Analysis Overview
SHA256
408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c
Threat Level: Known bad
The file RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe was found to be: Known bad.
Malicious Activity Summary
Remcos
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
Checks computer location settings
Reads user/profile data of web browsers
Accesses Microsoft Outlook accounts
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-08 09:03
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-08 09:03
Reported
2024-04-08 09:06
Platform
win7-20240221-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Remcos
NirSoft MailPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
NirSoft WebBrowserPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Nirsoft
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook accounts
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 112 set thread context of 1604 | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe |
| PID 1604 set thread context of 2884 | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe |
| PID 1604 set thread context of 2696 | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe |
| PID 1604 set thread context of 1584 | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fmduzErmJdOHa.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fmduzErmJdOHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp63C2.tmp"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\viokgylmgtyqzfvxp"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gltchqvfubqdbljbgiyd"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ifhvijghijiimzfnpstxjzil"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | paygateme.net | udp |
| US | 146.70.57.34:2286 | paygateme.net | tcp |
| US | 146.70.57.34:2286 | paygateme.net | tcp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| US | 146.70.57.34:2286 | paygateme.net | tcp |
| US | 146.70.57.34:2286 | paygateme.net | tcp |
Files
memory/112-0-0x0000000001190000-0x000000000128C000-memory.dmp
memory/112-1-0x0000000074CD0000-0x00000000753BE000-memory.dmp
memory/112-2-0x0000000004D00000-0x0000000004D40000-memory.dmp
memory/112-3-0x0000000000690000-0x00000000006AC000-memory.dmp
memory/112-4-0x0000000000360000-0x0000000000368000-memory.dmp
memory/112-5-0x0000000000380000-0x000000000038C000-memory.dmp
memory/112-6-0x0000000004ED0000-0x0000000004F90000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp63C2.tmp
| MD5 | 17fd0e70c58f84df1aca89d1dafe8e1e |
| SHA1 | f5508cd032836b1626a47fdc6331ce99b2dd2e96 |
| SHA256 | a2e2d9465954a2756a8c38aeeb4d2294ce8fad2e9527bf2a5bd57b895d3dcf02 |
| SHA512 | 68c9b1af161a83c37b47c02c0ed42c923a5e029e863a56f8774b302caf79b12a2c2cd54b9fc9e4c9fc9b695f9eb6df09bae8abdecf56fd16c1d8d3a001fedbbd |
memory/1604-14-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-16-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-18-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-19-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-21-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-23-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-25-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-27-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1604-31-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-33-0x0000000000400000-0x0000000000482000-memory.dmp
memory/112-34-0x0000000074CD0000-0x00000000753BE000-memory.dmp
memory/1604-35-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-37-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-38-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-39-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2588-41-0x000000006F0A0000-0x000000006F64B000-memory.dmp
memory/1604-42-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2588-43-0x000000006F0A0000-0x000000006F64B000-memory.dmp
memory/2588-44-0x0000000002980000-0x00000000029C0000-memory.dmp
memory/2588-45-0x000000006F0A0000-0x000000006F64B000-memory.dmp
memory/1604-47-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-49-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-51-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-52-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2884-56-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2884-58-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2884-61-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2884-66-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2696-67-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2696-63-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2696-71-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2696-70-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1584-72-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1584-75-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1584-74-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1584-76-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1584-77-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2884-82-0x0000000000400000-0x0000000000478000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\viokgylmgtyqzfvxp
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
memory/2696-85-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1604-86-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1604-90-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1604-89-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2588-92-0x0000000002980000-0x00000000029C0000-memory.dmp
memory/1604-91-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1604-93-0x0000000010000000-0x0000000010019000-memory.dmp
C:\ProgramData\remcos\logs.dat
| MD5 | 85ea239eb267ac4f4328c34fe9f682e5 |
| SHA1 | b5619b2615998aedb13b2c651bdfa658d1d52e29 |
| SHA256 | 27391626d1ca4826b55e9cf7125de2fa5b51847ca522efe853b7355b50f93bf8 |
| SHA512 | 0edee93a62baed3fea037dafd11bc4f9f27f7ef15b492344d6d28c2ca973cfdd96c91ec9a23e1518628db4d31e404fe224762855cd6b0098da3e5d4990482ec5 |
memory/1604-95-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-96-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-99-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-100-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-102-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1604-109-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-110-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-117-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-118-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-121-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-122-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1604-124-0x0000000000400000-0x0000000000482000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-08 09:03
Reported
2024-04-08 09:06
Platform
win10v2004-20240226-en
Max time kernel
150s
Max time network
154s
Command Line
Signatures
Remcos
NirSoft MailPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
NirSoft WebBrowserPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Nirsoft
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook accounts
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1596 set thread context of 544 | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe |
| PID 544 set thread context of 1576 | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe |
| PID 544 set thread context of 5076 | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe |
| PID 544 set thread context of 2516 | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fmduzErmJdOHa.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fmduzErmJdOHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA41F.tmp"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tlrqpmraonfnszieltkimbrhubwnjhg"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dnwaqfctcwxscfxiuwecpolycioolkffne"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dnwaqfctcwxscfxiuwecpolycioolkffne"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ohbtrx"
C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ohbtrx"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | paygateme.net | udp |
| US | 146.70.57.34:2286 | paygateme.net | tcp |
| US | 8.8.8.8:53 | 34.57.70.146.in-addr.arpa | udp |
| US | 146.70.57.34:2286 | paygateme.net | tcp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| US | 8.8.8.8:53 | 50.33.237.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.139.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| US | 146.70.57.34:2286 | paygateme.net | tcp |
| US | 146.70.57.34:2286 | paygateme.net | tcp |
| US | 8.8.8.8:53 | 169.117.168.52.in-addr.arpa | udp |
Files
memory/1596-1-0x00000000006E0000-0x00000000007DC000-memory.dmp
memory/1596-0-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/1596-2-0x0000000005620000-0x0000000005BC4000-memory.dmp
memory/1596-3-0x0000000005070000-0x0000000005102000-memory.dmp
memory/1596-4-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/1596-5-0x0000000005050000-0x000000000505A000-memory.dmp
memory/1596-6-0x00000000052D0000-0x000000000536C000-memory.dmp
memory/1596-7-0x0000000005190000-0x00000000051AC000-memory.dmp
memory/1596-8-0x00000000051B0000-0x00000000051B8000-memory.dmp
memory/1596-9-0x0000000001130000-0x000000000113C000-memory.dmp
memory/1596-10-0x0000000006090000-0x0000000006150000-memory.dmp
memory/3692-15-0x00000000028F0000-0x0000000002926000-memory.dmp
memory/3692-16-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/3692-17-0x00000000028E0000-0x00000000028F0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpA41F.tmp
| MD5 | 308d3bd81494562f8221bca2ca3c6c05 |
| SHA1 | f2c42bee7dc735e34e5c8cb2dfbf76af7b44c181 |
| SHA256 | 45b3772459e9825f39d7c0e904b8692bb38290145948998c2b85faa1b33342c3 |
| SHA512 | a7341f8b64b2d7436874bc2b239fea6ae86a247fc60b11011b66939f18b7b24414213ee4f9b147dd94e07884a2822bbcd99fe2b598d3f2767cf632da2ea6db4f |
memory/1596-19-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/3692-20-0x0000000005530000-0x0000000005B58000-memory.dmp
memory/544-21-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3692-22-0x0000000005120000-0x0000000005142000-memory.dmp
memory/544-23-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3692-24-0x0000000005340000-0x00000000053A6000-memory.dmp
memory/544-26-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1596-33-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/3692-32-0x0000000005BD0000-0x0000000005C36000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2s0a24q.gde.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3692-40-0x0000000005C40000-0x0000000005F94000-memory.dmp
memory/544-43-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-42-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-35-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-44-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-34-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-45-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3692-46-0x0000000006210000-0x000000000622E000-memory.dmp
memory/3692-48-0x00000000067C0000-0x000000000680C000-memory.dmp
memory/3692-49-0x00000000028E0000-0x00000000028F0000-memory.dmp
memory/544-50-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-51-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3692-52-0x0000000007220000-0x0000000007252000-memory.dmp
memory/3692-53-0x0000000071670000-0x00000000716BC000-memory.dmp
memory/3692-63-0x0000000006770000-0x000000000678E000-memory.dmp
memory/3692-64-0x0000000007460000-0x0000000007503000-memory.dmp
memory/544-65-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-66-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3692-67-0x0000000007B90000-0x000000000820A000-memory.dmp
memory/3692-68-0x0000000007530000-0x000000000754A000-memory.dmp
memory/3692-69-0x00000000075A0000-0x00000000075AA000-memory.dmp
memory/544-71-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3692-72-0x00000000077A0000-0x0000000007836000-memory.dmp
memory/3692-74-0x0000000007740000-0x0000000007751000-memory.dmp
memory/3692-75-0x0000000007770000-0x000000000777E000-memory.dmp
memory/3692-76-0x0000000007780000-0x0000000007794000-memory.dmp
memory/3692-77-0x0000000007880000-0x000000000789A000-memory.dmp
memory/3692-78-0x0000000007860000-0x0000000007868000-memory.dmp
memory/3692-81-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/1576-82-0x0000000000400000-0x0000000000478000-memory.dmp
memory/5076-83-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1576-86-0x0000000000400000-0x0000000000478000-memory.dmp
memory/5076-88-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2516-87-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1576-90-0x0000000000400000-0x0000000000478000-memory.dmp
memory/5076-93-0x0000000000400000-0x0000000000462000-memory.dmp
memory/5076-96-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2516-95-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2516-101-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2516-102-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1576-104-0x0000000000400000-0x0000000000478000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tlrqpmraonfnszieltkimbrhubwnjhg
| MD5 | 32a7b06ba8a0426235849b55b563b06b |
| SHA1 | 47157e4608ac7375544e6a59c7353f5bea8167f5 |
| SHA256 | 14bb01cde2127abdc8cbef51092d1327d4fc63d40b47ca4621947c0dd8475e52 |
| SHA512 | 0a610acf3ee1abcbb198d0d52de567d8c40d3460897ad9cb53d1a9cc463935b13c13e880b23716a429d8680794d24e1d1ecfce2f386e3861798bd03bbf1f8cf6 |
memory/544-106-0x0000000010000000-0x0000000010019000-memory.dmp
memory/544-109-0x0000000010000000-0x0000000010019000-memory.dmp
memory/544-110-0x0000000010000000-0x0000000010019000-memory.dmp
memory/544-111-0x0000000010000000-0x0000000010019000-memory.dmp
memory/544-113-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-112-0x0000000010000000-0x0000000010019000-memory.dmp
memory/544-114-0x0000000000400000-0x0000000000482000-memory.dmp
C:\ProgramData\remcos\logs.dat
| MD5 | 23f18db0842c2ab5d1685ce8eee3318d |
| SHA1 | 34220669e745cfccb790d351fae81eec30205707 |
| SHA256 | 6bc551d9cae4031708996dea31e1f08327f43b61030f41f8d5da3d228188c89c |
| SHA512 | 43ba668e146022d51b2fb9c212229178fffc94d268cded2d976e3fc3bd75cfdadb959480bec6d595fc43a891c09a814fca76e9866451251cc8712e9b7985d835 |
memory/544-118-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-119-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-121-0x0000000010000000-0x0000000010019000-memory.dmp
memory/544-127-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-128-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-136-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-137-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-141-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-142-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-143-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-144-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-146-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-149-0x0000000000400000-0x0000000000482000-memory.dmp
memory/544-150-0x0000000000400000-0x0000000000482000-memory.dmp