remcos | 5f473a095ab12daedce6b89432949792e519e353801936845ac819b55ef6c868

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
003060020002.PDF.scr
Size 1.2MB
Sample261031-pgvl5ahc92
SHA256 5f473a095ab12daedce6b89432949792e519e353801936845ac819b55ef6c868
MD5 811269044a20d9ab5f674c58e3df30c2
SHA1 986689bca82aadec7788d31bdc4685f2fd40b952
SHA512 274dd05e652feae56bdd972e2f8bdac0f2440ea5b93b13b1701f39dcc9859b401feb07be656467ada4217dc61824b91f4b6d433a68cc03db261ef1254cf5360b
SSDEEP 24576:hN/BUBb+tYjBFHL68O8gK+hujXG7aX1zJ54D+qN5x:jpUlRhTAK+kXG7aX1zJ5w+S
TLSH
T161551212BBC080F2D17225365AB68690167C7D312F66CADF63E03DAD6A315D1D632FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

greenbase discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.2.1 Pro

Botnet

GREENBASE

amsholdings.ddns.net:60859
swgtcampus0101.duckdns.org:60859
Ocampus.freeddns.org:60859

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-PU0TUA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
4280	kswgidvw.icm
3236	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\rhxs\\KSWGID~1.EXE C:\\Users\\Admin\\rhxs\\LCEHHD~1.MP2"	kswgidvw.icm

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4692	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 3236	4280	kswgidvw.icm	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe
2352	cmd.exe
856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegSvcs.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	003060020002.PDF.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kswgidvw.icm
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2708	ipconfig.exe
1108	ipconfig.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	003060020002.PDF.scr
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	003060020002.PDF.scr
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	003060020002.PDF.scr
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	003060020002.PDF.scr
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	003060020002.PDF.scr
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	003060020002.PDF.scr
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	003060020002.PDF.scr

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm
4280	kswgidvw.icm

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3236	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4692	2656	003060020002.PDF.scr	89
PID 4692 wrote to memory of 2352	4692	WScript.exe	91
PID 4692 wrote to memory of 856	4692	WScript.exe	93
PID 2352 wrote to memory of 2708	2352	cmd.exe	95
PID 856 wrote to memory of 4280	856	cmd.exe	96
PID 4692 wrote to memory of 4828	4692	WScript.exe	98
PID 4828 wrote to memory of 1108	4828	cmd.exe	100
PID 4280 wrote to memory of 3236	4280	kswgidvw.icm	101
PID 4280 wrote to memory of 3236	4280	kswgidvw.icm	101
PID 4280 wrote to memory of 3236	4280	kswgidvw.icm	101

C:\Users\Admin\AppData\Local\Temp\003060020002.PDF.scr
"C:\Users\Admin\AppData\Local\Temp\003060020002.PDF.scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\toxw.vbe"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c kswgidvw.icm lcehhdsfec.mp2
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\kswgidvw.icm
      kswgidvw.icm lcehhdsfec.mp2
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /renew
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 102B
SHA256 524d34e6602b782992c92eb96e78b96616b6e325abcc8e96a125c0106e0cd145
MD5 0373ff2a8f25c694d97273c2d3094121
SHA1 3a7c4c2ce7582fbac6a82ba3a893b8008bf36d80
SHA512 de65179656e2559f7eb9ec93aa638b1d727abd5571108b92707e8d2167277bdbfc8e76e56f33924f807ef33648eb43124b56ce1139e7101641a183e1f141c186
TLSH
T13FB0125D33F11005B850E16AA4F3001629707E9200388C0C31D0138D24B570170413DB
MD5 SHA1 SHA512 TLSH

Submit Download

asolxbpvkx.mp2

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\asolxbpvkx.mp2
Size 40KB
SHA256 89457b5460548c2b2fdabfb2f985504b2831e4ad868b334826d597e68bcf8948
MD5 f17b69334ef03cb35655f1421549ba47
SHA1 9a86440cc8db0c5762aa39dba49758d7535c6d90
SHA512 073e60568829692eae857123a6833d64c5a008e6759fcaf22413ccb1c1bfdf537700d1d0e409d667990e4a4704f3f065b3444383e4f795bc677b7ea3cb2b1af8
SSDEEP 768:ABfYDjVEeXTD6Y22SG6s6Fw32us+G1NIa3SfQlKQuRMPXryrvKzuJADx:ABQxEeDGlX26FhVF7SfQlQqKKzuCx
TLSH
T12513D0D016D907C8083FD77AB21AEACFA16B16651D81109F42B84FD73B37B2CB95A960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asolxbpvkx.mp2

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\asolxbpvkx.mp2
Size 40KB
SHA256 a8e948e948748cb2170b586c8871456780db7cf67bfddf1752caa70013f4dac0
MD5 0c32fd01ac5a40fadfad2d7db91e3599
SHA1 923b516b992de2a369d30ca6e2d8f3653b4eb6a5
SHA512 e2cb13693e0b07872764d2f3a486e3c1efce85aa1ae3ed46beabee6ed8fca52b8ff01d2b81f1facacee9d5e002559357c449e36d72095b3c83356ac6c2f27d2e
SSDEEP 768:ABfYDjVEeXTD6Y22SG6s6Fw32us+G1NIa3SfQlKQuRMPXryrvQzuJADg:ABQxEeDGlX26FhVF7SfQlQqKQzuCg
TLSH
T1EF13D0D016D907C8083FD77AB21AEACFA16B16651D81109F42B84FD73B37B2CB95A960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fkitauiii.mp2

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\fkitauiii.mp2
Size 512B
SHA256 b05975b8326c52e77a9d55010641dcd4d25bc8e7f4a418400005ce4182c05853
MD5 a76065ae26b901f57938daaabfd00344
SHA1 ecd23ba89da346f3c38ff3cce9374cac2e7c0724
SHA512 134b8ca195508a972c475f64aa7642cd4ed956543ac82a8e1bec0d9e602bffe329aec5f0fd143f31c5cc110e233016eed9335a411bf5bda31b7623cf0b2782cd
TLSH
T158F097A7E55A66C7086C59640B0F58610E30719B30446E68301EC4AC2806A3B5BE1BA7
MD5 SHA1 SHA512 TLSH

Submit Download

flowt.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\flowt.mp3
Size 507B
SHA256 aeac991e2b2d2f995c0c43b8eb82a2f5114c29570c4025658d91166baef44fdd
MD5 f0b4bb40265768e2bf4f9b5c5fea0f68
SHA1 bd39285d7d0fc1d02c9718e03ea06bec4017282f
SHA512 089fb43d0038a52f54019f39ccae0504407a290d964e094a2a89f8b5377c1440353044dd15abad231481f81d3a51108ad6cf93995edbe1204d9609e5c6540973
TLSH
T181F00E1EE11816E2252A54AC558008062E3D2BBB39C1C2BA246DA82C49CC9571EB1192
MD5 SHA1 SHA512 TLSH

Submit Download

fpdllxw.ppt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\fpdllxw.ppt
Size 625B
SHA256 1c84a4dd3e122fcda76d0b9235283336621bc11252ae84c747816008d8f1b80d
MD5 be6b4733de60f8d64bde143e53a16260
SHA1 f6b920d2e69bb178ee4c7fcee32d6d06162edad4
SHA512 539680f5029313ddb4b519f8dc65da546d27e91e807249983b13d357cd0411ac1977caddd248dc23b5c5a5050fe9828e6435fb3ff707fe5b32a87bc1b2de6c52
TLSH
T142F041B6E8041683581C78E8182A08722F38F63F3CC048314A3D811E3B4CA1F36DE05F
MD5 SHA1 SHA512 TLSH

Submit Download

iqcmnj.icm

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\iqcmnj.icm
Size 511B
SHA256 8b25d3c93c29d80c9aaeb1ed38b3a05489a9ba3beee80a4a0d42c22ff8864089
MD5 c8370e201a9d9b86093a5bf395adcba8
SHA1 fe9435c5e92627d8bf7db96c0e50472d0be7e7b2
SHA512 95d7d4a6a02715b421972cbc74af13166e1707e90700ccb46ae35493091c2cd6a8cc9b351d59b1f0e9b02ac1d12a9842e60c0ec1b3f70c5e06146515906f1135
TLSH
T114F02B37E85010DA02CCC00C490EAA140BC0FEAD309042E3AA5EE40C3300EBBFF09BA3
MD5 SHA1 SHA512 TLSH

Submit Download

kswgidvw.icm

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kswgidvw.icm
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
TLSH
T101158C0373918062FEA7A5331F5FE7265B7C6D2A0323B52F13981E79B9701B1162E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kwxxaf.docx

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kwxxaf.docx
Size 582B
SHA256 33a0661105f44b3d9879aa15e0f59d8132df3cf4229f8c0c7f9552d37fd3c898
MD5 4f1c0955b094479755d98877aec74085
SHA1 9aa6ee31157cf90e1c880759a5075e81779bdde4
SHA512 b02270c53cba3df39936efc41db11dc20f699eda047bf546b356ac81da892c3fa7dd6aeb212406dd13eec6f8fc2a033cb5c0c6a144d0f902647d2fa91c562bf3
TLSH
T1ABF08BF3C0045B971459D588825E50151E8BBEBE319A5E12296E80E8005BB8F6FD1597
MD5 SHA1 SHA512 TLSH

Submit Download

latwarq.msc

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\latwarq.msc
Size 520B
SHA256 e33fa54c720a54c60f9f2672c225fe6a866dc9fdec3c8d1d5db442a4b2e9e08f
MD5 e17a9488d5cf0adbdd66ec6eb6e1f073
SHA1 a097c7c0105106add79328b315ce4db7b0559748
SHA512 096e9f2e9188b1516c8fde18c0c3f57c563b80465d28ef0774ed540760e698f4a74e3a4e68ad1f3b6357e3e3be5be788cf3e9a1a7298841eb11e5ea8bddd9c2e
TLSH
T14EF0DC33CA02205F8D0E5170C23821D29037303FB8D42AA9276EE449170C26F1D4FE83
MD5 SHA1 SHA512 TLSH

Submit Download

loildsstx.3gp

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\loildsstx.3gp
Size 567B
SHA256 8ed074a638486c5ea78893f0e1404f568f2ded8aaf9fa64f79ec0c49196cd039
MD5 fc16c915fd2434c20a4a3c92cd09a3cd
SHA1 ec0d52999fa068762039141a86273eba17d2d839
SHA512 751250e56ccd791463e9ce7c0dbee68626895293e37f78a61cb1cde54c1843b6f7901d95a07d358ab8a218b170871698a84bc5612f5a43561065dde5813cd032
TLSH
T175F0C033FF9870C844AECA4D1D4D9D067E01A08EB9C42855D13EE8BC4945D476D32793
MD5 SHA1 SHA512 TLSH

Submit Download

luujthnsst.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\luujthnsst.mp3
Size 620B
SHA256 aff49edc74e4f065032cf1e8ed423f6724451ee00200a0b024a7a90cc10a8038
MD5 ba9b8842c877fb517cd4400f3d8d2251
SHA1 23b3e7e4ba6392d79f767db0eb782b2a1bbe426a
SHA512 eab0edb9fe78ea067cebafca29db12bd64b4902807318e16c13bbd6759be113678baa42053592e2b6ef64365ceb23f6cbf2b301b72322ee9960f0cba62dc52c1
TLSH
T1C4F0EB3BEF1A20E5956C3400235BA5305E26B36A38516DE87D9DC05EB828A1F1A0ECA7
MD5 SHA1 SHA512 TLSH

Submit Download

nhkrpot.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nhkrpot.txt
Size 532B
SHA256 1b295a4575fe61a99905906f71ac58251aa052f3dfb6e10eca03b2958db58396
MD5 f1c5d35501719d54783d5e4d7e31fd9f
SHA1 8c34b26a039c56e93d8133d7f67c09ca0e712cf6
SHA512 3ce67dd1958146e8a63559405b9d5baed4ea5ac04e2f478c96604606a3b412591200bf9f69823817f33860d9d820f5eff3a416da1300329beef4401845c95390
TLSH
T134F054F7DB22CD44291C2955061330D9C6157FCFF408C782EA9ED80C7D4126F1933992
MD5 SHA1 SHA512 TLSH

Submit Download

oecfo.pdf

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\oecfo.pdf
Size 584B
SHA256 4fb13f34c59971bb6cd24e1328b0e2eef9509ffab88150f4841dfd28148cfb4c
MD5 4a9a3f5d8ea0e76595f5034913ffbc51
SHA1 02a8659a30ad999e3cf7ea08fad50d797dffb1da
SHA512 7359e8e1b16ed8904c366be9bcdeeba6a4d896b897dc84e395e7fe1a00b0c04a43457bd8fc6fcaca933e0df01bcf2f285226a22925fa71d5f3de46f96dca78ba
TLSH
T19BF09667F3140185C87A6F30D201180A083EB30B3C91A2B8119FE74C5E2D0B74B44C27
MD5 SHA1 SHA512 TLSH

Submit Download

ohvlcsbfv.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ohvlcsbfv.jpg
Size 626B
SHA256 3c3f64cbfb7060f4e3e9e7bf201c888eaf3739b7eac54f08bc4371be642bdb42
MD5 5c1be59fd584187e4e528ea53e816b0b
SHA1 cf85ba163a2ce9c6c43d3e0348580ef405429c25
SHA512 cc73f1541bafbd781c20c15ad90bde511d3e4bdaaf072678fa5b2f18009f79c2f7849e2809b64ef677d8ca8bb7652774283c2bff8940cc1653a01744e02d5373
TLSH
T1B2F0E17FF314D1AF90ADC54D65CA97F819B2F7373B42829A60ACD04916068BAAD06143
MD5 SHA1 SHA512 TLSH

Submit Download

pgaua.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pgaua.exe
Size 546B
SHA256 7c3a923f9c0f38d81864b60138761e5239de98f0e71e6404eaaf42500f48c1d3
MD5 0925210f30a06c403ec6962c01c7a2a4
SHA1 999c93dd1c56bbabc780d9effafe39b31ebdb5fe
SHA512 9cd2e3f3076299d7aedae23fa5f1d2c850d9af2fe005ded46d449ace8b44853a431057dab799b795d0ddc0e05c12296c855b8c9ddc8e301c000675b9910007c9
TLSH
T1EEF00EB3E8CE30273C4C0D79292A2866AAA9B00BD395A00DA54DC45CAE525B75D5EC5F
MD5 SHA1 SHA512 TLSH

Submit Download

qgbrubvc.3gp

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\qgbrubvc.3gp
Size 527B
SHA256 66e398013be2e40284c122c5a34e1b7a949fbb48511c79457faf13c79370658f
MD5 1327a4208a45d0e3ad32c49ea29c5220
SHA1 fdfc1e0ce6dcb22c4463f0d72839684cc2869abc
SHA512 e49dfa6ab965ad589d6f40c4e3c931b1703ec003012994e7ebafb159b1c72e817f8213f03f8f2bfcabbb2e73a3f61af71dc60f41f64fbb4c5c15ba042bb7647f
TLSH
T1A1F00E12F88AD54B002EEC24158500ECEC30F2B3BF4272F5159FC08A3A9D4379A68093
MD5 SHA1 SHA512 TLSH

Submit Download

rvgbm.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rvgbm.dll
Size 608B
SHA256 385944026fc86eab5ef1752c443291e639ec725441863324b87d5b29a61add29
MD5 846274035858f485f9f4ab2522cb618a
SHA1 8a9d4d601325d28ef5f097de5a58d51153c5617f
SHA512 ba07991db919ff19a5595a98bbf314358e7c9934750c0eec20fab8d276de79029f5abbfa41c392774640b5aa15bd1b1bc3e08fe4652f9f312a5b0faf47e7d8b2
TLSH
T156F02073E1047697427CA008022E60AA631330CF72441C22815DD40910459CF4C59BE3
MD5 SHA1 SHA512 TLSH

Submit Download

tjkex.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\tjkex.dll
Size 598B
SHA256 c7522bf0a3a6556399249f3fff3fc8227dbdeb231c85a9eca542de5da9ad7362
MD5 7cb13620cbddb0cd3ef33abc6fa460ec
SHA1 55c428ee6d8126e05eb00103235308c4591a6bfa
SHA512 959375e96bc2508612fcc36f800e7f26dc68beb18a432cabb96887fd90991b30b2c9122d1b0732993385757d50d3cd9717d904feba6559927a73bc8db988ed68
TLSH
T1E3F0E13FE6503FC6186DFF78960F4D151D21B727318141AB267F800CAA5411B58988F6
MD5 SHA1 SHA512 TLSH

Submit Download

toxw.vbe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\toxw.vbe
Size 140KB
SHA256 b953477b61d93c6986314e4790d15c8375e08bcce5d113bf08b078e45039a46b
MD5 ebed6a90994f368cc8be50c3f53df22d
SHA1 e5e20d997d1bc32e5af5cc8df01dc6bc1274f8c4
SHA512 108b6644d76277a826201236760ff61cb381b35d5ff7dd5ed0bc00170ffa54208799a476bc7b8a09918a748811012d459277d060e30d9d6324506df39e7bc697
SSDEEP 384:beeeeeeeeeeeeeeeeEa333333333333333LXSSSSSSSSSSSSS4qffffffffffffG:Q3JS5F
TLSH
T10DE364392768585B7377F107938B261E9437F61F6406E97092821A4F14E104EEFAE3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tsxvndpw.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\tsxvndpw.mp3
Size 591B
SHA256 944d65e157a80243402a91562137c19d930eb69f3d356c630b613753a77cf0f6
MD5 842edc64832b4e622c0d6fdd853be0e1
SHA1 de17fa486d97dc2e78821f975150e96e52be1179
SHA512 45be63983061eb46f2ca64aebbeb5253c48c625f0e71f49cc8b60b61e8779fb8cb9432f8e5c6fc5b02ae86ce6c747c199669299a6276b2fb5d97e08c0b4fb10e
TLSH
T14CF09607E0C600839F9FE53C1745CCF4281CB14B7E42B1911C3DF129AB0093A5ED5657
MD5 SHA1 SHA512 TLSH

Submit Download

txvwm.xls

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\txvwm.xls
Size 561B
SHA256 3c488fe4180622873b5260d58a9675b991134ced003797f057b2b4af32854fdf
MD5 ac62f8ab79d7be917053d7dc059a2e99
SHA1 8415b9a1865a1f90390448626f55675b473ab02f
SHA512 0f6c1d170e0cc1eb5081b2cec224410dd0fe5701b9ffaa40ab6592acb86055edd1d19d133d10886cfb8d3bc846abe11908dbe942b21350940289a254f857bc86
TLSH
T1A6F0C076D19AB1D6445BFBAC110F10750C597ED1379EB418F63CD108199487B08579B3
MD5 SHA1 SHA512 TLSH

Submit Download

veoroctvb.bmp

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\veoroctvb.bmp
Size 602B
SHA256 e845cd8d44d10f4173ee7f2b0dd1f2870ab48d57450255c802fc378ff3ae6ec9
MD5 080efcc9376209235e798432a02e359a
SHA1 d8d5cf30ecf95a245c02dfda81353088dc8f7046
SHA512 f8731689c152669f615fc2d93e087cb2c9c915c98256181c610048a5da0aac1b381db8b65db3caba6bff4da8e23b559b544cf6e7506d3bd249c19a7a504a45d4
TLSH
T125F0E12FE72C678185BCE574192DD15F71823B0B78312D00183EC05E2046AB75E04B57
MD5 SHA1 SHA512 TLSH

Submit Download

wcngxekkug.hfe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\wcngxekkug.hfe
Size 942KB
SHA256 2f9b83a113d2710056cbbf2e20baf5bedfb11a01b63297276e6eaf857642aa7e
MD5 2a655e6c5ef6b6ae96ba31d3b1bb9f50
SHA1 3c3ae69cae810bf7fdae19ca3197e94e6944b5b8
SHA512 caa529c12c307dce91077259764cc8d088626b8df5fafe45f84334a7b976edfbcb874be028e0f71e9f21c77218a5c0a331cb3322826a50b7629cb722311cf658
SSDEEP 24576:rw3narq1PiPeH/FeuXo2INjb/MG8ZTQfqfyEQ3qzVKOXAK6pxt3NVuF0pwx37Zve:+GTZ
TLSH
T13725D8BF8B22C783BA20E5559180939B192EC5397158C77126F3465BE2CEE0711EECED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmxg.icm

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\wmxg.icm
Size 654B
SHA256 96b27335d5540e5123495bbe00eff0e66a47eba86b71867ac5d2111e2a91700b
MD5 44c544453020252f388601b3656d2b90
SHA1 845ba9fdc1fc57b9bde20cb7d56fad2278a387bf
SHA512 61e9c2a11ada03540c06b5e0e865fb34de4b6df398e8c5083e7e3d926617e6f79b08b58bd9a96b3e34190d8418d4a6f1ad4eebf7c932fdcd4b8467f0fa2254f8
TLSH
T1D0F0A217C5C5B48F4E6D1584080331A6171AB24FBA5859AE112DE29F644A4DF2B13647
MD5 SHA1 SHA512 TLSH

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 38KB
SHA256 083bc9319eb8066131b8005dd7013f85f2a27c7908767f94183d3e153b8db12b
MD5 d85f3f7a1d6107853816be0e4b020b7e
SHA1 eec2fbcc0138d7281f57291304637445841c25ed
SHA512 937b3fd8834bd3883d80add70263a6eb7b3c568f97acb99b53da9d25cc9d3962f581d1caf0f8f9eb9e73a51f60be72a189b5e3e45153d4d3c100067bf645f456
SSDEEP 768:nb/ZOc/rh0k2dsDtA6Iq86tqJTN4RXMWF//dj9z9R:7Lrh0ddsDtfcJTN4RXMWZz9R
TLSH
T17803B72897F84316F2B74BB099F5C047ADB2B9536EB5D79C388A530D0A227818553B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asolxbpvkx.mp2

Path C:\Users\Admin\temp\asolxbpvkx.mp2
Size 88B
SHA256 f231793edd0ac945de8e4b5764b8a643ecaff32d23d19cd54978989742f23ca9
MD5 26da82c9a54f2f838f2928fc465bb6e7
SHA1 897de0f2d44427a3ff13543b14de518b13e7888f
SHA512 cd2da38c358b96e14933cd7256e6427cd1489271519b330cd5ee153bfd84f6fd4784653fd755d1bbdce5b6ae0b12217c95dde168521ccdfd19d280985ebad925
TLSH
T133B01243641C703450313A2C43120019160021F4801C162408142618D870965AB480CB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3236-110-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-116-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-96-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-97-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-94-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-104-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-105-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-90-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-111-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-92-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-117-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-123-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-124-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-129-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-130-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-135-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download

memory/3236-136-0x0000000000B00000-0x0000000000FD4000-memory.dmp

Download