remcos | 99b7f76b11336a2316fb019b03693e553080262c3cef7f5337ca6fba7cd5a338

Analysis

max time kernel
232s
max time network
248s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Remcos v5.1.3 Light.exe
Size

38.4MB
MD5

1a787dacd4ac908241f677303af69d6f
SHA1

fa57edb0b2e21e8a55602cb96809efcfcfee65c1
SHA256

4098c759068a197e9b5236af09fc8344da2d0d8d8a3fd4c17824160b1afea5a0
SHA512

a6d0a770e9c425fa9f28a99e81a4f630c362692b9c4c623963871b2de992f5e10c035e1d23e1e8dbcd729777fa630801bf4998f7d83d245d353470353d71b650
SSDEEP

786432:WIXQNSBAVi1Bs2DuYr3jxkQNk58issVWhJDS3IWgrAfUPE+szJFjU:WIXQgAVi1eQ3jnm8ihADnrAuE3HA

Score

10^/10

remcos discovery rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 2 IoCs

pid	Process
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Remcos v5.1.3 Light.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Remcos v5.1.3 Light.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2472	1216	WerFault.exe	53
792	2172	WerFault.exe	55

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remcos v5.1.3 Light.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Remcos v5.1.3 Light.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	Remcos v5.1.3 Light.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	Remcos v5.1.3 Light.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	Remcos v5.1.3 Light.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	Remcos v5.1.3 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	Remcos v5.1.3 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	Remcos v5.1.3 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	Remcos v5.1.3 Light.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2084	Remcos v5.1.3 Light.exe
2976	chrome.exe
2976	chrome.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2976	chrome.exe
2976	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	Remcos v5.1.3 Light.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2084	Remcos v5.1.3 Light.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2084	Remcos v5.1.3 Light.exe
2084	Remcos v5.1.3 Light.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2600	2976	chrome.exe	32
PID 2976 wrote to memory of 2600	2976	chrome.exe	32
PID 2976 wrote to memory of 2600	2976	chrome.exe	32
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 1936	2976	chrome.exe	34
PID 2976 wrote to memory of 2812	2976	chrome.exe	35
PID 2976 wrote to memory of 2812	2976	chrome.exe	35
PID 2976 wrote to memory of 2812	2976	chrome.exe	35
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36
PID 2976 wrote to memory of 2332	2976	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\Remcos v5.1.3 Light.exe
"C:\Users\Admin\AppData\Local\Temp\Remcos v5.1.3 Light.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6a09758,0x7fef6a09768,0x7fef6a09778
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2140 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:1
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2152 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=992 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:2
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1448 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3424 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3576 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:8
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3996 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3416 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3424 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2208 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3496 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 --field-trial-handle=1292,i,17624436935554059346,1797566202431008479,131072 /prefetch:8
  2⤵
  PID:2016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3064

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:2356

C:\Users\Admin\Desktop\remcos_a.exe
"C:\Users\Admin\Desktop\remcos_a.exe"
1⤵
PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 200
  2⤵
  - Program crash
  PID:2472

C:\Users\Admin\Desktop\remcos_a.exe
"C:\Users\Admin\Desktop\remcos_a.exe"
1⤵
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 200
  2⤵
  - Program crash
  PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8d267867-14c8-48fc-874e-f2a739c457f6.tmp

Filesize
6KB

MD5
5faf349c82beb05bbde1ff1dc3aec1df

SHA1
a3ee11cdade5da26f29fbd2a0aa33d5fb3f2c479

SHA256
c4a9d2273f3a7a8e39921db3ceeceea260a31466c0e91cb9ad822c53eadbe496

SHA512
98d36276c3480c760b94d99748b317f947e292b5b8dd564bcf3d29be685d5676e21142bd97482639155de708acc08aa1ee95b8a7383357dd67414aa7551b7454

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
3138ec28dc91c6fb42b2a6c15f02b4a3

SHA1
11facaf66f91a24b87f24129e36950c5ed79c104

SHA256
69703baf659d2794966ee4f9541fb394901875425a5816bcf29c82d88e596794

SHA512
11f2768c17d648377bbd247d6ccaa1149cf80e86ac48df2f3aab2cfdd3c1dc279b26ccce6fb837f4015622ed6f50dc4d5f9063e55c1b32b9fbe281d2af78aa0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c687998c-36e4-4d90-8544-9d7adfff2fc6.tmp

Filesize
5KB

MD5
d8b80653407b772ab8b15dfba045958d

SHA1
62682001da9add2dfe4ae8ff544384202595e0d3

SHA256
73efc2eb72dcce31708f24d80e1d4e211efd5448c4dcd89f1f63643b646fa46b

SHA512
2812bfce2bfec10608ec9e0b98afbe96ccf1c2593e8f1293e902824e59cb6c13341ca2f6eb75c0f8dd52af26c38454d5b32cb30ba7248577dc272c9a291e71c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
325af5dbadc0fa84723355cc46d13f46

SHA1
63a58f6184e6b41e24541c23f1e0627f1ada2cde

SHA256
b290867a507086b99dccbb1b6957642d13363c0929cdc64afafd7eb2e677d98b

SHA512
668ffb2c7849d324d864b8e1bf33d187b3a84abe2d1ab5ee7b927695aa979542f578e8714fc4f0fcd5f536c1a359f438a4ee272271c472d0b0c593cc7d35fe01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6f63d1cd1bf623920bdffa0c18c3b684

SHA1
9d24fd9bbe846eaed75436dea7d604197e19ceed

SHA256
1de4fb3e2b87a8e164ac02c3dbf4329c1994e61897fa4e992087adb01f18f044

SHA512
c3625e06ed57b183b5558015e2a692d7ccb2352b4491e1e775ac0e4d73f34a5bcca6d37e4236847da9925d89cb7828a48b8e7f782f880c1964bbb8004c88e4d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\BuilderProfiles\DefaultProfile.ini

Filesize
398B

MD5
87b2d9f287e386304071ab0367b2f162

SHA1
e1cc7002d96913fa2d9bda2fe23a136fbf6dba43

SHA256
d50671403045ef77352966fdc83b71505b42a89efb791a0e9a27b3fc1033da86

SHA512
f154757d2cf08a9321fa00b7a6eb8728d20e12d3370d9b647e58757bf7d797950ac453da712718e181e4628b38adfb91bd3544c671f11c02bfce344196a9f4ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remcos_Settings.ini

Filesize
52B

MD5
dca2d32862d2ebf0898cf7ec52236857

SHA1
53f7b4bc516a86e07f3987f13902124b883d5f0d

SHA256
6a9d5617021b27db458a4e61248d12a1231d36ec319a2ff793a7d703f679936b

SHA512
8b54c9f0c7ea90e00feeff797f98164402d7e7163313e8d873dfd449c05c453eacf68baea3e574c101104a3837da966be16e0ea9bdbb24b152385643913b6a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remcos_Settings.ini

Filesize
73B

MD5
1b3e506805675892022bde3eae257e8e

SHA1
633743fa461c166d0e5f9bde0a963b6fc45b14a5

SHA256
fe07c59702ab1e3e1a85e86ceb6e284257b2e56facffc02c7ffe63d1ddb5a3db

SHA512
fcadd018d0e427fa0ce769942d767356a2f18448265213a979b8bd99ae30944720d15c6f0c463a462927777ea028328f36aa32bf1e3105ab0e829425f2c5fef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remcos_Settings.ini

Filesize
1KB

MD5
c16d287afb5de93230c1d227ea46e916

SHA1
bdd32b7089725627e291c3a6936a99cbd7805ee1

SHA256
a5c58be5dd574400622fe42269a59b44c23b403c5ea32b102de6ba5821d5f5f2

SHA512
a0b8c49172ca54dd6b2db072c94652697d077b82d553854332a8befc9b36a85ce42d4e31c3ae97413e7436179cb0282f8691ccc02bf9ce1086d88325caf9a3f8

Download Submit
C:\Users\Admin\Desktop\remcos_a.exe

Filesize
428KB

MD5
db6fb88fbbcc89cd8914367351b876ec

SHA1
cb1eb714d5cc7086ebf5cf3cc832103bf6794983

SHA256
ca6d466c2d7949486b741f095229702ff701d36f69deea68f41bd1bede305a75

SHA512
10e38f803fd5eab2a874203ed5cb5dfe0c8f4b23f066b4a2a0aeac16830807d67ef674ab426b6949a3cd492206236bb98185362e2ce44b69fb0d3b19f9b30725

Download Submit
\Users\Admin\AppData\Local\Temp\tls\libeay32.dll

Filesize
1.3MB

MD5
fa5def992198121d4bb5ff3bde39fdc9

SHA1
f684152c245cc708fbaf4d1c0472d783b26c5b18

SHA256
5264a4a478383f501961f2bd9beb1f77a43a487b76090561bba2cbfe951e5305

SHA512
4589382a71cd3a577b83bab4a0209e72e02f603e7da6ef3175b6a74bd958e70a891091dbdff4be0725baca2d665470594b03f074983b3ed3242e5cd04783fdba

Download Submit
\Users\Admin\AppData\Local\Temp\tls\ssleay32.dll

Filesize
330KB

MD5
2117e31688aef8ecf267978265bfcdcd

SHA1
e8c3cfd65ed7947f23b1bb0b66185e1e73913cfc

SHA256
0a4031ab00664cc5e202c8731798800f0475ef76800122cebd71d249655d725f

SHA512
dd03899429c2d542558e30c84a076d7e5dbde5128495954093a7031854c1df68f8ff8eca4c791144937288b084dd261fbe090c4ff9a3e0768e26f0616b474eca

Download Submit
memory/2084-30-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2084-25-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2084-15-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2084-13-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2084-11-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2084-41-0x0000000000400000-0x000000000658D000-memory.dmp

Filesize
97.6MB

Download
memory/2084-44-0x0000000000400000-0x000000000658D000-memory.dmp

Filesize
97.6MB

Download
memory/2084-45-0x0000000000400000-0x000000000658D000-memory.dmp

Filesize
97.6MB

Download
memory/2084-46-0x0000000000400000-0x000000000658D000-memory.dmp

Filesize
97.6MB

Download
memory/2084-47-0x0000000000400000-0x000000000658D000-memory.dmp

Filesize
97.6MB

Download
memory/2084-18-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2084-20-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2084-23-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2084-16-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2084-28-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2084-10-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2084-33-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2084-35-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2084-38-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2084-40-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2084-0-0x0000000000401000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/2084-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2084-358-0x000000000E5E0000-0x000000000E5E2000-memory.dmp

Filesize
8KB

Download
memory/2084-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2084-5-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2084-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2084-8-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2084-487-0x0000000000400000-0x000000000658D000-memory.dmp

Filesize
97.6MB

Download