remcos | 8c151b3db1aafe59d0dd8162411fcdb524c90f8c65325c5a6d55c21e20525c20

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Size 3.9MB
Sample261111-drtxssea55
SHA256 8c151b3db1aafe59d0dd8162411fcdb524c90f8c65325c5a6d55c21e20525c20
MD5 0f4c0bf83458de9905d447677bc11cb1
SHA1 ebb7a214f360ec5e69b019061ef040049c0e85c5
SHA512 032b9596571e28247770512ef16b8c30227b0fd26c7dbbe6775e6c10ab7e012ffb82726d8cc245ae381879f655eb98844ac6fa47ed7489fd60b5f8745a0ee6f8
SSDEEP 49152:Hh+ZkldoPK1XalKCc9nqh+ZkldoPK1XalKCc9noh+ZkldoPK1XalKCc9nqh+ZklY:w2cPK1aw2cPK1ay2cPK1aw2cPK1aF
TLSH
T155169C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

host discovery execution remcos persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

213.208.129.213:137

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
srvs.exe
copy_folder
WindowsApp
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
WindowsApp
keylog_path
%AppData%
mouse_option
false
mutex
remcos_jpetmoenqu
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
srvs
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Custom signature

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 4 IoCs

resource	yara_rule
behavioral2/memory/5164-4-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
behavioral2/memory/5164-10-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
behavioral2/memory/5584-40-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
behavioral2/memory/5584-39-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url	srvs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url	srvs.exe

Executes dropped EXE 25 IoCs

pid	Process
6112	srvs.exe
4888	srvs.exe
5584	srvs.exe
1220	srvs.exe
5012	srvs.exe
5344	srvs.exe
5280	srvs.exe
5712	srvs.exe
5852	srvs.exe
3336	srvs.exe
6052	srvs.exe
2728	srvs.exe
5096	srvs.exe
2528	srvs.exe
1568	srvs.exe
2892	srvs.exe
712	srvs.exe
4924	srvs.exe
2588	srvs.exe
2964	srvs.exe
1044	srvs.exe
4368	srvs.exe
5804	srvs.exe
3152	srvs.exe
464	srvs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\srvs = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsApp\\srvs.exe\""	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\srvs = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsApp\\srvs.exe\""	srvs.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000d00000001c466-20.dat	autoit_exe
behavioral2/files/0x000d00000001c463-22.dat	autoit_exe
behavioral2/files/0x000e00000001c464-29.dat	autoit_exe
behavioral2/files/0x000e00000001c463-32.dat	autoit_exe

Suspicious use of SetThreadContext 31 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 5164	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	89
PID 6112 set thread context of 5584	6112	srvs.exe	96
PID 4888 set thread context of 1220	4888	srvs.exe	97
PID 4280 set thread context of 300	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	98
PID 4888 set thread context of 5344	4888	srvs.exe	100
PID 4280 set thread context of 1536	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	101
PID 4888 set thread context of 5712	4888	srvs.exe	103
PID 4280 set thread context of 1048	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	106
PID 4888 set thread context of 5852	4888	srvs.exe	107
PID 4280 set thread context of 2364	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	108
PID 4888 set thread context of 3336	4888	srvs.exe	109
PID 4280 set thread context of 4528	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	110
PID 4888 set thread context of 6052	4888	srvs.exe	111
PID 4280 set thread context of 876	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	112
PID 4888 set thread context of 2728	4888	srvs.exe	113
PID 4280 set thread context of 3620	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	114
PID 4888 set thread context of 1568	4888	srvs.exe	117
PID 4280 set thread context of 2316	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	118
PID 4888 set thread context of 2588	4888	srvs.exe	122
PID 4280 set thread context of 4328	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	123
PID 4888 set thread context of 2964	4888	srvs.exe	124
PID 4280 set thread context of 2088	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	125
PID 4888 set thread context of 1044	4888	srvs.exe	126
PID 4280 set thread context of 4260	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	127
PID 4888 set thread context of 4368	4888	srvs.exe	128
PID 4280 set thread context of 4616	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	129
PID 4888 set thread context of 5804	4888	srvs.exe	130
PID 4280 set thread context of 5440	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	131
PID 4888 set thread context of 3152	4888	srvs.exe	132
PID 4280 set thread context of 2684	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	133
PID 4888 set thread context of 464	4888	srvs.exe	134

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4608	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	srvs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	srvs.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvs.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4348	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4348	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
6112	srvs.exe
6112	srvs.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4888	srvs.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
6112	srvs.exe
6112	srvs.exe
6112	srvs.exe
4888	srvs.exe
4888	srvs.exe
4888	srvs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5584	srvs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 5164	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	89
PID 4280 wrote to memory of 5164	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	89
PID 5164 wrote to memory of 4608	5164	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	91
PID 4608 wrote to memory of 4348	4608	cmd.exe	93
PID 4608 wrote to memory of 4888	4608	cmd.exe	95
PID 6112 wrote to memory of 5584	6112	srvs.exe	96
PID 6112 wrote to memory of 5584	6112	srvs.exe	96
PID 4888 wrote to memory of 1220	4888	srvs.exe	97
PID 4888 wrote to memory of 1220	4888	srvs.exe	97
PID 4280 wrote to memory of 300	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	98
PID 4280 wrote to memory of 300	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	98
PID 4888 wrote to memory of 5012	4888	srvs.exe	99
PID 4888 wrote to memory of 5344	4888	srvs.exe	100
PID 4888 wrote to memory of 5344	4888	srvs.exe	100
PID 4280 wrote to memory of 1536	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	101
PID 4280 wrote to memory of 1536	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	101
PID 4888 wrote to memory of 5280	4888	srvs.exe	102
PID 4888 wrote to memory of 5712	4888	srvs.exe	103
PID 4888 wrote to memory of 5712	4888	srvs.exe	103
PID 4280 wrote to memory of 1084	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	104
PID 4280 wrote to memory of 3708	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	105
PID 4280 wrote to memory of 1048	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	106
PID 4280 wrote to memory of 1048	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	106
PID 4888 wrote to memory of 5852	4888	srvs.exe	107
PID 4888 wrote to memory of 5852	4888	srvs.exe	107
PID 4280 wrote to memory of 2364	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	108
PID 4280 wrote to memory of 2364	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	108
PID 4888 wrote to memory of 3336	4888	srvs.exe	109
PID 4888 wrote to memory of 3336	4888	srvs.exe	109
PID 4280 wrote to memory of 4528	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	110
PID 4280 wrote to memory of 4528	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	110
PID 4888 wrote to memory of 6052	4888	srvs.exe	111
PID 4888 wrote to memory of 6052	4888	srvs.exe	111
PID 4280 wrote to memory of 876	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	112
PID 4280 wrote to memory of 876	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	112
PID 4888 wrote to memory of 2728	4888	srvs.exe	113
PID 4888 wrote to memory of 2728	4888	srvs.exe	113
PID 4280 wrote to memory of 3620	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	114
PID 4280 wrote to memory of 3620	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	114
PID 4888 wrote to memory of 5096	4888	srvs.exe	115
PID 4888 wrote to memory of 2528	4888	srvs.exe	116
PID 4888 wrote to memory of 1568	4888	srvs.exe	117
PID 4888 wrote to memory of 1568	4888	srvs.exe	117
PID 4280 wrote to memory of 2316	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	118
PID 4280 wrote to memory of 2316	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	118
PID 4888 wrote to memory of 2892	4888	srvs.exe	119
PID 4888 wrote to memory of 712	4888	srvs.exe	120
PID 4888 wrote to memory of 4924	4888	srvs.exe	121
PID 4888 wrote to memory of 2588	4888	srvs.exe	122
PID 4888 wrote to memory of 2588	4888	srvs.exe	122
PID 4280 wrote to memory of 4328	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	123
PID 4280 wrote to memory of 4328	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	123
PID 4888 wrote to memory of 2964	4888	srvs.exe	124
PID 4888 wrote to memory of 2964	4888	srvs.exe	124
PID 4280 wrote to memory of 2088	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	125
PID 4280 wrote to memory of 2088	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	125
PID 4888 wrote to memory of 1044	4888	srvs.exe	126
PID 4888 wrote to memory of 1044	4888	srvs.exe	126
PID 4280 wrote to memory of 4260	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	127
PID 4280 wrote to memory of 4260	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	127
PID 4888 wrote to memory of 4368	4888	srvs.exe	128
PID 4888 wrote to memory of 4368	4888	srvs.exe	128
PID 4280 wrote to memory of 4616	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	129
PID 4280 wrote to memory of 4616	4280	2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4348
  - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
      "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:1220
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5012
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5344
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5280
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5712
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5852
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:3336
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:6052
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2728
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5096
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2528
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:1568
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2892
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:712
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:4924
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2588
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2964
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:1044
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:4368
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:5804
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:3152
    - - C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
        5⤵
        Executes dropped EXE
        
        PID:464
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:300
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:1536
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:1048
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4528
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:876
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:3620
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:2088
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4260
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:4616
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:5440
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_0f4c0bf83458de9905d447677bc11cb1_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:2684

C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
"C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
  "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 101B
SHA256 e6f65c9e9b69042c7ac81b8249ca98ba081f71e9025d4e3d700e6f3cea820077
MD5 16561b6804bab596f1cee44c3b88aea7
SHA1 e8b3d827a38f17ad04309b1760259558e3722061
SHA512 24eaf7ec5964ce2afa96357ec8d03b655359cf2e4136f2009fee638d32d3e9763d0089dae4a4a9a6826cee8ad587719706e6a75bf1b8f63d3665b9be675a68a4
TLSH
T134B01232089085EE5D030EAB0DBD791BE11199907A0634089B4814481B72404F4D2751
MD5 SHA1 SHA512 TLSH

Submit Download

RmClient.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url
Size 64B
SHA256 749d7d16186b3d8b4d53abdc87a9cf2d6334ec9b5ee5e73e24e9db64937bb0b8
MD5 8c2657c9b64e308e633a005cd276b6cf
SHA1 4c79763fe05c29f5ad3cfba820386b814fac2581
SHA512 1c36d996a65316aa979b73d4e9d93edba87ac5f12abf1441d33c2288a3df63f22ad53db81553e613b3447229da5f25e794843c52120c01d59c0d528a63748305
TLSH
T19FA02220028EF82C8202820AC320F08CEC2308E03803F800FA80CF08200AA8083C0282
MD5 SHA1 SHA512 TLSH

Submit Download

srvs.exe

Path C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
Size 3.9MB
SHA256 8c151b3db1aafe59d0dd8162411fcdb524c90f8c65325c5a6d55c21e20525c20
MD5 0f4c0bf83458de9905d447677bc11cb1
SHA1 ebb7a214f360ec5e69b019061ef040049c0e85c5
SHA512 032b9596571e28247770512ef16b8c30227b0fd26c7dbbe6775e6c10ab7e012ffb82726d8cc245ae381879f655eb98844ac6fa47ed7489fd60b5f8745a0ee6f8
SSDEEP 49152:Hh+ZkldoPK1XalKCc9nqh+ZkldoPK1XalKCc9noh+ZkldoPK1XalKCc9nqh+ZklY:w2cPK1aw2cPK1ay2cPK1aw2cPK1aF
TLSH
T155169C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RmClient.vbs

Path C:\Users\Admin\MdRes\RmClient.vbs
Size 103B
SHA256 2f48612a9514cda737b94c5786373ac3821a4ea94be793397db387eea3296b5e
MD5 7a10f112e597d6bc2317f41b888427bd
SHA1 5ced86ad8f9c50080a59f2425ddb39615622caf7
SHA512 6dcb41ba5ebb101e7c891efae20ef8d5dd1d4828a567fa1d2fc26e13dbec00c7f817ec981cc077cfe247c4b5e8a75690809549e36bde48477450150d9eb6e2ed
TLSH
T11DB0121AEC0DC8529049C2E74372920C8BC594612521FE300B00CC4822003041F76112
MD5 SHA1 SHA512 TLSH

Submit Download

klist.exe

Path C:\Users\Admin\MdRes\klist.exe
Size 3.9MB
SHA256 18c15cb9ee14541c87da926c2f55df22ceb5031fcdc302530d9a2e3208cb2688
MD5 9c18f72afe2d8a0e24ad0617a44da18d
SHA1 8d960281fa9d47fa55de2919fcf3b2de8bc620f4
SHA512 0664992311b73a6dcc505e602c406f5f6c0960a02897deac8d7d0b53325bdf692c9ad62ad207d828782ac21fd14d4bd00da6336048ad4b93b0c280eed2b7ffae
SSDEEP 49152:Hh+ZkldoPK1XalKCc9nqh+ZkldoPK1XalKCc9noh+ZkldoPK1XalKCc9nqh+ZklX:w2cPK1aw2cPK1ay2cPK1aw2cPK1ae
TLSH
T1E3169C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Users\Admin\MdRes\klist.exe
Size 3.9MB
SHA256 2c4c914ccc3b2409fd9648a00feebc192468e7c4d7c6a8457c2abe974d07078e
MD5 4462e82b8bc882af8483abf8c9d943e8
SHA1 9a05312bd1d2bc92b3afe78d89beac5d84ca801f
SHA512 9ce82ae8143fc45754d4460c0fc3584cf36344ee568556a98dc574658ba20fbaa9a370cfa2eed3706157826655818e081397c5c602dc77ca57297ddb1d028ed5
SSDEEP 49152:Hh+ZkldoPK1XalKCc9nqh+ZkldoPK1XalKCc9noh+ZkldoPK1XalKCc9nqh+ZklH:w2cPK1aw2cPK1ay2cPK1aw2cPK1a+
TLSH
T157169C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Users\Admin\MdRes\klist.exe
Size 3.9MB
SHA256 f2542e3f078f678853470c8d19408f9119acdbace0280a206338532c2ab855c5
MD5 02ceffa7cd41cfced0377e4a7e043eb1
SHA1 61f193afa12f1bb86e3c1c49937f23337bfe93cc
SHA512 8f9854aecb27175644aa43f29f39b9bcb9929e90e498ddc3361b3e675bece2603c6018237dfb8fc977996a7c9ffacd5fa708f497e60ec7d5eb5172ab8522afe4
SSDEEP 49152:Hh+ZkldoPK1XalKCc9nqh+ZkldoPK1XalKCc9noh+ZkldoPK1XalKCc9nqh+ZklQ:w2cPK1aw2cPK1ay2cPK1aw2cPK1aJ
TLSH
T17C169C0273D1C036FFABA2739B6AF24156BD79354123852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4280-3-0x0000000003B40000-0x0000000003B41000-memory.dmp

Download

memory/5164-4-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5164-10-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5584-40-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5584-39-0x0000000000400000-0x0000000000417000-memory.dmp

Download