Malware Analysis Report

2025-06-16 01:18

Sample ID 231205-h2m98aaa68
Target PO-880182.PDF..exe
SHA256 f8b4f90e536a1cdd95cc100f8db1cbc90970f125110fbe883523e84b0beae62a
Tags
modiloader remcos remotehost collection persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f8b4f90e536a1cdd95cc100f8db1cbc90970f125110fbe883523e84b0beae62a

Threat Level: Known bad

The file PO-880182.PDF..exe was found to be: Known bad.

Malicious Activity Summary

modiloader remcos remotehost collection persistence rat spyware stealer trojan

ModiLoader, DBatLoader

Remcos

NirSoft MailPassView

Nirsoft

ModiLoader Second Stage

NirSoft WebBrowserPassView

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates system info in registry

Script User-Agent

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-05 07:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-05 07:14

Reported

2023-12-05 07:16

Platform

win7-20231020-en

Max time kernel

141s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe

"C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe"

Network

N/A

Files

memory/2516-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2516-1-0x0000000000400000-0x00000000005D5000-memory.dmp

memory/2516-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-05 07:14

Reported

2023-12-05 07:16

Platform

win10v2004-20231127-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Remcos

rat remcos

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows \System32\easinvoker.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Public\Libraries\kipyayhY.pif N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yhyaypik = "C:\\Users\\Public\\Yhyaypik.url" C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1592 set thread context of 5008 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 set thread context of 4724 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 set thread context of 4124 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 set thread context of 2240 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\kipyayhY.pif N/A
N/A N/A C:\Users\Public\Libraries\kipyayhY.pif N/A
N/A N/A C:\Users\Public\Libraries\kipyayhY.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\Libraries\kipyayhY.pif N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\kipyayhY.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1592 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 4412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2592 wrote to memory of 4804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 2592 wrote to memory of 4804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 4804 wrote to memory of 4592 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 4804 wrote to memory of 4592 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 2592 wrote to memory of 3080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2592 wrote to memory of 3080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2592 wrote to memory of 3080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4592 wrote to memory of 4344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4592 wrote to memory of 4344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4344 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4344 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1592 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Users\Public\Libraries\kipyayhY.pif
PID 1592 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Users\Public\Libraries\kipyayhY.pif
PID 1592 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Users\Public\Libraries\kipyayhY.pif
PID 1592 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Users\Public\Libraries\kipyayhY.pif
PID 1592 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 4724 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 4724 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 4724 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 4124 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 4124 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 4124 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 2240 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 2240 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif
PID 5008 wrote to memory of 2240 N/A C:\Users\Public\Libraries\kipyayhY.pif C:\Users\Public\Libraries\kipyayhY.pif

Processes

C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe

"C:\Users\Admin\AppData\Local\Temp\PO-880182.PDF..exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\YhyaypikO.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c mkdir "\\?\C:\Windows "

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c mkdir "\\?\C:\Windows \System32"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ECHO F

C:\Windows\SysWOW64\xcopy.exe

xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ECHO F

C:\Windows\SysWOW64\xcopy.exe

xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ECHO F

C:\Windows\SysWOW64\xcopy.exe

xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y

C:\Windows \System32\easinvoker.exe

"C:\Windows \System32\easinvoker.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 6

C:\Windows\system32\cmd.exe

cmd.exe /c start /min powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Users\Public\Libraries\kipyayhY.pif

C:\Users\Public\Libraries\kipyayhY.pif

C:\Users\Public\Libraries\kipyayhY.pif

C:\Users\Public\Libraries\kipyayhY.pif /stext "C:\Users\Admin\AppData\Local\Temp\qrdsfpbvlw"

C:\Users\Public\Libraries\kipyayhY.pif

C:\Users\Public\Libraries\kipyayhY.pif /stext "C:\Users\Admin\AppData\Local\Temp\bmqkgimozerfx"

C:\Users\Public\Libraries\kipyayhY.pif

C:\Users\Public\Libraries\kipyayhY.pif /stext "C:\Users\Admin\AppData\Local\Temp\lgwdhawqvmjkzsnbo"

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 155.245.36.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.43.13:443 onedrive.live.com tcp
US 13.107.43.13:443 onedrive.live.com tcp
US 8.8.8.8:53 dgit2q.dm.files.1drv.com udp
US 13.107.42.12:443 dgit2q.dm.files.1drv.com tcp
US 8.8.8.8:53 13.43.107.13.in-addr.arpa udp
US 8.8.8.8:53 12.42.107.13.in-addr.arpa udp
N/A 127.0.0.1:45070 tcp
N/A 127.0.0.1:52707 tcp
US 172.245.208.30:52707 tcp
US 172.245.208.30:52707 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 30.208.245.172.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 121.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

memory/1592-0-0x00000000008E0000-0x00000000008E1000-memory.dmp

memory/1592-1-0x0000000002D30000-0x0000000003D30000-memory.dmp

memory/1592-2-0x0000000002D30000-0x0000000003D30000-memory.dmp

memory/1592-4-0x0000000000400000-0x00000000005D5000-memory.dmp

C:\Users\Public\Libraries\YhyaypikO.bat

MD5 9e80036aabe3227dbf98b3975051a53b
SHA1 9670aab8897770a93293d85426b7b13dda23a152
SHA256 964aab3b72b3545fabc58a209714ebeade739a0fec40b33af675d7157b9cb252
SHA512 107fb6b364cf92730aca1a044f7769a1f4aed39a72f031a5004ccf09b3bebabac5fc88b3d0f85eb64c665404136db13678718bad36bea4311f07726684ed0a03

C:\Users\Public\Libraries\easinvoker.exe

MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

C:\Users\Public\Libraries\netutils.dll

MD5 f3734dd95652252d02090c287c556522
SHA1 a9b9479f66516922a119eec78d3610342f22a68b
SHA256 be00f70763a053bf9c4b35e97319afbffa71dbb6e9c2c3c3f642a5e1fa7eb004
SHA512 59df477a29d38b8d5b5c4567c241d4ffe1d58926fa6775e1ecb15ec8119cf040be97f83870704b422f044ae56f2a5169c50b92a3e1b75a8069e2a251f9dec41b

C:\Users\Public\Libraries\KDECO.bat

MD5 7e5fbd29557a68383dfb34e696964e93
SHA1 c1f748f89b47864301255d1fb2bfed04ed0d1300
SHA256 4e55b1bbe2e0e099592ac57a747fa8d4ef67409901d6c64323a1b73d50e5de67
SHA512 7dcb6582b03e7bf0cab2168dc775ca6d7a15ebb097fd2cdd3445b6d35ee128386fb9aa6a548b745c32540e358b2aa4d7c78a6f59f85c32065735fc54a6a2bb6a

C:\Windows \System32\easinvoker.exe

MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

C:\Windows \System32\easinvoker.exe

MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

C:\Windows \System32\netutils.dll

MD5 f3734dd95652252d02090c287c556522
SHA1 a9b9479f66516922a119eec78d3610342f22a68b
SHA256 be00f70763a053bf9c4b35e97319afbffa71dbb6e9c2c3c3f642a5e1fa7eb004
SHA512 59df477a29d38b8d5b5c4567c241d4ffe1d58926fa6775e1ecb15ec8119cf040be97f83870704b422f044ae56f2a5169c50b92a3e1b75a8069e2a251f9dec41b

C:\Windows \System32\netutils.dll

MD5 f3734dd95652252d02090c287c556522
SHA1 a9b9479f66516922a119eec78d3610342f22a68b
SHA256 be00f70763a053bf9c4b35e97319afbffa71dbb6e9c2c3c3f642a5e1fa7eb004
SHA512 59df477a29d38b8d5b5c4567c241d4ffe1d58926fa6775e1ecb15ec8119cf040be97f83870704b422f044ae56f2a5169c50b92a3e1b75a8069e2a251f9dec41b

memory/4804-26-0x00000000613C0000-0x00000000613E2000-memory.dmp

C:\windows \system32\KDECO.bat

MD5 7e5fbd29557a68383dfb34e696964e93
SHA1 c1f748f89b47864301255d1fb2bfed04ed0d1300
SHA256 4e55b1bbe2e0e099592ac57a747fa8d4ef67409901d6c64323a1b73d50e5de67
SHA512 7dcb6582b03e7bf0cab2168dc775ca6d7a15ebb097fd2cdd3445b6d35ee128386fb9aa6a548b745c32540e358b2aa4d7c78a6f59f85c32065735fc54a6a2bb6a

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q50qcjc4.np4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/8-35-0x000001EDB9C60000-0x000001EDB9C82000-memory.dmp

memory/8-40-0x00007FFEA8C70000-0x00007FFEA9731000-memory.dmp

memory/8-42-0x000001EDB9CA0000-0x000001EDB9CB0000-memory.dmp

memory/8-41-0x000001EDB9CA0000-0x000001EDB9CB0000-memory.dmp

memory/8-43-0x000001EDB9CA0000-0x000001EDB9CB0000-memory.dmp

memory/8-46-0x00007FFEA8C70000-0x00007FFEA9731000-memory.dmp

memory/1592-48-0x00000000008E0000-0x00000000008E1000-memory.dmp

memory/5008-51-0x0000000000590000-0x0000000001590000-memory.dmp

C:\Users\Public\Libraries\kipyayhY.pif

MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

C:\Users\Public\Libraries\kipyayhY.pif

MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

memory/5008-55-0x0000000000590000-0x0000000001590000-memory.dmp

memory/5008-57-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-59-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-60-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-61-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-62-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-65-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-67-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-68-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-69-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-70-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-72-0x00000000004F0000-0x0000000000572000-memory.dmp

C:\Users\Public\Libraries\kipyayhY.pif

MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

memory/4724-73-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Public\Libraries\kipyayhY.pif

MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

memory/4724-79-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2240-80-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4724-83-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Public\Libraries\kipyayhY.pif

MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

memory/4124-82-0x0000000000400000-0x0000000000457000-memory.dmp

memory/4124-75-0x0000000000400000-0x0000000000457000-memory.dmp

memory/2240-90-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2240-94-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4124-92-0x0000000000400000-0x0000000000457000-memory.dmp

memory/4124-91-0x0000000000400000-0x0000000000457000-memory.dmp

memory/2240-96-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4724-99-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qrdsfpbvlw

MD5 f38f9e66e6018fe17658be974254cad4
SHA1 597063c515fc90a5cef2d3f4a64d5c8f5e7ed47c
SHA256 448eb8deec9960c9a2b6a27daeaea4cbab7d8469ed8b52b6d5916df458b07bb6
SHA512 a6b2f498fbd5fe598430371d57182b73779e66af1f2a85b4f6bde919e17c0f8611b226d96ff8134098904c42edaf0c0ef78328f2ccbe9fb16a4f66dd1d5c57a5

memory/5008-102-0x000000001B5E0000-0x000000001B5F9000-memory.dmp

memory/5008-106-0x000000001B5E0000-0x000000001B5F9000-memory.dmp

memory/5008-107-0x000000001B5E0000-0x000000001B5F9000-memory.dmp

memory/5008-108-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-109-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-110-0x000000001B5E0000-0x000000001B5F9000-memory.dmp

memory/5008-114-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-115-0x00000000004F0000-0x0000000000572000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 086f4438f428869bf89b241351cd5c89
SHA1 79999ad49717de1cfd7c902dff5353dfa312c29b
SHA256 dd80e327252311c1184acfed7a71b61fc7a0abb5e4d086776ef7233e885a8f70
SHA512 c0f93f32efaf36213f5a6622b26b7b60f058bad12c707e7c1b6f65703849c17e5b6d1ffc419aeee6e115dbdbe4faa3de5193af16766d70595b1ea824d228c067

memory/5008-122-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-123-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-130-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-131-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-138-0x00000000004F0000-0x0000000000572000-memory.dmp

memory/5008-139-0x00000000004F0000-0x0000000000572000-memory.dmp