remcos | 23a9310f890f52da13e9c12d8f4753fa714941a430883181e2bc1e6bfadb098f

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Size 973KB
Sample261101-2rrpfade55
SHA256 23a9310f890f52da13e9c12d8f4753fa714941a430883181e2bc1e6bfadb098f
MD5 92a1ca49b8e6f1fbba8c6761db019a59
SHA1 061c1af8d602043a4d6d4a2421175dc438f432cc
SHA512 61a70c6d21b8a93601f537054623497aa255fc17dcfb7ada9f97f59234338f5fd466c61645af610347fcdce10ef3ddf6e2ed1e2e68f000f7d910b8dec461f2cb
SSDEEP 24576:QAHnh+eWsN3skA4RV1Hom2KXFmIalKCc9GS5d:Hh+ZkldoPK1XalKCc9nd
TLSH
T194259C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

host discovery execution remcos persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

213.208.129.213:137

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
srvs.exe
copy_folder
WindowsApp
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
WindowsApp
keylog_path
%AppData%
mouse_option
false
mutex
remcos_jpetmoenqu
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
srvs
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 4 IoCs

resource	yara_rule
behavioral2/memory/1660-4-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
behavioral2/memory/1660-10-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
behavioral2/memory/3444-34-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
behavioral2/memory/3444-36-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url	srvs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url	srvs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe

Executes dropped EXE 24 IoCs

pid	Process
5004	srvs.exe
5756	srvs.exe
3444	srvs.exe
5956	srvs.exe
2116	srvs.exe
1132	srvs.exe
2760	srvs.exe
724	srvs.exe
2372	srvs.exe
1800	srvs.exe
5568	srvs.exe
5252	srvs.exe
2860	srvs.exe
2288	srvs.exe
4508	srvs.exe
3036	srvs.exe
2956	srvs.exe
5800	srvs.exe
4484	srvs.exe
3936	srvs.exe
3116	srvs.exe
108	srvs.exe
2580	srvs.exe
1700	srvs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\srvs = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsApp\\srvs.exe\""	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\srvs = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsApp\\srvs.exe\""	srvs.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000d00000001c52c-19.dat	autoit_exe
behavioral2/files/0x002300000001c49c-20.dat	autoit_exe
behavioral2/files/0x001200000001c52a-37.dat	autoit_exe

Suspicious use of SetThreadContext 31 IoCs

description	pid	Process	procid_target
PID 3344 set thread context of 1660	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	90
PID 5004 set thread context of 3444	5004	srvs.exe	97
PID 5756 set thread context of 5956	5756	srvs.exe	98
PID 3344 set thread context of 4944	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	99
PID 5756 set thread context of 2116	5756	srvs.exe	100
PID 3344 set thread context of 2736	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	102
PID 5756 set thread context of 1132	5756	srvs.exe	103
PID 3344 set thread context of 3960	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	104
PID 5756 set thread context of 2760	5756	srvs.exe	105
PID 3344 set thread context of 3164	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	106
PID 5756 set thread context of 724	5756	srvs.exe	107
PID 3344 set thread context of 3704	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	108
PID 5756 set thread context of 5568	5756	srvs.exe	111
PID 3344 set thread context of 2484	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	112
PID 5756 set thread context of 2860	5756	srvs.exe	114
PID 3344 set thread context of 4304	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	117
PID 5756 set thread context of 2288	5756	srvs.exe	118
PID 3344 set thread context of 3404	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	119
PID 5756 set thread context of 4508	5756	srvs.exe	120
PID 3344 set thread context of 1828	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	121
PID 5756 set thread context of 2956	5756	srvs.exe	123
PID 3344 set thread context of 3224	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	124
PID 5756 set thread context of 4484	5756	srvs.exe	126
PID 3344 set thread context of 4872	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	129
PID 5756 set thread context of 3116	5756	srvs.exe	131
PID 3344 set thread context of 5036	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	132
PID 5756 set thread context of 108	5756	srvs.exe	133
PID 3344 set thread context of 3040	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	134
PID 5756 set thread context of 2580	5756	srvs.exe	135
PID 3344 set thread context of 4404	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	136
PID 5756 set thread context of 1700	5756	srvs.exe	137

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4268	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	srvs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	srvs.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvs.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3260	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3260	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
5004	srvs.exe
5004	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5756	srvs.exe
5756	srvs.exe
5004	srvs.exe
5004	srvs.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
5756	srvs.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
5004	srvs.exe
5004	srvs.exe
5004	srvs.exe
5756	srvs.exe
5756	srvs.exe
5756	srvs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3444	srvs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 5300	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	89
PID 3344 wrote to memory of 1660	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	90
PID 3344 wrote to memory of 1660	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	90
PID 1660 wrote to memory of 4268	1660	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	91
PID 4268 wrote to memory of 3260	4268	cmd.exe	94
PID 4268 wrote to memory of 5756	4268	cmd.exe	96
PID 5004 wrote to memory of 3444	5004	srvs.exe	97
PID 5004 wrote to memory of 3444	5004	srvs.exe	97
PID 5756 wrote to memory of 5956	5756	srvs.exe	98
PID 5756 wrote to memory of 5956	5756	srvs.exe	98
PID 3344 wrote to memory of 4944	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	99
PID 3344 wrote to memory of 4944	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	99
PID 5756 wrote to memory of 2116	5756	srvs.exe	100
PID 5756 wrote to memory of 2116	5756	srvs.exe	100
PID 3344 wrote to memory of 3228	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	101
PID 3344 wrote to memory of 2736	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	102
PID 3344 wrote to memory of 2736	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	102
PID 5756 wrote to memory of 1132	5756	srvs.exe	103
PID 5756 wrote to memory of 1132	5756	srvs.exe	103
PID 3344 wrote to memory of 3960	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	104
PID 3344 wrote to memory of 3960	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	104
PID 5756 wrote to memory of 2760	5756	srvs.exe	105
PID 5756 wrote to memory of 2760	5756	srvs.exe	105
PID 3344 wrote to memory of 3164	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	106
PID 3344 wrote to memory of 3164	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	106
PID 5756 wrote to memory of 724	5756	srvs.exe	107
PID 5756 wrote to memory of 724	5756	srvs.exe	107
PID 3344 wrote to memory of 3704	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	108
PID 3344 wrote to memory of 3704	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	108
PID 5756 wrote to memory of 2372	5756	srvs.exe	109
PID 5756 wrote to memory of 1800	5756	srvs.exe	110
PID 5756 wrote to memory of 5568	5756	srvs.exe	111
PID 5756 wrote to memory of 5568	5756	srvs.exe	111
PID 3344 wrote to memory of 2484	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	112
PID 3344 wrote to memory of 2484	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	112
PID 5756 wrote to memory of 5252	5756	srvs.exe	113
PID 5756 wrote to memory of 2860	5756	srvs.exe	114
PID 5756 wrote to memory of 2860	5756	srvs.exe	114
PID 3344 wrote to memory of 4892	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	115
PID 3344 wrote to memory of 6116	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	116
PID 3344 wrote to memory of 4304	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	117
PID 3344 wrote to memory of 4304	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	117
PID 5756 wrote to memory of 2288	5756	srvs.exe	118
PID 5756 wrote to memory of 2288	5756	srvs.exe	118
PID 3344 wrote to memory of 3404	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	119
PID 3344 wrote to memory of 3404	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	119
PID 5756 wrote to memory of 4508	5756	srvs.exe	120
PID 5756 wrote to memory of 4508	5756	srvs.exe	120
PID 3344 wrote to memory of 1828	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	121
PID 3344 wrote to memory of 1828	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	121
PID 5756 wrote to memory of 3036	5756	srvs.exe	122
PID 5756 wrote to memory of 2956	5756	srvs.exe	123
PID 5756 wrote to memory of 2956	5756	srvs.exe	123
PID 3344 wrote to memory of 3224	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	124
PID 3344 wrote to memory of 3224	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	124
PID 5756 wrote to memory of 5800	5756	srvs.exe	125
PID 5756 wrote to memory of 4484	5756	srvs.exe	126
PID 5756 wrote to memory of 4484	5756	srvs.exe	126
PID 3344 wrote to memory of 3424	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	127
PID 3344 wrote to memory of 5984	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	128
PID 3344 wrote to memory of 4872	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	129
PID 3344 wrote to memory of 4872	3344	2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	129
PID 5756 wrote to memory of 3936	5756	srvs.exe	130
PID 5756 wrote to memory of 3116	5756	srvs.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:5300
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3260
  - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
      "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5756
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5956
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2116
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:1132
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2760
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:724
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2372
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:1800
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5568
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5252
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2860
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2288
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:4508
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:3036
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2956
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5800
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:4484
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:3936
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:3116
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:108
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2580
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:1700
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3228
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:2736
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3960
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3164
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3704
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:6116
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3404
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3224
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3424
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:5984
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:5036
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-31_92a1ca49b8e6f1fbba8c6761db019a59_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4404

C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
"C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
  "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 101B
SHA256 e6f65c9e9b69042c7ac81b8249ca98ba081f71e9025d4e3d700e6f3cea820077
MD5 16561b6804bab596f1cee44c3b88aea7
SHA1 e8b3d827a38f17ad04309b1760259558e3722061
SHA512 24eaf7ec5964ce2afa96357ec8d03b655359cf2e4136f2009fee638d32d3e9763d0089dae4a4a9a6826cee8ad587719706e6a75bf1b8f63d3665b9be675a68a4
TLSH
T134B01232089085EE5D030EAB0DBD791BE11199907A0634089B4814481B72404F4D2751
MD5 SHA1 SHA512 TLSH

Submit Download

RmClient.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url
Size 64B
SHA256 749d7d16186b3d8b4d53abdc87a9cf2d6334ec9b5ee5e73e24e9db64937bb0b8
MD5 8c2657c9b64e308e633a005cd276b6cf
SHA1 4c79763fe05c29f5ad3cfba820386b814fac2581
SHA512 1c36d996a65316aa979b73d4e9d93edba87ac5f12abf1441d33c2288a3df63f22ad53db81553e613b3447229da5f25e794843c52120c01d59c0d528a63748305
TLSH
T19FA02220028EF82C8202820AC320F08CEC2308E03803F800FA80CF08200AA8083C0282
MD5 SHA1 SHA512 TLSH

Submit Download

srvs.exe

Path C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
Size 973KB
SHA256 23a9310f890f52da13e9c12d8f4753fa714941a430883181e2bc1e6bfadb098f
MD5 92a1ca49b8e6f1fbba8c6761db019a59
SHA1 061c1af8d602043a4d6d4a2421175dc438f432cc
SHA512 61a70c6d21b8a93601f537054623497aa255fc17dcfb7ada9f97f59234338f5fd466c61645af610347fcdce10ef3ddf6e2ed1e2e68f000f7d910b8dec461f2cb
SSDEEP 24576:QAHnh+eWsN3skA4RV1Hom2KXFmIalKCc9GS5d:Hh+ZkldoPK1XalKCc9nd
TLSH
T194259C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RmClient.vbs

Path C:\Users\Admin\MdRes\RmClient.vbs
Size 103B
SHA256 2f48612a9514cda737b94c5786373ac3821a4ea94be793397db387eea3296b5e
MD5 7a10f112e597d6bc2317f41b888427bd
SHA1 5ced86ad8f9c50080a59f2425ddb39615622caf7
SHA512 6dcb41ba5ebb101e7c891efae20ef8d5dd1d4828a567fa1d2fc26e13dbec00c7f817ec981cc077cfe247c4b5e8a75690809549e36bde48477450150d9eb6e2ed
TLSH
T11DB0121AEC0DC8529049C2E74372920C8BC594612521FE300B00CC4822003041F76112
MD5 SHA1 SHA512 TLSH

Submit Download

klist.exe

Path C:\Users\Admin\MdRes\klist.exe
Size 975KB
SHA256 60b574f29bdb5c71e12781ea817f3614473e3bebff79ae2f1fbe017fa8def46e
MD5 21eca3357bc98d3f3ba8060b7100dc14
SHA1 d8f41c717c8214e61b7e712797fcd159d94729bd
SHA512 2ec0bbb973339f8937921c3f4112cc7efbbb913bfba99499463e02b1f8654e79e31af448a608f66b201ca3a519e410e7f468c693dd4bda147186f3ecf20fb72b
SSDEEP 24576:QAHnh+eWsN3skA4RV1Hom2KXFmIalKCc9GS5J:Hh+ZkldoPK1XalKCc9nJ
TLSH
T1CA259C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Users\Admin\MdRes\klist.exe
Size 975KB
SHA256 acc1d6c4d031b745ca37fa6e237feec04834d3284cde177de903cb76a69f7dfc
MD5 81ddbee330baefce70a77a5a285b809f
SHA1 a5f2abf0abdaa78b16ce7be66247555ec0e82c1e
SHA512 00e07f1b2d68e123a3decd7d129f115dbaf844fada2664fa4bcc6f1e675c51b6acb4cfc28834d3c307f858da095a38fa8989b0729769579f46a450b8d5144aa7
SSDEEP 24576:QAHnh+eWsN3skA4RV1Hom2KXFmIalKCc9GS5E:Hh+ZkldoPK1XalKCc9nE
TLSH
T15B259C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1660-4-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1660-10-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3344-3-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3444-34-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3444-36-0x0000000000400000-0x0000000000417000-memory.dmp

Download