Analysis

  • max time kernel
    179s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 19:26

General

  • Target

    41589419116464448286035679864158972845276735013687.exe

  • Size

    2.7MB

  • MD5

    b00ececc12e8dedbe256613f1b945b23

  • SHA1

    97cb8249006a80e0773bb3aaba631171715ffcd4

  • SHA256

    87768a35d6a9b73f30d4d4adcd96b8c4cca695dec762fe7962859972fbd75e56

  • SHA512

    afd4ea1986da088c3f4c2757baeb4b21b14bd4b5e22e00260eca7e719c8fc78d803443b9dfc457799ab7b2d7d306395fbd48bf9d1bde260106a7ad3038c93d97

  • SSDEEP

    49152:9wREDDM04bCaLjmFy1nOFPG/3E1/4BtkMgHeXDREnz+d:9wREsbCaLaeO2EJSkTs0+d

Malware Config

Extracted

Family

remcos

Botnet

DropBoxF

C2

cubalibreu6obyau6j8.duckdns.org:2020

Attributes
  • audio_path

    %UserProfile%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    flof

  • keylog_flag

    false

  • keylog_folder

    tlof

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    fMXJEdWdidHdX-6WDMJ4

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to execute payload.

  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe
    "C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\is-FA8PC.tmp\41589419116464448286035679864158972845276735013687.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FA8PC.tmp\41589419116464448286035679864158972845276735013687.tmp" /SL5="$501C4,1880700,795136,C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe" /VERYSILENT /SUPPRESSMSGBOXES
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\SysWOW64\timeout.exe
          timeout /T 3
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:4296
        • C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe
          "C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe" /VERYSILENT /SUPPRESSMSGBOXES
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2188
          • C:\Users\Admin\AppData\Local\Temp\is-FRALO.tmp\41589419116464448286035679864158972845276735013687.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-FRALO.tmp\41589419116464448286035679864158972845276735013687.tmp" /SL5="$A0034,1880700,795136,C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe" /VERYSILENT /SUPPRESSMSGBOXES
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2432
            • C:\Windows\SysWOW64\regsvr32.exe
              "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\CluelessStork.dll"
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2984
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll' }) { exit 0 } else { exit 1 }"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4656
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{14556AE9-B7F9-43B6-A44B-EF81D5CAA8CE}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4524
              • C:\Windows\SysWOW64\explorer.exe
                "explorer" C:\Users\Admin\AppData\Roaming\new_document.pdf
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4472
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\new_document.pdf"
      2⤵
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3284
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=80FF53341566AB28FB9C3E42884567FF --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4044
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B2817EEAFE0D5714FE953712C17661DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B2817EEAFE0D5714FE953712C17661DD --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
          4⤵
          • System Location Discovery: System Language Discovery
          PID:764
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E50EE9FAFEA7A5E54713427F18048E46 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1168
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F4594C25E8CABF9702118D23A881D52B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F4594C25E8CABF9702118D23A881D52B --renderer-client-id=5 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job /prefetch:1
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4824
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=12B020B9D6B91FEC7C5499F935E89AF3 --mojo-platform-channel-handle=2628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2588
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=815D8B629F04DC900B6E8ADD5421EE8F --mojo-platform-channel-handle=2860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1508
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    1⤵
      PID:2976
    • C:\Windows\system32\regsvr32.EXE
      C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll
      1⤵
        PID:4344
        • C:\Windows\SysWOW64\regsvr32.exe
          /S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1212
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll' }) { exit 0 } else { exit 1 }"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4844
      • C:\Windows\system32\regsvr32.EXE
        C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll
        1⤵
          PID:3476
          • C:\Windows\SysWOW64\regsvr32.exe
            /S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2760
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll' }) { exit 0 } else { exit 1 }"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3456

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          36KB

          MD5

          b30d3becc8731792523d599d949e63f5

          SHA1

          19350257e42d7aee17fb3bf139a9d3adb330fad4

          SHA256

          b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

          SHA512

          523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          56KB

          MD5

          752a1f26b18748311b691c7d8fc20633

          SHA1

          c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

          SHA256

          111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

          SHA512

          a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          64KB

          MD5

          0da4fbadfe41831eb7915c5452bcbcd4

          SHA1

          b76c8bf3645a1716a278dc6574d8165d987318e2

          SHA256

          cccb80d0f63802e806b3ca803f35d8f657246f66154b05cf3f7519d34993d004

          SHA512

          500bfc6b278304d0aba2a7fb465075081daefca009608563e33df7d865d49e2c6aecc55abaf0a757646b8e934b56f91bd4033c0da83f07a48cdef176bc909ce0

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          9751fcb3d8dc82d33d50eebe53abe314

          SHA1

          7a680212700a5d9f3ca67c81e0e243834387c20c

          SHA256

          ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

          SHA512

          54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          21KB

          MD5

          903cfb20df5bde5d658e05c3dfa5346c

          SHA1

          36c373d3f42d95c7bcbcbe8bd7e291c80e27a660

          SHA256

          24d5c2c634a50cab3080212087ca1e2d7d288af80c74336b33d8deb28b5f1df5

          SHA512

          0b37aad41f009dae8770539d8de2fdc3b20e562ee8f5aecf415fe42a8191a7432be0058ebe5b88d410f32884682af8f96393408adabd0ed6301c7c61450d48a5

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          20KB

          MD5

          87d27d894072dbcdae144f36253941e9

          SHA1

          acaac3d6fef14f0c1a2f57d29c6fa493d63181d6

          SHA256

          8437d029f238f478f09820f49f92871b570bba632c765173f1873d844a0b1f02

          SHA512

          6d945604d50732c663b0d63f912313f7b454d8c7fb6b15cc5775c1ec432f01e3d0eb782d4287b3cbf231d98b40d19997e2dca6a0fe88d17b0e14f93cdeb07bb9

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          20KB

          MD5

          1d11170672c3a451b038b58de0b12450

          SHA1

          e59bbf2f7762b17db96f1a4c0869bb6519116cc3

          SHA256

          23a766275e48d11c8897ab3cd719f762410382f423489dcc822bc4e1db138957

          SHA512

          3a78987d168cd03982346153f50e5df6e475be17d52063e13a4cfe919f9e7d1baf382ef6ac31ae4c640d1153b720d285d22636a19627156a89a4392e8d5ef50d

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oztan2wv.ulb.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\is-FA8PC.tmp\41589419116464448286035679864158972845276735013687.tmp

          Filesize

          3.1MB

          MD5

          e97363b64f37ee24cdd55cea14d1c564

          SHA1

          dd82ae5ebf33348011b0437fe8107d4d72b9e2b9

          SHA256

          ade1473799360f3df1cb0f8f20fa99e325009fb53e151236d0a2be6f041a8c8c

          SHA512

          362bdf700ddd9186e9207351f0b8879f303c8c669b4bea2327ba549e18f7a333e11f4dc07cc2721ac18fdcdee04a8362ae6b4cdbdc961d220e154fa6de32182b

        • C:\Users\Admin\AppData\Roaming\CluelessStork.dll

          Filesize

          2.8MB

          MD5

          5d12e174483a3ffe2c2c500e307fdc8a

          SHA1

          b32a8018e88633775bb9b6bd708ddce03699de37

          SHA256

          2ae1ba32a40756b38d7544aff09b77e72c6cffdcaf05758fa7d3edd2d9b21f56

          SHA512

          27453a456b36b8ad018dc8801cb28f08da89acc2c99b7f76f199ef9694f350810bfd404eda650e3eb889c9a7cf41e2117c66d30efb26ecfa80c094f353f4183e

        • C:\Users\Admin\AppData\Roaming\new_document.pdf

          Filesize

          85KB

          MD5

          fe3e7701f1a41cf4f92d1e6fc7efbf5c

          SHA1

          05fac77a598118e7fc47b70cb5f38d5b27409ae1

          SHA256

          c236dd48e3e528022b3205cefcd0daab16c759d0c8aea96ae2399eefecc639d0

          SHA512

          9df1892c71771b94560eeb9e86b0afc69d010463d34daf84bcd91ac56ab1d1ae4ca93d6791b3e70343dd09d9d63900f8ee99df73c66d5188a89b790ba3c7976f

        • memory/1212-266-0x0000000073C40000-0x0000000073E39000-memory.dmp

          Filesize

          2.0MB

        • memory/1960-25-0x0000000000BA0000-0x0000000000ECF000-memory.dmp

          Filesize

          3.2MB

        • memory/1960-6-0x0000000003500000-0x0000000003501000-memory.dmp

          Filesize

          4KB

        • memory/2188-23-0x00000000001F0000-0x00000000002C0000-memory.dmp

          Filesize

          832KB

        • memory/2188-8-0x00000000001F0000-0x00000000002C0000-memory.dmp

          Filesize

          832KB

        • memory/2432-21-0x00000000008F0000-0x0000000000C1F000-memory.dmp

          Filesize

          3.2MB

        • memory/2760-300-0x0000000073C40000-0x0000000073E39000-memory.dmp

          Filesize

          2.0MB

        • memory/2984-268-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-129-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-274-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-273-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-137-0x0000000073C40000-0x0000000073E39000-memory.dmp

          Filesize

          2.0MB

        • memory/2984-267-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-132-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-302-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-236-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-235-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-303-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-131-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-307-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-130-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-308-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-90-0x0000000073C40000-0x0000000073E39000-memory.dmp

          Filesize

          2.0MB

        • memory/2984-116-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-113-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/2984-108-0x0000000002A60000-0x0000000002ADF000-memory.dmp

          Filesize

          508KB

        • memory/3456-287-0x0000000005C60000-0x0000000005FB4000-memory.dmp

          Filesize

          3.3MB

        • memory/3456-289-0x0000000063F70000-0x0000000063FBC000-memory.dmp

          Filesize

          304KB

        • memory/3492-0-0x00000000001F0000-0x00000000002C0000-memory.dmp

          Filesize

          832KB

        • memory/3492-27-0x00000000001F0000-0x00000000002C0000-memory.dmp

          Filesize

          832KB

        • memory/3492-2-0x00000000001F1000-0x0000000000299000-memory.dmp

          Filesize

          672KB

        • memory/4524-77-0x00000000742F0000-0x000000007433C000-memory.dmp

          Filesize

          304KB

        • memory/4524-66-0x0000000005B60000-0x0000000005EB4000-memory.dmp

          Filesize

          3.3MB

        • memory/4656-42-0x00000000056B0000-0x0000000005A04000-memory.dmp

          Filesize

          3.3MB

        • memory/4656-43-0x0000000005B80000-0x0000000005B9E000-memory.dmp

          Filesize

          120KB

        • memory/4656-61-0x0000000007150000-0x00000000071E6000-memory.dmp

          Filesize

          600KB

        • memory/4656-28-0x00000000045D0000-0x0000000004606000-memory.dmp

          Filesize

          216KB

        • memory/4656-60-0x0000000006F20000-0x0000000006F2A000-memory.dmp

          Filesize

          40KB

        • memory/4656-29-0x0000000004C70000-0x0000000005298000-memory.dmp

          Filesize

          6.2MB

        • memory/4656-30-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

          Filesize

          136KB

        • memory/4656-31-0x00000000054D0000-0x0000000005536000-memory.dmp

          Filesize

          408KB

        • memory/4656-32-0x0000000005540000-0x00000000055A6000-memory.dmp

          Filesize

          408KB

        • memory/4656-59-0x0000000006ED0000-0x0000000006EEA000-memory.dmp

          Filesize

          104KB

        • memory/4656-58-0x0000000007510000-0x0000000007B8A000-memory.dmp

          Filesize

          6.5MB

        • memory/4656-57-0x0000000006D80000-0x0000000006E23000-memory.dmp

          Filesize

          652KB

        • memory/4656-56-0x00000000061A0000-0x00000000061BE000-memory.dmp

          Filesize

          120KB

        • memory/4656-46-0x00000000742F0000-0x000000007433C000-memory.dmp

          Filesize

          304KB

        • memory/4656-45-0x0000000006160000-0x0000000006192000-memory.dmp

          Filesize

          200KB

        • memory/4656-44-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

          Filesize

          304KB

        • memory/4656-62-0x00000000070D0000-0x00000000070E1000-memory.dmp

          Filesize

          68KB

        • memory/4844-264-0x0000000007830000-0x0000000007841000-memory.dmp

          Filesize

          68KB

        • memory/4844-263-0x00000000074E0000-0x0000000007583000-memory.dmp

          Filesize

          652KB

        • memory/4844-253-0x0000000063F70000-0x0000000063FBC000-memory.dmp

          Filesize

          304KB

        • memory/4844-252-0x0000000006830000-0x000000000687C000-memory.dmp

          Filesize

          304KB

        • memory/4844-250-0x0000000005DD0000-0x0000000006124000-memory.dmp

          Filesize

          3.3MB