winagent.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\pavcomm.dll	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\unins000.dat	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-EUERE.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-U3U0E.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\about.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-ARRMD.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-RIGJ1.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\unins000.dat	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\247_header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\wsus3.exe	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-LK5T8.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\about.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\tagline.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\PavApi.dll	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-D23FJ.tmp	agent.tmp
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-TR09V.tmp	agent.tmp
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp	unzip.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\images\tagline.bmp	unzip.exe
File opened for modification	C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp	unzip.exe
File opened for modification	C:\PROGRA~2\ADVANC~1\settings.ini	winagent.exe
File created	C:\Program Files (x86)\Advanced Monitoring Agent\is-8IQDA.tmp	agent.tmp

Executes dropped EXE 5 IoCs

pid	Process
5964	agent.exe
5704	agent.tmp
4876	unzip.exe
4940	unzip.exe
4832	winagent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_946404150a40783c692a71042ef1d628_darkgate_elex_gcleaner_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unzip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winagent.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000c00000001c58c-6.dat	innosetup
behavioral2/memory/5964-12-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/5964-136-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1081-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}\InprocServer32	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67B30939-3B35-11D2-A595-002018648BA7}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1072-989B-0000E87B4FB1}	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1073-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1074-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32\ThreadingModel = "Both"	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}\InprocServer32	winagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41564737-3200-1077-989B-0000E87B4FB1}	winagent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5704	agent.tmp
5704	agent.tmp
4832	winagent.exe
4832	winagent.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	4832	winagent.exe
Token: SeSecurityPrivilege	4832	winagent.exe
Token: SeBackupPrivilege	4832	winagent.exe
Token: SeSecurityPrivilege	4832	winagent.exe
Token: SeBackupPrivilege	4832	winagent.exe
Token: SeSecurityPrivilege	4832	winagent.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5704	agent.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 5964	1848	2026-08-22_946404150a40783c692a71042ef1d628_darkgate_elex_gcleaner_wannacry.exe	89
PID 5964 wrote to memory of 5704	5964	agent.exe	90
PID 5704 wrote to memory of 4876	5704	agent.tmp	91
PID 5704 wrote to memory of 4940	5704	agent.tmp	93
PID 5704 wrote to memory of 4832	5704	agent.tmp	95

C:\Users\Admin\AppData\Local\Temp\2026-08-22_946404150a40783c692a71042ef1d628_darkgate_elex_gcleaner_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_946404150a40783c692a71042ef1d628_darkgate_elex_gcleaner_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Users\Admin\AppData\Local\Temp\is-MUQO7.tmp\agent.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-MUQO7.tmp\agent.tmp" /SL5="$500B2,3999367,56832,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe" package.zip
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4876
  - - C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe"
      4⤵
      Executes dropped EXE
      PID:4940
  - - C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
      "C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe" /autoinstall
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.lng

Path C:\PROGRA~2\ADVANC~1\1.lng
Size 32KB
SHA256 0e5882114864d4a708b472d524063867fa770958b770b67fc0af7f8ed4757ad2
MD5 e4361def38811d2f295b5686bd2c2b5b
SHA1 91002014191d2e09616f619a81c7cafb652e2815
SHA512 f1ee01ec34edfe27f5f48be84f0a36a572e709bd46d29114617785954576e71ab55d8a8090256a5efff6d2a63c1625dac0a3275b9dbc55ba69d6e1861c14a755
SSDEEP 768:MdUriNbhCz1TSobrPjgZcN6OVLjF2JgXWdo/aqmRy17U:MGriNNron0Rsg
TLSH
T1D9E2D857A30286AB1F261198B90C53E27B38818D9733262534EED15C36CCE5CD7BB5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.ini

Path C:\PROGRA~2\ADVANC~1\services.ini
Size 3KB
SHA256 b3ff7c0a671e3d6cf02c2422fd7f0705bf4e22775e1b91e1fd4cf604bfc47646
MD5 7e3633ed291fceeac2484d2e1133fee4
SHA1 5f07cab96e6c1b547959b44bab5759a89bc2a4ea
SHA512 6efa3027cebdac7f2bcb1ef4afe6fce4809071fd94415db31844fbef6a791aff2bca04b964ec5793c73d5ee51b2e05310b1d622acc1f84aa7966af26a2775f16
TLSH
T10171CC1726D0A97F217831A866D57201239F80B8DB3CD585EB9BCCDBED88C0B316E784
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 87393ac0676fd17d9b868e4c0524317b258a56059eb60d84a28e329d576945e7
MD5 79ed0efbe869647ee24b9018b676f1ed
SHA1 e0dafd8cd25c0c62838da0683663f41ea9baff6a
SHA512 07de720fb67637a4df2709066457c2d6610bb9ced2b9f8293f0418e9b8566076e13c4e01befd8b1024b371b9a2d3165dabd8b66f2757ddf45045960e486403bf
TLSH
T12A21C69FCA392043BF7634FAB1163B4A17821A87E771E29165ABD0C4CA8402723B413B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\PROGRA~2\ADVANC~1\settings.ini
Size 1KB
SHA256 5afb56106206023a4da2fceb014ea1a80dd542ccd8e98f3b5862a11d05523fda
MD5 ee18f2245f3c9384aa2a58bcd0e9dbce
SHA1 3e5a8078a9a165834f7e0239735ff3f312313abb
SHA512 81cb17ca5cd7202d90f7dc287c41ad340649b13cc67838b2be44df428faf3ad49196ea9a2da3f36c6b525df43456a51e1c810f3a7670a50596d289e781cf0631
TLSH
T11D21C69FCE292043BF7634FAB1163B4A17821A87E771E29165ABD0C4CA8402713B413B
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 2KB
SHA256 ff5e16ebfd01caa0c098a2229d71b2cd262f2a2e1566fa4c073d1a4e8e7d3373
MD5 e7c6678661f93d1502379e8194fe0df0
SHA1 d40902c780555ef8a8c843f830e7e539e6baa095
SHA512 4ef68e8b2ed0fc1b38e2663544c8f1b64a187e4ba784486983ddaf8416abaa87d9a41488e4a11dbda000536e326b0bbc7be959b889d61412319d02959d39188b
TLSH
T18341914B0EB609B19FA6FE096336CD14E8D2106B2BE184E173825725C67B10A89FC677
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 4KB
SHA256 97b4184bd16695015650e56a102780ac00cc55ec0be8eec0473a7a1d4356d53b
MD5 ef8ee6ddc4f614338217a8dba5588ae7
SHA1 55682935406676fddb341d465e813df4af486892
SHA512 115496e84ee1e18450927c68d595fae2413c2e253acaf0b516a7bbee12b057f843905db38bf2e38c6bb2f080de75edb2c43315d71af33b2e8483cc0661d4ea4f
SSDEEP 96:ZpIrQVS8mdVQyTW3X+6HajQXZcHtFKE5m/ti7J/tv7JO6te6th7r7Y7EEP6E6E0U:KfPtFIt4tJtjtQUiwS
TLSH
T1C981F8470DB619B19FA2BE0C273BDC54B4D211A76BA188E037925365C6BB009CEFC577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
Size 4KB
SHA256 23e07addc7f55c181f74185a80f61f7d79ef6236029565e323d64800e029c811
MD5 3fb91b42163a18aef963352461763d55
SHA1 ecc7a87024c9b5a465beb8729fec8f8a516510f0
SHA512 0c81b77ed89236ea235148a8f7baa50530bd03b84ab7aacfa19c21899be4fb72a43ccead86e622e82446f2f9c0850c4dd1845cdba435d430347d858ae8fe2a08
SSDEEP 96:ZpIrQVS8mdVQyTW3X+6HajQXZcHtFKE5m/ti7J/tv7JO6te6th7r7Y7EEP6E6E0S:KfPtFIt4tJtjtQUiwg
TLSH
T17691E8470DB619B19FA2BE0C273ADC54B4D211AB6BB148E037925365C2BB009CEFC577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

header.bmp

Path C:\Program Files (x86)\Advanced Monitoring Agent\images\header.bmp
Size 7KB
SHA256 a2acbb1b55df6a88829fbc4eb7881d8c39af8d4fb97d07cc9dc7bdba2229ea22
MD5 fcb4c9763f9f349690b128e04893e683
SHA1 3b9aebc5500ec0af591b94ed26fdebb06ab7ce62
SHA512 9ae7e8e16fe499048d86936a005cc84ab8293bdce4585d57cee0c5092c4ff872533b11b53be7b094ba3dd58f8190daa122e6cb2ebb20062dd18a2f1cc7f20293
SSDEEP 48:OI/ZV22222222222222dxfpupWHP6x22222222222222222222ic:OK7Lv6oc
TLSH
T1FCE10D420A3FD61C559A5C29EC55A5FD8CBB1D69DF09A1772000739BFAB0382F3D146B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splash.bmp

Path C:\Program Files (x86)\Advanced Monitoring Agent\images\splash.bmp
Size 150KB
SHA256 195b36b5a4d6f40ac350fda0fd90aa0dc3b4f7d72c047f6679680c7c34aade27
MD5 bb2998c80d5458d727ccefdeeac0a9ea
SHA1 356c55b7d8985db5ab21401221a58e95e0ea7940
SHA512 cb724e0eb06af18c1d756bee49c9c0d38951c8b9a93371e2c733cd0b9ec05706d2b8eb228b7dab9440cdcbd0e085be5ee751259b10987e44f0273131a5792907
SSDEEP 48:wvkAk8kvdcoBzEqc96ZvEMuC6677BYkler6l38iCAe39rpkIfJBBe+zkv/////YC:t5Yasz39rpfze+krWxu7kxxlwkLDWMq
TLSH
T16AE37EE462472B3C86DED265B586416A40139C9D33B1CDA49D293C508E78307FF6EAFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini
Size 1KB
SHA256 9e981dbc0ac8865c1f162e0b32f92375742a5c90b4aba9ea3b0287f0883d30f3
MD5 f6a84126328be59374203397297b8e6c
SHA1 ed5fbcec5c755512cc4079f975522ad390ed9f2c
SHA512 76565ea574022edd67b50adc6d8339542a2e84318a4aedf8e542bcb2282657f0e8c09825e39290e01ca5a909a0152ab18f17108f7078fd169d10ec628c8ca550
TLSH
T1EF21F99FCA392043BF7634FAA1163F4A13821687E771F29165BBD0C4CA8402713B403B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini
Size 1KB
SHA256 611e6be5ccc15206612418392b435cd9f1a82a162ab1942f4501bb8ec776cb4b
MD5 243800d4857e38b8886f1c401f90e3a7
SHA1 a29cb5775e1cb1fcedde973659c63f60d0926854
SHA512 91aba8df706d674716498de26995eea30b8ee693d3b2c5162e5618db05da09304023a302708ab58ef5d95b46e6e28bd101685c43276f5ea16d00c37941a8106f
TLSH
T17A11E99FCB392403BF7634EA61163B4612921983E371F19164B7C0C4CA4002613B403B
MD5 SHA1 SHA512 TLSH

Submit Download

unzip.exe

Path C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
Size 828KB
SHA256 ecb69cb30ee6a1111ce861c321ae7392304c3e687a94a0bd37a62fb704c7fc91
MD5 8861ea631aaebbf9121306cf2b25007f
SHA1 cbaba93f66055c69506174785460d2fdd432ebed
SHA512 e385bdb11b9760b7cbdeec5858f042edb92b2fbb5970698b33f2ff76b5d0f06b1605557ac4a859f8988aedf730f2c2c5bc3ffe1b35b51851ab7ec5af4bf84cc4
SSDEEP 24576:F+irRnD9iCygJsOcSZJv7xhWg4YXps1ZGTqM:zD5sRSZJe54s1ZGTl
TLSH
T15B057C213EC0D032E6A2017799BDBA2581BEB9710B365AC7A3DD0A1D6E745C31F3275B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winagent.exe

Path C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
Size 13.0MB
SHA256 6c6e713255a88bc1aec925bac68cb9ad9f30662df1eee1a02349f39cea06d994
MD5 5c576dfe054590a6d7fae41d99eb46e5
SHA1 3ebdb53b7bf07613e229475ea132c57996127c6e
SHA512 3683f62ce4e4b6b83ff4b79f9d9757e13c857a8103f88896eb1fda6c349b2e7f00bb5858839a256f520694cf0e7c0abc5e2069b06d39fb454d841cdf6ba5af15
SSDEEP 196608:fCG/11k/n2fOwt0artwaQTO4OkJm7zDP3:d/Hk/n2WwtmNKZkJmXDP3
TLSH
T140D63A303A42C63BEB9201B2997CAE6F545D9E510F7964D7D2CC0E5E1EB42C30B36A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
Size 4.1MB
SHA256 f829693efd0dc0c139d624cf651fbd71c98bbd97ed7ac240ef4c875dc5be0db0
MD5 46a67648e1b1e03b8158717b9b333245
SHA1 dce591d15ffc7173822e3bf475c0912a15f2e8af
SHA512 e23c581470e88c7fd2a985d237751462f4ff6569b1f134fe5a438631280ba5823fc1cbcfe9338e5cc087f5d793ffa5ea89be0982ee5e1d8be4d68a0bce0065be
SSDEEP 98304:NlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTd6:fU1Ls6DjX34gSVNU
TLSH
T150163373282D4CB5FA64363419A543112ABE2F4DAE38705A73FD4BBE9707AC509CE385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.zip

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\package.zip
Size 12KB
SHA256 8940be68ecf3b24cc0d465961853e24b616cb9cab840d32507bd7f7f3066106c
MD5 5369c5a3661904e13629eae683935b1d
SHA1 e592e68ebe74b9ccbcd34e6d69e95761896e2588
SHA512 1a139cc1618046f2aa29c6cc3bf8ca02ade30c6684e60649ed7bf3c2fd1c28cf84979880768af89d9628cdbdbd0a7fd9782ce7d53f657c6cd265fc2eb27e736a
SSDEEP 192:DWBaX8filiRVKE9awZ6cXEbQaOEx/4KLdXinaNawAawWDwCsP4mFvccCt5WGI1en:DS5fNV91Xyz/GKLgnaN6Ezsr/C7bIJrQ
TLSH
T1CF428D445679E295CC1F9ABD3F476E9B639F524240D2C506BF1C382C0EC2EE9836156E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MUQO7.tmp\agent.tmp
Size 690KB
SHA256 6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
MD5 a2c4d52c66b4b399facadb8cc8386745
SHA1 c326304c56a52a3e5bfbdce2fef54604a0c653e0
SHA512 2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6
SSDEEP 12288:yTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5MRxyF:6PcYn5c/rPx37/zHBA6pFptZ1CEQqMRU
TLSH
T1BDE46C32F2A0C837D4B31E789D5B82D55936BE103E38A59736E81F4C4F796817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5704-101-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5704-19-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/5964-136-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5964-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download