Analysis

  • max time kernel
    62s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-09-2024 01:21

General

  • Target

    3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe

  • Size

    2.9MB

  • MD5

    067027b5b20d0d80be90f41dc126fda3

  • SHA1

    b7644f39188e8e8bcb41723833321a43f9474629

  • SHA256

    3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01

  • SHA512

    a56fa19a0e6e4263a9d48e17e13ef76084808f98dfba1306feda58f64d92acb15c93794726697982f15cde699874407f7a991138de423eb5fa87b43d5084362a

  • SSDEEP

    49152:hh+ZkldoPK8Yad7cwj644Mh+ZkldoPK8YaLDNc9:C2cPK8YwjE2cPK8U

Malware Config

Extracted

Family

webmonitor

C2

snpandey4659.wm01.to:443

Attributes
  • config_key

    sFitr5r1ExCJl86X6inyc4qxlzwyw8fK

  • private_key

    t1wG88poq

  • url_path

    /recv4.php

Extracted

Family

remcos

Version

2.3.0 Pro

Botnet

RemoteHost

C2

daya4659.ddns.net:8282

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    3

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-S1KNPZ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

  • WebMonitor payload 2 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 17 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • AutoIT Executable 20 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 30 IoCs
  • HTTP links in PDF interactive object 2 IoCs

    Detects HTTP links in interactive objects within PDF files.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 25 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe
    "C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe
      "C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe
        "C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2324
            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2196
              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4660
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1292
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 576
                    9⤵
                    • Program crash
                    PID:3920
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:928
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 192
                    9⤵
                    • Program crash
                    PID:3048
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1120
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 560
                    9⤵
                    • Program crash
                    PID:3040
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4624
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 560
                    9⤵
                    • Program crash
                    PID:4796
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4484
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 596
                    9⤵
                    • Program crash
                    PID:4612
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1404
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 564
                    9⤵
                    • Program crash
                    PID:4984
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2936
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 228
                    9⤵
                    • Program crash
                    PID:2832
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2196
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 208
                    9⤵
                    • Program crash
                    PID:4136
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe
                  8⤵
                    PID:916
                  • C:\Windows\SysWOW64\svchost.exe
                    C:\Windows\SysWOW64\svchost.exe
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1964
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 568
                      9⤵
                      • Program crash
                      PID:3836
                  • C:\Windows\SysWOW64\svchost.exe
                    C:\Windows\SysWOW64\svchost.exe
                    8⤵
                      PID:4620
                    • C:\Windows\SysWOW64\svchost.exe
                      C:\Windows\SysWOW64\svchost.exe
                      8⤵
                        PID:2296
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2572
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 560
                          9⤵
                          • Program crash
                          PID:2616
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:4400
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 560
                          9⤵
                          • Program crash
                          PID:3792
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:5092
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 192
                          9⤵
                          • Program crash
                          PID:1628
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2112
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 560
                          9⤵
                          • Program crash
                          PID:3088
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:4612
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 212
                          9⤵
                          • Program crash
                          PID:4512
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:4864
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 560
                          9⤵
                          • Program crash
                          PID:3576
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:456
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 564
                          9⤵
                          • Program crash
                          PID:632
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe
                        8⤵
                          PID:4980
                        • C:\Windows\SysWOW64\svchost.exe
                          C:\Windows\SysWOW64\svchost.exe
                          8⤵
                            PID:1088
                          • C:\Windows\SysWOW64\svchost.exe
                            C:\Windows\SysWOW64\svchost.exe
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:224
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 560
                              9⤵
                              • Program crash
                              PID:1568
                          • C:\Windows\SysWOW64\svchost.exe
                            C:\Windows\SysWOW64\svchost.exe
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:1996
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 560
                              9⤵
                              • Program crash
                              PID:4392
                          • C:\Windows\SysWOW64\svchost.exe
                            C:\Windows\SysWOW64\svchost.exe
                            8⤵
                              PID:4872
                            • C:\Windows\SysWOW64\svchost.exe
                              C:\Windows\SysWOW64\svchost.exe
                              8⤵
                                PID:1540
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\SysWOW64\svchost.exe
                                8⤵
                                • System Location Discovery: System Language Discovery
                                PID:3088
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 564
                                  9⤵
                                  • Program crash
                                  PID:3516
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\SysWOW64\svchost.exe
                                8⤵
                                • System Location Discovery: System Language Discovery
                                PID:3452
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 200
                                  9⤵
                                  • Program crash
                                  PID:4188
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\SysWOW64\svchost.exe
                                8⤵
                                • System Location Discovery: System Language Discovery
                                PID:2676
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 560
                                  9⤵
                                  • Program crash
                                  PID:4932
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\SysWOW64\svchost.exe
                                8⤵
                                • System Location Discovery: System Language Discovery
                                PID:3664
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 560
                                  9⤵
                                  • Program crash
                                  PID:4628
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\SysWOW64\svchost.exe
                                8⤵
                                • System Location Discovery: System Language Discovery
                                PID:4468
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 560
                                  9⤵
                                  • Program crash
                                  PID:808
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\SysWOW64\svchost.exe
                                8⤵
                                • System Location Discovery: System Language Discovery
                                PID:3488
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 560
                                  9⤵
                                  • Program crash
                                  PID:4004
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\SysWOW64\svchost.exe
                                8⤵
                                • System Location Discovery: System Language Discovery
                                PID:3192
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 568
                                  9⤵
                                  • Program crash
                                  PID:1156
                            • C:\Windows\SysWOW64\schtasks.exe
                              "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
                              7⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:4348
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:4596
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Modifies Internet Explorer settings
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1864
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3264
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=38E0AC1278AB28164564502AEC719024 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1692
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FD04FA19B0A978456D678766D603DB04 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FD04FA19B0A978456D678766D603DB04 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4924
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4064ACB14660DD87B68497D58520AC5A --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1368
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=79207EAD2AE2F7CADC78DB8635DAF6A5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=79207EAD2AE2F7CADC78DB8635DAF6A5 --renderer-client-id=5 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job /prefetch:1
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4240
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3DD458A74F2AB662296C7EBDF6D93611 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:3560
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E002EE61D3B461B378876CD30A10A252 --mojo-platform-channel-handle=1992 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4816
                  • C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe
                    "C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"
                    2⤵
                      PID:4012
                    • C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe
                      "C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"
                      2⤵
                        PID:3576
                      • C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe
                        "C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"
                        2⤵
                          PID:2080
                        • C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe
                          "C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"
                          2⤵
                          • Adds Run key to start application
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: RenamesItself
                          PID:4220
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:4192
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:1384
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1292 -ip 1292
                          1⤵
                            PID:208
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 928 -ip 928
                            1⤵
                              PID:1504
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1120 -ip 1120
                              1⤵
                                PID:2080
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4624 -ip 4624
                                1⤵
                                  PID:3488
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4484 -ip 4484
                                  1⤵
                                    PID:1236
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1404 -ip 1404
                                    1⤵
                                      PID:4556
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2936 -ip 2936
                                      1⤵
                                        PID:208
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2196 -ip 2196
                                        1⤵
                                          PID:2532
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1964 -ip 1964
                                          1⤵
                                            PID:4380
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2572 -ip 2572
                                            1⤵
                                              PID:4336
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4400 -ip 4400
                                              1⤵
                                                PID:3952
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5092 -ip 5092
                                                1⤵
                                                  PID:4808
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2112 -ip 2112
                                                  1⤵
                                                    PID:744
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4612 -ip 4612
                                                    1⤵
                                                      PID:1000
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4864 -ip 4864
                                                      1⤵
                                                        PID:3100
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 456 -ip 456
                                                        1⤵
                                                          PID:2080
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 224 -ip 224
                                                          1⤵
                                                            PID:3372
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1996 -ip 1996
                                                            1⤵
                                                              PID:4312
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3088 -ip 3088
                                                              1⤵
                                                                PID:2996
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3452 -ip 3452
                                                                1⤵
                                                                  PID:5068
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2676 -ip 2676
                                                                  1⤵
                                                                    PID:2368
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3664 -ip 3664
                                                                    1⤵
                                                                      PID:4308
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4468 -ip 4468
                                                                      1⤵
                                                                        PID:3952
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3488 -ip 3488
                                                                        1⤵
                                                                          PID:3480
                                                                        • C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
                                                                          C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
                                                                          1⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1628
                                                                          • C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
                                                                            "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:4192
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:1736
                                                                        • C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
                                                                          C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
                                                                          1⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4348
                                                                          • C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
                                                                            "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3672
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:4728
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3192 -ip 3192
                                                                          1⤵
                                                                            PID:2960
                                                                          • C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
                                                                            C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
                                                                            1⤵
                                                                              PID:1920
                                                                              • C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
                                                                                "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
                                                                                2⤵
                                                                                  PID:2588
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
                                                                                  2⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:3432
                                                                              • C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
                                                                                C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
                                                                                1⤵
                                                                                  PID:5068
                                                                                  • C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
                                                                                    2⤵
                                                                                      PID:3916
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
                                                                                      2⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:4668

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                    Filesize

                                                                                    56KB

                                                                                    MD5

                                                                                    752a1f26b18748311b691c7d8fc20633

                                                                                    SHA1

                                                                                    c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                                                                    SHA256

                                                                                    111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                                                                    SHA512

                                                                                    a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                                                                                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                    Filesize

                                                                                    64KB

                                                                                    MD5

                                                                                    6bbf2fd7e7696f2883b6459059d4066d

                                                                                    SHA1

                                                                                    bda3fd6ab1d20b45a1f658f51df06a09889c957b

                                                                                    SHA256

                                                                                    d92a0881b71164ac5e13fae30c1fbc04c1f854fa46fca110673c93e1c94b9417

                                                                                    SHA512

                                                                                    49c9696826c1867475461714b252de5a407346efabfa80348f7d14a63e95bcea697b5da3a6f94cea45b11e6070186f964bfdb46f8a9df4260039898177e18dfe

                                                                                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                    Filesize

                                                                                    36KB

                                                                                    MD5

                                                                                    b30d3becc8731792523d599d949e63f5

                                                                                    SHA1

                                                                                    19350257e42d7aee17fb3bf139a9d3adb330fad4

                                                                                    SHA256

                                                                                    b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                                                                                    SHA512

                                                                                    523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                                                                                  • C:\Users\Admin\AppData\Local\Temp\install.vbs

                                                                                    Filesize

                                                                                    418B

                                                                                    MD5

                                                                                    ff449f6f7bc5e2d800eb30e2d2c56611

                                                                                    SHA1

                                                                                    93419ea805b9ce35a766e5c56db50d54c2d3f94b

                                                                                    SHA256

                                                                                    655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416

                                                                                    SHA512

                                                                                    02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6

                                                                                  • C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf

                                                                                    Filesize

                                                                                    340KB

                                                                                    MD5

                                                                                    bb0aa1bade4df17033a05d8d682b44d2

                                                                                    SHA1

                                                                                    bec4b0a8a7413d158cf6705a3c888bdf36a4371b

                                                                                    SHA256

                                                                                    96d6c8c54390b476e8f8f42b99b52efb19eca152bf046c254992bc2f2faba764

                                                                                    SHA512

                                                                                    6bfe1b289f9c84d4db5a564ed129f7920775946981d5da5cb7753d63a141d84486ba9e958044e8162fba2eba875e56c358f92091b760e07b8cbe459e4202e4d9

                                                                                  • C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe

                                                                                    Filesize

                                                                                    1.1MB

                                                                                    MD5

                                                                                    ceb1ccb24967d31ec7c4ac1aee82afbd

                                                                                    SHA1

                                                                                    daa2bb097446f4a66fd2dc346465f6cd9ff49e2b

                                                                                    SHA256

                                                                                    7c88dbe6c9c0a38ba3d09483e915cae9e1f73546f271b2f741ea3ed8781f9639

                                                                                    SHA512

                                                                                    3aea1338a3e26d6e91c5f683c899bcb9e0a6469d294ed7938d1922a09f3b2a57483fbf1fbecb170f2f2e07c1035f0ca9418171483987be712a3eec830f2c97d7

                                                                                  • C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe

                                                                                    Filesize

                                                                                    2.9MB

                                                                                    MD5

                                                                                    54ab36dc04263d956b36e4cb55a391aa

                                                                                    SHA1

                                                                                    f595ff0af54ab6bfdea2f3e44e3511a26b98460d

                                                                                    SHA256

                                                                                    ae3b64c6e9018feddd5c987f35f7397af2556e2d4b010159cbd8172cd7400c40

                                                                                    SHA512

                                                                                    0bb1279aac67c56794cea53b083bb7b82edbc399f95f8a45269ecf893f9c5af55a1c0cec7f421184c8862196f4b132049315a203dbef32cf778aa56030e32f3a

                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\logs.dat

                                                                                    Filesize

                                                                                    118B

                                                                                    MD5

                                                                                    3a206e64c0ee5ddf3950a7dbdc60c420

                                                                                    SHA1

                                                                                    faa0dbeef653bc3229626839b64dee6da5e96d1e

                                                                                    SHA256

                                                                                    8ca5c6792af5a693d3e3bda299ac2b9b747501a2176fd8384a8bd527c1f0c230

                                                                                    SHA512

                                                                                    45b1ad5b207d0d90148b173953f725541cf087b1340b784adffe5bb1d10235bafe66a8d8261a024a7f462cc6154908bc81df99fcd2f2dd22a8e4fd66717b59f8

                                                                                  • C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe

                                                                                    Filesize

                                                                                    1.1MB

                                                                                    MD5

                                                                                    d5581c9db64b399c7d0cdb3f7b78673b

                                                                                    SHA1

                                                                                    87396211e6468d73c97301fe0b673f64bcd6d17c

                                                                                    SHA256

                                                                                    7210f2ca290296d1f6e61da4b3192ad19afd719d6cf77dbb2d6810734b349826

                                                                                    SHA512

                                                                                    5a8034902bfd110826aebc8196469f0dea26d94fcb093406342657b9660f400cc495a6a7ce843d32a7541083cfbc3f0fbdf9aab1ad08294729307bffe7c512c6

                                                                                  • memory/928-85-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/1120-87-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/1292-81-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/1292-80-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/1404-189-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/1864-204-0x000000000B400000-0x000000000B54D000-memory.dmp

                                                                                    Filesize

                                                                                    1.3MB

                                                                                  • memory/1864-205-0x000000000B400000-0x000000000B6AB000-memory.dmp

                                                                                    Filesize

                                                                                    2.7MB

                                                                                  • memory/1964-196-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/2112-208-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/2196-194-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/2572-198-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/2936-191-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/3408-23-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                  • memory/3408-30-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                  • memory/4220-21-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                    Filesize

                                                                                    768KB

                                                                                  • memory/4220-19-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                    Filesize

                                                                                    768KB

                                                                                  • memory/4220-14-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                    Filesize

                                                                                    768KB

                                                                                  • memory/4220-18-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                    Filesize

                                                                                    768KB

                                                                                  • memory/4220-192-0x00000000009B0000-0x0000000000C9B000-memory.dmp

                                                                                    Filesize

                                                                                    2.9MB

                                                                                  • memory/4220-20-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                    Filesize

                                                                                    768KB

                                                                                  • memory/4400-201-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/4484-104-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/4612-210-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/4624-89-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/4660-73-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                  • memory/4660-76-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                  • memory/4660-77-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                  • memory/4660-72-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                  • memory/4864-212-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/5092-203-0x0000000000400000-0x0000000000526000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB