remcos | d997a546378df1ac4b47a2836b5cb6dfcfbaf10c4298165928237112f2d6cb27

Analysis

max time kernel
899s
max time network
901s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
30-12-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc.txt
Size

26B
MD5

77ec9122c07d50702533f30c31bf1216
SHA1

865d4c2651033ae7dde69c77012a6e3875fe88fa
SHA256

d997a546378df1ac4b47a2836b5cb6dfcfbaf10c4298165928237112f2d6cb27
SHA512

8c434e5fb0b0427e50154804b01c6e53ebdad2a5fecd551c84bcecb8147c52cfa18bb9a6f2890ffa3df5a7f28d9a1273cd3c9662a6e8d6c7d42cde503c00a715

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

RemoteHost

bekleyen.myq-see.com:2424

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
VLC.exe
copy_folder
VLC
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-001UHE
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000\Control Panel\International\Geo\Nation	220420200119_FUJI MARINE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 8 IoCs

pid	Process
568	220420200119_FUJI MARINE.exe
324	220420200119_FUJI MARINE.exe
2752	220420200119_FUJI MARINE.exe
4492	VLC.exe
5352	VLC.exe
6128	VLC.exe
1164	220420200119_FUJI MARINE.exe
2936	220420200119_FUJI MARINE.exe

Loads dropped DLL 4 IoCs

pid	Process
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\VLC\\VLC.exe\""	220420200119_FUJI MARINE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\VLC\\VLC.exe\""	VLC.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128
PID 2232 set thread context of 568	2232	x32dbg.exe	128

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x32dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	220420200119_FUJI MARINE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	220420200119_FUJI MARINE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	220420200119_FUJI MARINE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	220420200119_FUJI MARINE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	220420200119_FUJI MARINE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133800567588859062"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x32\\x32dbg.exe"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	x32dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x64\\x64dbg.exe"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\DefaultIcon	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 4a003100000000009e596193300078333200380009000400efbe9e5956939e5961932e000000396304000000280000000000000000000000000000005bf94300780033003200000012000000	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\NodeSlot = "6"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	x32dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings	220420200119_FUJI MARINE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = ffffffff	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x32dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	x32dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	x32dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\ = "x64dbg_db"	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	x32dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	x32dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\ = "x64dbg_db"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	x32dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	x32dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	x32dbg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5252	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2232	x32dbg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1568	chrome.exe
1568	chrome.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2232	x32dbg.exe
6128	VLC.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
324	220420200119_FUJI MARINE.exe
4492	VLC.exe
4492	VLC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	1568	chrome.exe
Token: SeCreatePagefilePrivilege	1568	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2232	x32dbg.exe
2232	x32dbg.exe
2232	x32dbg.exe
6128	VLC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 3124	1568	chrome.exe	86
PID 1568 wrote to memory of 3124	1568	chrome.exe	86
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3036	1568	chrome.exe	87
PID 1568 wrote to memory of 3044	1568	chrome.exe	88
PID 1568 wrote to memory of 3044	1568	chrome.exe	88
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89
PID 1568 wrote to memory of 4884	1568	chrome.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\abc.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb9e64cc40,0x7ffb9e64cc4c,0x7ffb9e64cc58
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2056,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1820,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3712,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4864,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3704,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4816,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5304,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4828,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5184,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4824,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5232 /prefetch:2
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5400,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4724,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5632,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4024,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3388,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5528,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4612,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3196,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5824,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4404,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3296,i,6029780213240913735,2811930160418291113,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:3368

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1648

C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe
"C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2636
- C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe
  "C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe" ::install
  2⤵
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2608

C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\x32dbg.exe
"C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\x32dbg.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2232
- C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe
  "C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:568
- C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe
  "C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:324
- - C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe
    "220420200119_FUJI MARINE.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2752
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      PID:1060
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\VLC\VLC.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
      - C:\Users\Admin\AppData\Roaming\VLC\VLC.exe
        
        C:\Users\Admin\AppData\Roaming\VLC\VLC.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:4492
        
        C:\Users\Admin\AppData\Roaming\VLC\VLC.exe
        
        "VLC.exe"
        7⤵
        Executes dropped EXE
        
        PID:5352
        
        C:\Users\Admin\AppData\Roaming\VLC\VLC.exe
        
        "VLC.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:6128
- C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe
  "C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1164
- C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe
  "C:\Users\Admin\Downloads\220420200119_FUJI MARINE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ea771d5367187f6246ca4f6badc90067

SHA1
92e687708e5983c6a04ef6a4ee63b0d5bb6db493

SHA256
92e9866cafe6e07a53b81adf30b22631f1c85f489b4fcb428d0dbec9a6207d42

SHA512
5b054b07d4fe1e5b9c528adf2bf1b20856e197d89af878d0f40627c23be0057f01de35b31125f5e796c1abe0bde62283dd84e176fb211da1eb400e2773e1cec2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
d4e0b8d2985c142941247c312f94a356

SHA1
7ed4d530d3583e765effa964010657dca9c78278

SHA256
87d22b516c198c5a0b02b2c853da6167debcccf627d5a548090692526a274092

SHA512
320fa7734608df78ed9b38d2acd38e96dee9c952b4b6e7aa7d69c53c8d26dc1c5b954d892b86e15a299f2a67aa85b0d4679bd505857877f087616d2994980ad6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
14b129c64ae24d74aa27820392b6ea28

SHA1
59a2a454c12f4804a128db9db9e78448b54aa000

SHA256
d27fa2876e626aced2405f04069f22c2a6b706de409162088cd9958d53c874ab

SHA512
31c3c9a9b5df130fee66fd009b5d3918109843b24febffa3867f201ecab6ad1e6f3e3a0a231747cbd261c02a7103a1db5b1ac06acbc2647ef2cd76cf3eb9e336

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
4ce7fd90bac920c780bfb16897d2b56a

SHA1
509c0b09eb8678a86ace518ecb860ccbe8fdb429

SHA256
ccf6bbb070892a9b2a73782a76302bebb06a8c44f98a3471682b15649e5bdbce

SHA512
133b356a5a3137163123af4da2a774976ba0a274c398ebc6ccb040624d226bf3359f3d3b4e7df6b227abc7cbc12bb1db0b04837b192f913ddc20f0789813ca68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
6ad2b419ba180cd027e15a2b888b7f46

SHA1
0a1f72a50df0e9a37ba7af7d7fb1a9714e0a396e

SHA256
7c1453e371c0944c1027bffee0efb5fb7447f182f58343aa74a43765020e7a1d

SHA512
29f514e3ea4c0e8080590485ea42dd976fafaa241196219747f738fcfcfd20e8368cb3154a6cbe3fbcfa895cd7dfac5b87fb981d9e058905247889ae3f766487

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4b19fe1e1e4d3408875e931d3e020719

SHA1
80b486fa5ba670c97e10272aed957ccfb10e4d9f

SHA256
310b69eccda02e997c23a1c3f263aa30cdae7d7b340bcac2abde440540247787

SHA512
c38fa652345067436575e73be64b278a5afd800bb2beb48f0829db1a2eb6bfc5c084fff0694808ca6629631500f56bc05af203fe01576ed45abe22336bb279f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fbcd504e448a749f97a60c55a0174da2

SHA1
75a9538c4865f738dcca17378839b4d89a8733c8

SHA256
07f090f48373b7c8e1ac018b0eabb1c5adf73278c4fb665ce3a26e78a4ad0bcb

SHA512
fca3fb7327034b9ebc43f940fa19f8a2de5e05f46f9ddd441a790b433d960297627cacf0009b5da379d8512431a3e104c654700b8d7c4fb2983b6c61cfc8a0b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
716037a47ff6df427b43cc9e8e880aab

SHA1
2a2cf1f4c134e5a3e860783c92405f839616babb

SHA256
aff9d4e374fb30736b461283f05853a4708214602193a1070140d17596545a6b

SHA512
72310a5389a12116bb7e2e3c394e199391f9a4aa3999b95abc5dc52fa01fea9105d8180e484de66e68c36f4f460b279b3165a3f4fe7f05d2898360667f3e657e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
2882e7ad54ddfc93d4fb5a05c8e128cb

SHA1
addc533a66873cb6a7ece4fc6899e8d4d848dec1

SHA256
25fd4ec4e8e42534bb0b034a70a444481ae634e591ee860f3ca9e1363c6d5d40

SHA512
59a43e16423d343dd3c8a3a90ac591b7f3b192552c139678fd67fd2887551e71bdd48506ebc91629cca98b115e83dfab136ab74bf4fe290ba3aa90da6632c578

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
032e9a3bc660d4d66d1cdc25de685b36

SHA1
07851c6b7ea97a90c378ef91047016c195ae8da5

SHA256
a8f1871fcbf70e0195ee976281e4004a16dff62de306efe53d0876e6578fbc4d

SHA512
666ad50c1ecd2b9f7b6ef54db67396803d98fe526151a11a914d7845b0aa57fa39775d43b6066d0ca78722e5192acabeaf68bee3ee0399f681b95f52659a599c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
dde4a4b07303d4c19df16df7a1b014b1

SHA1
47bdaa7ccd3da3815951e3abf905fb01bfdf7432

SHA256
4f26cd90b316692d961dd454ad2309a91ea3a39221397669258add77f58f1707

SHA512
dc9fa25ff1db461d800322878a69e0a97c18268fc22d55219455fd17ecf9affe7966955ac2274a0ef440067f367824acf7f173514f7973055f1104a6e5f6879d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
709dcd270e3362904153a74ca52c818d

SHA1
3b52b28d0b737b71b5129ff6c7242bfd16aaf8e4

SHA256
63d997d1eebaf84f41999e8701c649d1b371a73e78830589360636db09fbc8bd

SHA512
d4a9c99bf1a2f311426468ff8dab5821d870a791b334ebe38f7a6c974984451ad12457357eec9eda85bd419ed307d2c59692f29a8e9886813ffdac397db6259d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
db5c2ba57fd9531dd21b5cbd70f8a261

SHA1
33e4d5584639d9a2996e74d8d23e2dc7bf1aff55

SHA256
53cc2ff1406de7329efcc1a76355b4ac68dd262ff09d361f3e6b858f9f27cc05

SHA512
2ce683e2d2afc70187d777a99d244db08c72351d3983e75cb05ab35b29d15f4b45eb23221437f8ab4140bd42f66e679f17ad3a78a49eadd1403be14f117f34b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\220420200119_FUJI MARINE.exe.log

Filesize
798B

MD5
2bd5b45abb11cef383703a9e3b29729e

SHA1
04b2f7975aa1852b3ac5bd3bc5740f4f658d708e

SHA256
bc59e65cf5d5046e2020cb349c0958f42534af18a0f7c213da292e3976f3d304

SHA512
76e860d5aa0275dd4adb8529c6ad9b1df9a4c95f44c3050012a0110d49f4169e3e5bd1b12500f947f3f223f1adbe553c0552ca360e2458065bfe5e1fe42fa8ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
406B

MD5
854219cc98e5b2481c851446afe79605

SHA1
2423fce3defedf02f7cb8af374f92b78f4bd22f9

SHA256
db79feef63151ee105d5cb255d847df5f09b987db10b4015410a7db35bf76a7f

SHA512
32c16b720c94f800f4513a78be858d92d7fd85aa6cf450408e68cf78b64948f3d3b50e343e2c215234b5404de25be76619b2ac083dfe6b2d0a06bb6c4fedad80

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1568_1951753705\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
2KB

MD5
ece417e5014472161863f17382faa2e8

SHA1
e91067edf243925beb3707c9b3dabdb6ed1a00fa

SHA256
c0327270aa6b035e7ee4320d99686a4932e5f212e54d5a11d8775bda4ef3a4bb

SHA512
aefabf28404dbcf0f2faf1f3ff2388054a6a40e97b669c27b7783bbfb416bbe42365ad45f85a0e5e2b591ff1443278704cbfff2f08d9cf3374c36bcb9dc82132

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
2KB

MD5
5198edcb507c2d100b0b3e8b38c841d0

SHA1
48a7a5c95239f1e2a3fa52f211abe7a8cff2128e

SHA256
f662e3676bbb014cf4ba59ea1b9c72778f22844ad6799af61cbf6edf8f0bdd4c

SHA512
698d6a7f16deca32a3da23ea7edab62da021cd5d2d17915bea9662c4aff31eff63def0b0328d5eae3cf4a5371dd52a25088db49c970629119c4134fe49ac0c58

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 438730.crdownload

Filesize
438KB

MD5
5e9770c2b22b03e5726285900afab954

SHA1
0be9416d3ca3ab36ffa1f2da9f3d20d4841bb468

SHA256
ad3dc7a0c6ce33a7e45775b3452343eb748fab8823311df58d4599d6a203ff80

SHA512
05af187e6f87657193c4ee1eb1f8c0313313403b2e4953ee3c670f48f808279fabccfb72175cb9e926982e317e6dd4c25955632e848eeb03e1025822679f00c8

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\db\220420200119_FUJI MARINE.exe.dd32

Filesize
1KB

MD5
8e4f9e1ec972b051c1e8110eee7e9283

SHA1
f9e8b90815c2b302dcc6022e135641daa7b807c3

SHA256
6d35986f9efa91efa3629b7c1374a96f86a6e9c295ae52dcfa7c523135400f9a

SHA512
f444d658942f34915304692e0dbed3e228246125166210d95f8b75ccf75cbbe2d172af8d27c99fc2e53a0582d0f1b821655ac19123bab5cbf2eb56aaa5494fa7

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\db\220420200119_FUJI MARINE.exe.dd32

Filesize
1KB

MD5
d7ad6e7dffe5bc8ff9c2a1a4b31c4e6d

SHA1
93f0caa2b1d5410c211d2da7ad1e38338e72ff7a

SHA256
a38dd84252e5d2df33a282a97bf6eb8e813c9cfbe9e9042d971957e6bcb77198

SHA512
2fda85811d733e7595e3e65f091bef9aa7889252750f399d9608b38ead96f88a51db1baa980e03a7cb72436229def5276919827fc575a111da0c1533886b58e5

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\temp_E5ABC0E.lz4

Filesize
366B

MD5
78b21fbc4b9b814ae65b6c9c13cad078

SHA1
0b5ed88624f3d612b6dc4567f6a520a0f325f558

SHA256
501d968852da76bc38e45269368c726c726d219fc034029362a2942991c56b4a

SHA512
7352d5692a2a3f0dc20b8ee021017c3eb27ed81684a73acd97a9f92ef8f7c6397c1a384771a7b61f8e896fdb5687155ba99559538a3a4e2cf34fce5969d14921

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\temp_E5B8C3F.lz4

Filesize
362B

MD5
583afd39a9411b6e326a81e2367d558a

SHA1
8ada3cb1280b0f3b8eb467239b279304cd721176

SHA256
fa103681a4e4f1725cb94639878174b4b6764430b82163d362f95c7848c7fe43

SHA512
350aeae0852382e6be870b636369417829ceada8b80c4df18a2f49fadc08ea4b8d7c2f26ff65ddbc18577491a4cd264cbe0457aaf8466323938b359c73951b09

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.ini

Filesize
122B

MD5
45c1e010baaeb6b086b93c73cbfa1433

SHA1
6570b66b77103aac30dc7cccfacde1e42413890a

SHA256
672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc

SHA512
6b00d4050ad80dc575b056e40b3fdae831e57d1b035fc7500c1523c70c7f03f344e8b53b070ec3c8482fcb7c300d401260502ba4c04076ee23db66c236d3ad50

Download Submit
memory/324-692-0x0000000004D90000-0x0000000004DF6000-memory.dmp

Filesize
408KB

Download
memory/324-690-0x0000000004910000-0x0000000004918000-memory.dmp

Filesize
32KB

Download
memory/324-683-0x0000000000010000-0x0000000000082000-memory.dmp

Filesize
456KB

Download
memory/324-684-0x0000000005000000-0x00000000055A6000-memory.dmp

Filesize
5.6MB

Download
memory/324-685-0x0000000004930000-0x00000000049C2000-memory.dmp

Filesize
584KB

Download
memory/324-691-0x0000000004A10000-0x0000000004A1C000-memory.dmp

Filesize
48KB

Download
memory/324-687-0x0000000002310000-0x0000000002342000-memory.dmp

Filesize
200KB

Download
memory/324-688-0x0000000004BF0000-0x0000000004C8C000-memory.dmp

Filesize
624KB

Download
memory/2232-681-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-659-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-686-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-682-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-647-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-648-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-689-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-745-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-786-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-781-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-751-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-748-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-726-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-658-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-656-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2232-649-0x0000000074800000-0x0000000074812000-memory.dmp

Filesize
72KB

Download
memory/2752-698-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2752-696-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2752-693-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4492-716-0x0000000005170000-0x00000000051A2000-memory.dmp

Filesize
200KB

Download
memory/4492-715-0x0000000000810000-0x0000000000882000-memory.dmp

Filesize
456KB

Download
memory/6128-725-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6128-722-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download