Overview

overview

10

Static

static

10

013ed964d3...f8.exe

windows10-2004-x64

10

013ed964d3...f8.exe

windows11-ltsc_2024-x64

3

014cbdc259...89.exe

windows10-2004-x64

10

014cbdc259...89.exe

windows11-ltsc_2024-x64

3

0a52207d41...9f.exe

windows10-2004-x64

3

0a52207d41...9f.exe

windows11-ltsc_2024-x64

10

152f42d8d6...c9.apk

android-9-x86

8

152f42d8d6...c9.apk

android-10-x64

8

152f42d8d6...c9.apk

android-11-x64

8

1fbae4f859...80.exe

windows10-2004-x64

10

1fbae4f859...80.exe

windows11-ltsc_2024-x64

10

237494387c...fc.exe

windows10-2004-x64

10

237494387c...fc.exe

windows11-ltsc_2024-x64

10

280ebd2392...3b.exe

windows10-2004-x64

6

280ebd2392...3b.exe

windows11-ltsc_2024-x64

6

3655fd1416...b6.exe

windows10-2004-x64

10

3655fd1416...b6.exe

windows11-ltsc_2024-x64

10

3c19d62248...b00.js

windows10-2004-x64

6

3c19d62248...b00.js

windows11-ltsc_2024-x64

6

4134aa6962...da.msi

windows10-2004-x64

7

4134aa6962...da.msi

windows11-ltsc_2024-x64

7

437814cb41...4a.exe

windows10-2004-x64

7

437814cb41...4a.exe

windows11-ltsc_2024-x64

10

484a712197...63.jar

windows10-2004-x64

10

484a712197...63.jar

windows11-ltsc_2024-x64

10

484c0b7849...8.xlsm

windows10-2004-x64

10

484c0b7849...8.xlsm

windows11-ltsc_2024-x64

10

4ca951e9d3...7e.exe

windows10-2004-x64

10

4ca951e9d3...7e.exe

windows11-ltsc_2024-x64

3

4d269e29e4...91.exe

windows10-2004-x64

10

4d269e29e4...91.exe

windows11-ltsc_2024-x64

10

51ae05ee92...c3.exe

windows10-2004-x64

7

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

260807-rn2ecsfm2v10

07/08/2026, 14:20

260807-rnv8cazwds

06/08/2026, 22:19

260806-18tppa1gqf10

06/08/2026, 22:01

260806-1w8m3svsfz10

06/08/2026, 03:44

260806-ear8baff4610

10/07/2026, 00:11

260710-agy7zsct5t10

Analysis

  • max time kernel
    300s
  • max time network
    309s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 14:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe
  • Size 438KB
  • Sample260807-rn2ecsfm2v
  • SHA256 4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remotehostdefense_evasiondiscoveryevasionexecutionremcospersistenceratrezer0trojan

Malware Config

Extracted

Family

  • remcos

Version

  • 2.5.0 Pro

Botnet

  • RemoteHost

C2

  • kenya8.duckdns.org:7722

  • ikorodu2.duckdns.org:7722

  • mypepsi22.duckdns.org:7722

  • mypepsi25.duckdns.org:7722

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-LOWNF5

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
    evasiontrojan
  • Disables one or more Microsoft Defender components 1 TTPs 14 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 3 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs

    Using powershell.exe command.

    execution
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe
    "C:\Users\Admin\AppData\Local\Temp\4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender TamperProtection settings
    • Windows security modification
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5752
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1004
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2988
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1932
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2440
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4748
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5544
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:568
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4384
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4300
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4504
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5748
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4120
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      2⤵
      • Disables one or more Microsoft Defender components
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4132
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Disables automatic submission of suspicious files to Microsoft by Windows Defender
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1408
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iQEEJsF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE12.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2844
    • C:\Users\Admin\AppData\Local\Temp\4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe
      "{path}"
      2⤵
        PID:2980
      • C:\Users\Admin\AppData\Local\Temp\4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe
        "{path}"
        2⤵
          PID:4124
        • C:\Users\Admin\AppData\Local\Temp\4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe
          "{path}"
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:5760
      • C:\Users\Admin\AppData\Roaming\iQEEJsF.exe
        C:\Users\Admin\AppData\Roaming\iQEEJsF.exe
        1⤵
        • Modifies Windows Defender DisableAntiSpyware settings
        • Modifies Windows Defender Real-time Protection settings
        • Modifies Windows Defender TamperProtection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5156
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4064
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
          2⤵
          • Disables one or more Microsoft Defender components
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4840
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
          2⤵
          • Disables one or more Microsoft Defender components
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:3952
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
          2⤵
          • Disables one or more Microsoft Defender components
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:256
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
          2⤵
          • Disables one or more Microsoft Defender components
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1420
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
          2⤵
          • Disables one or more Microsoft Defender components
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4860
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
          2⤵
          • Disables one or more Microsoft Defender components
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2584
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:6464
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:6512
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:6552
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:6652
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:6524
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
          2⤵
          • Disables one or more Microsoft Defender components
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:2564
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
          2⤵
          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          PID:4068
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iQEEJsF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp62F1.tmp"
          2⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5228
        • C:\Users\Admin\AppData\Roaming\iQEEJsF.exe
          "{path}"
          2⤵
          • Executes dropped EXE
          PID:7064

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ModuleAnalysisCache
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
            • Size 63KB
            • SHA256 effbd33d90efc8f57bbe9784b03abda40610dcbeecc07938675a3eb7f659f274
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 21KB
            • SHA256 5f31d7c5c967a92ccccbd392ce9d646d14bc346a74238dfb1089281b300af778
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 21KB
            • SHA256 958ad5669682ebc3ff8cafa29a78bc9d9f02eef82bd0fe8e6230963d0ff3bccf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 21KB
            • SHA256 2c2ac59be863c3a818b7f17b9dffd440b4956f626507bfe7dc7e5fa56b19450d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 21KB
            • SHA256 78b7c5408a5ad43593d9654cdc1c887b8f831824dbd50fae48f975390b6a12c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 21KB
            • SHA256 f4c7203df6a1096030b0daadadf3e154e62c6774aaba006f65e5ea07704c7c0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 21KB
            • SHA256 be69623b8d2f7880403a4f6c4fcd1bc95c5499be83ec425752c1f3215f398bb4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 ecbabb263040b1724f9efcba11438668d7189b6e874712f5344a1e24cc83cf6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 21KB
            • SHA256 322c098eb0ed190294a0b83bf4c0337640eb4f20923d1913e8dc3b3992c45e1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 ee3e94112ba3700dd14fb625510844be7168d29f5a7e21be93ac4274401ef91c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 21KB
            • SHA256 eb7b132a7b45e932148b35eb33ac41080edd92a840ae08c72dfdc8f48adb87fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 8586bd18f3c2b2a142dbf7c88e31342891a6b5b15fa9e990f7319fa51c0361d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 b666729a6bb8fc1d58ce20cf093dd17f73de512e7d2ed79d3c9da0a88fb229c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 e5c685965f796c49984b23aa877ddfb6cc20b2bc51d7e391741ce4e56272ba83
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 312338140c7db9bbf4339465953bfd94905523e66c6b007549f15a94fc61228b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 2c24d88c3b8274274105ae0dfc22db8118d550e0a5747ecf87a398d1847ae654
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 c87471bd04975fc2803dca181bd98778d0622c1a2d00a5b56c2ec4d7069c535e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 bb563eab263486b03d717cc9adc74e016c664a2f0261f304a98a0eb065652cf1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 1844541b67972769767349899d4d113548d1dc1f415bb53a69556bc547e68cb6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 66a051d929e97645f69346a93ddb640a2e2e67705818d581ecbfb25a76a5751f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 12KB
            • SHA256 63e5b80c55364983c7633f804d19cc5c61dfab15ec4ffce2806c77a09628314e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 a011b82632e877b8b61e3f9e81e62419b295c85f1ad51b6ed5dde2669d100e4f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 20KB
            • SHA256 250154de7ba2d5dac2e504cf423dcbf49c434e4a0485354ec2fb74fc2b6a5a24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_nnxleqad.i53.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nnxleqad.i53.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tmpDE12.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmpDE12.tmp
            • Size 1KB
            • SHA256 a07fcbfb1ccf3d5e1c0232ba8322d31fe31cd15285f7202e4eba313ae4e12fda
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            iQEEJsF.exe
            • Path C:\Users\Admin\AppData\Roaming\iQEEJsF.exe
            • Size 438KB
            • SHA256 4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logs.dat
            • Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
            • Size 64B
            • SHA256 4e33516d9c732b046d2e4ceb60a5e427a33f0d95ccbeac04f025ec5365d7856d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/568-93-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/1004-22-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/1004-30-0x0000000007620000-0x00000000076C3000-memory.dmp
            Download

            memory/1004-36-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/1004-33-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/1004-9-0x0000000004F00000-0x0000000004F36000-memory.dmp
            Download

            memory/1004-31-0x00000000077E0000-0x0000000007876000-memory.dmp
            Download

            memory/1004-10-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/1004-11-0x0000000005600000-0x0000000005C4A000-memory.dmp
            Download

            memory/1004-12-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/1004-13-0x0000000005C90000-0x0000000005CB2000-memory.dmp
            Download

            memory/1004-14-0x0000000005E30000-0x0000000005E96000-memory.dmp
            Download

            memory/1004-28-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/1004-34-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/1004-16-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/1004-27-0x00000000075E0000-0x0000000007600000-memory.dmp
            Download

            memory/1004-24-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/1004-15-0x0000000005EA0000-0x0000000005F06000-memory.dmp
            Download

            memory/1004-19-0x0000000005F10000-0x000000000626B000-memory.dmp
            Download

            memory/1004-20-0x00000000063F0000-0x000000000640E000-memory.dmp
            Download

            memory/1004-21-0x0000000006440000-0x000000000648C000-memory.dmp
            Download

            memory/1004-23-0x00000000075A0000-0x00000000075D6000-memory.dmp
            Download

            memory/1408-117-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/1932-80-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/2440-83-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/2988-74-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/2988-79-0x00000000076D0000-0x0000000007773000-memory.dmp
            Download

            memory/4064-86-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/4120-111-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/4132-114-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/4300-100-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/4384-99-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/4504-108-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/4748-90-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/5544-96-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/5748-105-0x0000000070930000-0x000000007097C000-memory.dmp
            Download

            memory/5752-72-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/5752-6-0x0000000007DA0000-0x0000000007E3C000-memory.dmp
            Download

            memory/5752-0-0x0000000074D22000-0x0000000074D23000-memory.dmp
            Download

            memory/5752-1-0x0000000000DA0000-0x0000000000E14000-memory.dmp
            Download

            memory/5752-2-0x0000000005E70000-0x000000000642A000-memory.dmp
            Download

            memory/5752-3-0x0000000005950000-0x00000000059E2000-memory.dmp
            Download

            memory/5752-4-0x0000000005A00000-0x0000000005A0A000-memory.dmp
            Download

            memory/5752-32-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/5752-8-0x0000000007D70000-0x0000000007D9E000-memory.dmp
            Download

            memory/5752-7-0x0000000005BC0000-0x0000000005BC8000-memory.dmp
            Download

            memory/5752-29-0x0000000074D22000-0x0000000074D23000-memory.dmp
            Download

            memory/5752-5-0x0000000074D10000-0x00000000754CC000-memory.dmp
            Download

            memory/5760-68-0x0000000000400000-0x0000000000420000-memory.dmp
            Download

            memory/5760-71-0x0000000000400000-0x0000000000420000-memory.dmp
            Download

            memory/5760-67-0x0000000000400000-0x0000000000420000-memory.dmp
            Download

            memory/5760-66-0x0000000000400000-0x0000000000420000-memory.dmp
            Download