remcos | 965f7b8327a64556173a1d6045d2e13044c96fb2f39e7481eb0852741eb724ab

Analysis

max time kernel
300s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 09162026 [WeChat Attachment] Sample Pictures_November.2026 PO_doc01149201149220250116135402022090.msi
Size 940KB
Sample260925-mknxmsdd75
SHA256 965f7b8327a64556173a1d6045d2e13044c96fb2f39e7481eb0852741eb724ab
MD5 67cc61670a656ac8dd624b303bb8272a
SHA1 1edc3c142b9ea5d4bf2c74f71d4805e667ecfe30
SHA512 a46a1a95cbdf44289a6373be21a2a4c706b67d13bfcb6513a9f7dbe6e52a9706d823055b5df813c20f557e65cd0e9846067ea2c745c21e15ac7e754265f49819
SSDEEP 24576:UhVLL6Xnii8mUprdGathDTXjfqm+35YzwWOsPOpuKTzN0fD4N3X:Yf6Xnii89lMM1Xem+3tW7QXBQ
TLSH
T1E62523ED7628B332DA0741F1903AF34B96538C962B634E58E1ACF51E073B9D0657BB80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution remcos persistence ransomware rat spyware stealer suricata

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 12 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 14 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
12	3488	ZTAKTJSDWBNLLXHW.EXE
13	3488	ZTAKTJSDWBNLLXHW.EXE
13	3488	ZTAKTJSDWBNLLXHW.EXE

Executes dropped EXE 1 IoCs

pid	Process
3488	ZTAKTJSDWBNLLXHW.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ZTAKTJSDWBNLLXHW.EXE
Key enumerated	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ZTAKTJSDWBNLLXHW.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e59d029.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF298BFC5C93F113BA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB05.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA395944B7639A370.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID557.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF063B7C77A55FC092.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7C8ED0F4504962C.TMP	msiexec.exe
File created	C:\Windows\Installer\e59d027.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d027.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE0FC136E14B7ACC.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D9D7FCD2-D41A-44BE-A643-962C8171F5EC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0CFA1D9026E419FA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFABEC97B1379D419.TMP	msiexec.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4084	cmd.exe
3228	cmd.exe
5760	cmd.exe
2772	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2420	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2420	msiexec.exe
Token: SeSecurityPrivilege	4808	msiexec.exe
Token: SeCreateTokenPrivilege	2420	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2420	msiexec.exe
Token: SeLockMemoryPrivilege	2420	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2420	msiexec.exe
Token: SeMachineAccountPrivilege	2420	msiexec.exe
Token: SeTcbPrivilege	2420	msiexec.exe
Token: SeSecurityPrivilege	2420	msiexec.exe
Token: SeTakeOwnershipPrivilege	2420	msiexec.exe
Token: SeLoadDriverPrivilege	2420	msiexec.exe
Token: SeSystemProfilePrivilege	2420	msiexec.exe
Token: SeSystemtimePrivilege	2420	msiexec.exe
Token: SeProfSingleProcessPrivilege	2420	msiexec.exe
Token: SeIncBasePriorityPrivilege	2420	msiexec.exe
Token: SeCreatePagefilePrivilege	2420	msiexec.exe
Token: SeCreatePermanentPrivilege	2420	msiexec.exe
Token: SeBackupPrivilege	2420	msiexec.exe
Token: SeRestorePrivilege	2420	msiexec.exe
Token: SeShutdownPrivilege	2420	msiexec.exe
Token: SeDebugPrivilege	2420	msiexec.exe
Token: SeAuditPrivilege	2420	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2420	msiexec.exe
Token: SeChangeNotifyPrivilege	2420	msiexec.exe
Token: SeRemoteShutdownPrivilege	2420	msiexec.exe
Token: SeUndockPrivilege	2420	msiexec.exe
Token: SeSyncAgentPrivilege	2420	msiexec.exe
Token: SeEnableDelegationPrivilege	2420	msiexec.exe
Token: SeManageVolumePrivilege	2420	msiexec.exe
Token: SeImpersonatePrivilege	2420	msiexec.exe
Token: SeCreateGlobalPrivilege	2420	msiexec.exe
Token: SeBackupPrivilege	2504	vssvc.exe
Token: SeRestorePrivilege	2504	vssvc.exe
Token: SeAuditPrivilege	2504	vssvc.exe
Token: SeBackupPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2420	msiexec.exe
2420	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2420	msiexec.exe
4808	msiexec.exe
5224	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3368	4808	msiexec.exe	93
PID 4808 wrote to memory of 3228	4808	msiexec.exe	95
PID 4808 wrote to memory of 5224	4808	msiexec.exe	97
PID 4808 wrote to memory of 3488	4808	msiexec.exe	98
PID 3488 wrote to memory of 5760	3488	ZTAKTJSDWBNLLXHW.EXE	100
PID 5760 wrote to memory of 1256	5760	cmd.exe	101
PID 3488 wrote to memory of 2772	3488	ZTAKTJSDWBNLLXHW.EXE	102
PID 2772 wrote to memory of 2900	2772	cmd.exe	103
PID 3488 wrote to memory of 4084	3488	ZTAKTJSDWBNLLXHW.EXE	104
PID 4084 wrote to memory of 760	4084	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ZTAKTJSDWBNLLXHW.EXE

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\PO 09162026 [WeChat Attachment] Sample Pictures_November.2026 PO_doc01149201149220250116135402022090.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3368
- C:\Windows\system32\cmd.exe
  cmd.exe /c if /i "YES"=="YES" if not exist "ZTAKTJSDWBNLLXHW.mui" echo %RANDOM%%RANDOM%%RANDOM%> "ZTAKTJSDWBNLLXHW.mui"
  2⤵
  - Executes a command shell one-liner
  PID:3228
- C:\Windows\system32\msiexec.exe
  msiexec.exe /x {D9D7FCD2-D41A-44BE-A643-962C8171F5EC} /qn /norestart
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5224
- C:\Users\Admin\Documents\ZTAKTJSDWBNLLXHW\ZTAKTJSDWBNLLXHW.EXE
  "C:\Users\Admin\Documents\ZTAKTJSDWBNLLXHW\ZTAKTJSDWBNLLXHW.EXE" "C:\Users\Admin\Documents\ZTAKTJSDWBNLLXHW\ZTAKTJSDWBNLLXHW.ttf"
  2⤵
  - Suricata alert: REMCOS RAT Malware Inbound C2 Communication
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c whoami
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /query /tn "ZTAKTJSDWBNLLXHW" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /tn "ZTAKTJSDWBNLLXHW"
      4⤵
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 15 /tn "ZTAKTJSDWBNLLXHW" /tr "cmd /c \"C:\Users\Admin\Documents\ZTAKTJSDWBNLLXHW\WHXLLNBWDSJTKATZ.url\"" /ru "szapmtop\admin" /f /it
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc minute /mo 15 /tn "ZTAKTJSDWBNLLXHW" /tr "cmd /c \"C:\Users\Admin\Documents\ZTAKTJSDWBNLLXHW\WHXLLNBWDSJTKATZ.url\"" /ru "szapmtop\admin" /f /it
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59d028.rbs

Path C:\Config.Msi\e59d028.rbs
Size 8KB
SHA256 784d0df41931eb251aeb4332d281ee8dde73db812bdcf3055d984f6658f22078
MD5 1af3a3852cf154410369a67243be0948
SHA1 6364968ecd9df6dab8903dca27520fec00d6c76d
SHA512 591ff4b219739f7c16cc3268ea1fd9ed6691a573a351201d4a33efbadf9e8f03fcf8589763a5cb60aa43a38844004d6d904349beda4b9bee18e5062236f6ccd4
SSDEEP 96:D6yJlKEaC4BKZUBCTCOThqQUBCTCgjFIBzThqVHItvqAF+XNghRC1pkBUxzXNWHH:DNJl5aCTS4OG+4O57I1pE
TLSH
T166021E02B1458092F85D2B7E87173B903BFBE3B9A251730F659D82649F02B999BCD1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59d02c.rbs

Path C:\Config.Msi\e59d02c.rbs
Size 7KB
SHA256 8465271c78063ec0d226e2c5f0d68099dd55949d40c38f490676b069500bada0
MD5 727032c40846787bea0703fbdc9995bb
SHA1 666f6b2d57c7dddebf491f54601def5dfd5e44ba
SHA512 13d56d94cf402cb7de52fb0d305d234ac01c448e3469df51b3d652d5d60f1a7822507d3e63691e4c283b152ed39e13457e06a2c9bbe7fcab53d8e7f6bc57e3ab
SSDEEP 96:z6yOsCUB28Rii8WjVt8Riu8WIjx4juIBbBqVTjH0aoMcBLxXwsYCdOBx4x6grtZ1:zNOGRJ8WoRl8WhXwu9Zb
TLSH
T1CAF10D03B1098193FC6D2B3E8B173A903BEBD3B8A605634F615D52649F01F999BDD2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZTAKTJSDWBNLLXHW.exe

Path C:\Users\Admin\Documents\ZTAKTJSDWBNLLXHW\ZTAKTJSDWBNLLXHW.exe
Size 467KB
SHA256 52f0c0230b580e2fdf53a378b5c6d0db9829af900dae43e0df8f18635cd9f0c1
MD5 7f47d5ea49f77b99e25ca2918cea8920
SHA1 b7b3dbcf32f3b7a78554efee75f0ad5746126c69
SHA512 04f24c43bc290adb84d23453e3dbbbc317e2b2c9c752e4289501a9358c76116188a7d3cd9d3c44acf23254c4aa39bfaac49341e0085ed6d9e9f9eb1016325453
SSDEEP 12288:26DGsq60U/A62U1q6CkrlA1NIcjBM4rF3/W:26DGsqEVAWhoIcO4rF3/W
TLSH
T17DA43703A2B353BDC667C1308B978BB2BA32BC9512316DBE2454FB311DB1CA1479F529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZTAKTJSDWBNLLXHW.mui

Path C:\Users\Admin\Documents\ZTAKTJSDWBNLLXHW\ZTAKTJSDWBNLLXHW.mui
Size 16B
SHA256 18c3ed780781f13aa16719d063959b3a7735d9652ba1e775f28c0cad8518dcfe
MD5 56216a0f945283b08a37e67569094ae9
SHA1 62a4beab977f0f96830ab46401a6f1c6ad1d7105
SHA512 64c45aa6489f5dd0558120137dafa741f429199fd79d7f7c9b07222539c5b01264b0adb710f55ede853005f6b05a31cf8230b3eaa3ba480076bd29b3004af8d4
MD5 SHA1 SHA512

Submit Download

ZTAKTJSDWBNLLXHW.ttf

Path C:\Users\Admin\Documents\ZTAKTJSDWBNLLXHW\ZTAKTJSDWBNLLXHW.ttf
Size 1.1MB
SHA256 5e7625fa441b6ad330e1132a4b9d6dcbe8dea09c35e7b927049325da2c41ef37
MD5 a68e81ad99247451d9201a396c0ca4cf
SHA1 f0d4a35f6a1ceaa5f38883c21ea0355b7002fa8a
SHA512 bf8beb35223638c29e40a8dbf16d17f479c2000dea4cb8fd215f0fbb9d496a8e8b90af44fd904a3d95388bd07fb5e681c73f47e2ec9926119e2a860133891a03
SSDEEP 24576:uZ4CrVrkLNmS7odX7ylcHPq2xzkOsqu1zqeBbnqgvtKD:uySVgAS7Y73q2K1N1OeBbnqgvtKD
TLSH
T1C635D08B778F6C1452F683E0CC6F1DDA7066D4EA435E11274FC4D1E47A2076CCAE9A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59d029.msi

Path C:\Windows\Installer\e59d029.msi
Size 940KB
SHA256 965f7b8327a64556173a1d6045d2e13044c96fb2f39e7481eb0852741eb724ab
MD5 67cc61670a656ac8dd624b303bb8272a
SHA1 1edc3c142b9ea5d4bf2c74f71d4805e667ecfe30
SHA512 a46a1a95cbdf44289a6373be21a2a4c706b67d13bfcb6513a9f7dbe6e52a9706d823055b5df813c20f557e65cd0e9846067ea2c745c21e15ac7e754265f49819
SSDEEP 24576:UhVLL6Xnii8mUprdGathDTXjfqm+35YzwWOsPOpuKTzN0fD4N3X:Yf6Xnii89lMM1Xem+3tW7QXBQ
TLSH
T1E62523ED7628B332DA0741F1903AF34B96538C962B634E58E1ACF51E073B9D0657BB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 1ee2f6677e39144a23326637d8364fd85fb814e2bad2eb5913743d19d1b40669
MD5 af53d8933044ad91c0edd732502cc84c
SHA1 5ca9d3da670ad8bc4ca29b0b3ea6a1723c34e44c
SHA512 6e8fdbfb3eb9886c0abede23d4729c3eaae680669af0798c631af92cc0aa774c75adb8b0d1b642e5c70caa2d3872b209c25ecc78b562ed7d0cc20ed1f99e4bd5
SSDEEP 24576:cFo3DMPedoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+z:XHo
TLSH
T12F57B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9e3e9eaf-034a-46c2-b6e8-10c61a1719fb}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9e3e9eaf-034a-46c2-b6e8-10c61a1719fb}_OnDiskSnapshotProp
Size 6KB
SHA256 c90c290ddbf41ed71abc07d6a4d6cf98c0f7d447fc5b252380992cedfd380816
MD5 dbcb5374ab52c6a01e5e9db64daf09b7
SHA1 9ffd700a2932ca4eed41dc34c1a37eb1eaad1201
SHA512 f7c16c8ab1c4199836a5c925e3e4cff7e76dd6fec7f7e41d24a5625b1c6c7ada8e6c304a7c6435f888fc381bdd59b951ea26c1fd928165e6273d7c8f45303045
SSDEEP 96:FyPMZTvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:oPab++uVmN
TLSH
T1F5D187085AF54711E2B3AB3129F58557A877B911EF33CB8E0198238E6630A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3488-35-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-29-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-59-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-58-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-57-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-56-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-55-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-54-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-53-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-52-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-51-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-50-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-77-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-62-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-60-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-49-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-48-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-47-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-46-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-45-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-44-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-43-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-42-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-41-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-40-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-39-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-38-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-37-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-31-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-34-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-36-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-33-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-78-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-32-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-27-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-26-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-25-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-24-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-23-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-28-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-30-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-76-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-87-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-86-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-85-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-84-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-83-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-82-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-81-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-80-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-79-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-75-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-74-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-72-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-71-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-70-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-69-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-68-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-67-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-66-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-65-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-64-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-63-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download

memory/3488-61-0x000000002A4F0000-0x000000002A500000-memory.dmp

Download