Overview

overview

10

Static

static

3

5b2f7db7f9...9N.exe

windows7-x64

10

5b2f7db7f9...9N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/02/2025, 03:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b2f7db7f9b1126f9840242568fdbf7957c8400253e9b9809321148304d572e9N.exe

  • Size

    372KB

  • MD5

    9db9dde201b0c8390fab040b4fcdcde0

  • SHA1

    63f0a0039d71b9ec37ade5c4c8f3aff75da38d36

  • SHA256

    5b2f7db7f9b1126f9840242568fdbf7957c8400253e9b9809321148304d572e9

  • SHA512

    9d4abfcdc2f72ceb5c87afb8f923f981aec6efa93f62c263b2232daa81b8282633484496f65d94361e76312225a7325bac9df966d07477e85e509fb071d03693

  • SSDEEP

    6144:tpdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tLqQx+H2i+8LBNbdypazCXY

Score
10/10
remcostinodiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

TINo

C2

185.140.53.140:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    true

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-5S9O07

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Modifies WinLogon for persistence 2 TTPs 39 IoCs
    persistence
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Modifies WinLogon 2 TTPs 39 IoCs
    persistence
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 39 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b2f7db7f9b1126f9840242568fdbf7957c8400253e9b9809321148304d572e9N.exe
    "C:\Users\Admin\AppData\Local\Temp\5b2f7db7f9b1126f9840242568fdbf7957c8400253e9b9809321148304d572e9N.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4240
    • C:\Users\Admin\AppData\Local\Temp\5b2f7db7f9b1126f9840242568fdbf7957c8400253e9b9809321148304d572e9N.exe
      "C:\Users\Admin\AppData\Local\Temp\5b2f7db7f9b1126f9840242568fdbf7957c8400253e9b9809321148304d572e9N.exe"
      2⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Users\Admin\AppData\Local\Temp\hab.exe
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Users\Admin\AppData\Local\Temp\hab.exe
          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3240
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2824
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2360
              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2056
                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2040
                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4224
                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                      10⤵
                      • Modifies WinLogon for persistence
                      • Executes dropped EXE
                      • Modifies WinLogon
                      • Modifies registry class
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:740
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                        11⤵
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:5024
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3288
                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:3728
                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                              14⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1868
                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                15⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in Windows directory
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:3896
                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                  16⤵
                                  • Modifies WinLogon for persistence
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Modifies WinLogon
                                  • Drops file in Windows directory
                                  • Modifies registry class
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3444
                                  • C:\Windows\SysWOW64\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5092
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4180
                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:1076
                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4784
                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:1396
                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                              22⤵
                                              • Modifies WinLogon for persistence
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Modifies WinLogon
                                              • Drops file in Windows directory
                                              • Modifies registry class
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:4072
                                              • C:\Windows\SysWOW64\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                23⤵
                                                  PID:3696
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                    24⤵
                                                      PID:4988
                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                        25⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2648
                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                          26⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4540
                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                            27⤵
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4020
                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                              28⤵
                                                              • Modifies WinLogon for persistence
                                                              • Executes dropped EXE
                                                              • Adds Run key to start application
                                                              • Modifies WinLogon
                                                              • Drops file in Windows directory
                                                              • Modifies registry class
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:3212
                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                29⤵
                                                                • Checks computer location settings
                                                                PID:4568
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                  30⤵
                                                                    PID:3652
                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                      31⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4204
                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                        32⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1936
                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                          33⤵
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4424
                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                            34⤵
                                                                            • Modifies WinLogon for persistence
                                                                            • Executes dropped EXE
                                                                            • Adds Run key to start application
                                                                            • Modifies WinLogon
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4332
                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                              35⤵
                                                                              • Checks computer location settings
                                                                              PID:4364
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                36⤵
                                                                                  PID:3884
                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                    37⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:3188
                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                      38⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3268
                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                        39⤵
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2176
                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                          40⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • Modifies WinLogon
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          • Suspicious use of SendNotifyMessage
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4000
                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                            41⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3200
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                              42⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5044
                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                43⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:3828
                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                  44⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:860
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                    45⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4092
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                      46⤵
                                                                                                      • Modifies WinLogon for persistence
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      • Modifies WinLogon
                                                                                                      • Drops file in Windows directory
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:4660
                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                        47⤵
                                                                                                        • Checks computer location settings
                                                                                                        PID:4428
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                          48⤵
                                                                                                            PID:1448
                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                              49⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:3540
                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                50⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:1284
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                  51⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:4816
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                    52⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Modifies WinLogon
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:4720
                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                      53⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:2732
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                        54⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4108
                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                          55⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:4288
                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                            56⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:3692
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                              57⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:424
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                58⤵
                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Modifies WinLogon
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:3424
                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                  59⤵
                                                                                                                                    PID:4440
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                      60⤵
                                                                                                                                        PID:4036
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                          61⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:4460
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                            62⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:2068
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                              63⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:2404
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                64⤵
                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Modifies WinLogon
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:3884
                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                  65⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  PID:3716
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                    66⤵
                                                                                                                                                      PID:4576
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                        67⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:1652
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                          68⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:3908
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                            69⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:4376
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                              70⤵
                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:1996
                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                71⤵
                                                                                                                                                                  PID:1928
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                    72⤵
                                                                                                                                                                      PID:1380
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                        73⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        PID:1528
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                          74⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:5064
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                            75⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:4308
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                              76⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:2648
                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                77⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                PID:844
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                  78⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:5028
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                    79⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:4288
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                      80⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                      PID:892
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                        81⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:4408
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                          82⤵
                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:3948
                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                            83⤵
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3668
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                              84⤵
                                                                                                                                                                                                PID:4424
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:4460
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:2160
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                            PID:2060
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                PID:4076
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:1376
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        PID:1916
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                            PID:3208
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                PID:3836
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:3196
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:768
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4840
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        PID:2584
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          PID:3748
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                              PID:2716
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:4900
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1760
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      PID:2448
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  PID:804
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                          PID:1440
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:388
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:3268
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                  PID:2200
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                    PID:1820
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      PID:3684
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                            PID:764
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:2912
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:2284
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3880
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                        PID:1076
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:2328
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                              PID:2632
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:396
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                  PID:4008
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                                      PID:212
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                          PID:4652
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:3576
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                  PID:3868
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:3348
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:4728
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                          PID:804
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:3392
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                                PID:4460
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                  PID:4800
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    PID:2404
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1364
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:1792
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                              PID:1320
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2908
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1292
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2116
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4328
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                            PID:992
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:4316
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:824
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1896
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                          PID:964
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                            PID:452
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                              PID:4008
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:424
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTUzMzM2OTEtOTEzRC00QTdDLUI0MEQtNDc3RDQ4MjQyQzc4fSIgdXNlcmlkPSJ7QjVFOThCRDMtRkEyOS00QTMzLUJBMzQtMzE2NTkyMUYzMzI4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MEJENkE2QjQtQkE5Ni00N0QyLTk3NUYtMTI2NDQwODVGQUNFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU1NzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODAxNjUyMzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTEyMDkwNDQwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                    1⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                    PID:3552

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    389314ff1775812c2a1233111d518de2

                                                                                                    SHA1

                                                                                                    1395d9c9a325fd55e426ffd1e9ce214c20db8d68

                                                                                                    SHA256

                                                                                                    55b6531ab157bfb8db6ebb984b5fafed3ea9079ba40f84fcd7e1df472961f674

                                                                                                    SHA512

                                                                                                    d03bbec5131b1303731498145e46401d7b3ebdd2d2b1f85f42fbf9681149da45126417e2b98e0dd41fc028b80fad0668056c39adff8f73eb93dcb007ceaa017d

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    3037067afb4a378641636002294f8ce9

                                                                                                    SHA1

                                                                                                    7016203587b4aa4d520b0dd803e2eaa08326fccb

                                                                                                    SHA256

                                                                                                    56fcc91ac79a210befe425eb3bb27ad31e6e4005fe6e5efd45e30eb76d55d1f4

                                                                                                    SHA512

                                                                                                    7e3659db8075023333c51bd0879a7b0386956c0b985fc041fa8b31f936420c3b70c4c00b0823296d2022ba76df960d835b85792403decff240397c1dba7692ec

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    2a1bc988c409f5fafba2b3ee3b41869b

                                                                                                    SHA1

                                                                                                    fefa06825a5b8d0283e1c9afff3eb25406f5b670

                                                                                                    SHA256

                                                                                                    4aefcc074e355b0c13474dbf3855e42074a70a98822ce0a739f3164df71dd989

                                                                                                    SHA512

                                                                                                    5bfdb3a847ace6138d9c062905ef5b008bdfdfa297cd080192b6579c2d417c264d6f382afc1f2834b9a8819143f35200ef85d6169972ff05c3432949ab7cdf65

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    4d371f6d28111c4ae17113b6cd74028c

                                                                                                    SHA1

                                                                                                    46b2601896931c4ecaa78967f5665d355a741c7a

                                                                                                    SHA256

                                                                                                    d0ece2f921a0215921c4a6656c8d6ffb64a9989e945bc4a358b7209688aec175

                                                                                                    SHA512

                                                                                                    2702229cde24f17823a7cf6e39082d7b74e8bb13b9795c9c2fe51b8586e25a0c44b302c56eb7e1e0ca664ad4eb58c1d595c94a57d1a45602279fc37ffc3f7a13

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    1285d2fca12daf245dbf0d8b95853c57

                                                                                                    SHA1

                                                                                                    7499d804440393b047377da8a81480230b12cb83

                                                                                                    SHA256

                                                                                                    17aa8501fd2521df13bc416e53465440e3f86bd699611f2cdda4cd6dc7690178

                                                                                                    SHA512

                                                                                                    3bd47c10f2abc89b99cdc903364641d3edff8de2acceb99496a56d4bf5a1d9a0bf95d2455a7ae6c7189cde007bfa820315698f939760ff616a0d9e00d35aa0df

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    7e5b43a609573e352b4894f6772e61a1

                                                                                                    SHA1

                                                                                                    916e64e79b15e6f61fcfb12dd0abf631ac3a339f

                                                                                                    SHA256

                                                                                                    71dadda1858361e2a4d55352e5d9fb748f5969317606ee9080ae591392b22b90

                                                                                                    SHA512

                                                                                                    8dd8e2b4db30fd5787e03ff0ff3a4c6565ce6c9a85559e43fe6c49f4c6e26484701715a6ae42853f5b41e2093dcdb2ec451f736077f4f51e51dc694c37e7b5da

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    c30b2443b8736be4dbafef185f145585

                                                                                                    SHA1

                                                                                                    991087e5d04f363247338bf5849d66170ca911b4

                                                                                                    SHA256

                                                                                                    153aecbb61c3d23a2b4bcc05ee538d8e80a268a0926e8602862f9293e407018e

                                                                                                    SHA512

                                                                                                    649a374817887cd90edcad34aa9b2c157bfd522fc46a238ec8c0b30f76263fd600b53a2e7a0a77697daaef7754ea1d49abdcd5a65856d8278b4e1cf66d35b324

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    4f1c6eedfa17e64910381fda427ce0c2

                                                                                                    SHA1

                                                                                                    3e8a3753a17e9bfb4ceeb1eeafd48318bcb86c90

                                                                                                    SHA256

                                                                                                    3ca91cc50186f598901e58c96246f429d729e35523105133c5875a20864d425c

                                                                                                    SHA512

                                                                                                    34da9ac1275845779ce21db803a42194d0f8a902a9739e9693d122f32130657ecb53170a963760ff5d0b21bd42537ca94042f93bf795a89a8f0309567029722b

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    964e8ef35bdbc9bd5abacda91e5898da

                                                                                                    SHA1

                                                                                                    982956f25b97755fa33af3ea912d0ca7c33a48f6

                                                                                                    SHA256

                                                                                                    73085f7732c8bdbd2a24afd8c17e657fc9398355034b0d45f546d48026786012

                                                                                                    SHA512

                                                                                                    56d74eb4eacdfa393c1cacdcea3a39c652beccaa5aa28f9d2204966f92d099d8fef8008c3c5b76abb2f6c87acea5e374124d7298c6b733c5d3b5955f201e6eff

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    602c5a343d93bfc655cbe8d5dff11715

                                                                                                    SHA1

                                                                                                    a90fcf29baddb9c91c12980d5105fc550672ad34

                                                                                                    SHA256

                                                                                                    ed6c17a87723202bd2ff727c63d0c1a032b7a82060f74d21c3f12a094986a892

                                                                                                    SHA512

                                                                                                    c061dfc638236326f4dbb8abf7ba0369b732f4f69c7ece13e67e17af410a9de15d336da46746b5f0c305cc62f5e98990e720c75d8a4135746ba7f95bba94e75e

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    2d5d562a269c00a03cfa8ffc0332993e

                                                                                                    SHA1

                                                                                                    fc0d74af4aec55f30ed92a7ff35058bd69f03708

                                                                                                    SHA256

                                                                                                    ce7bb8ddde7f39f1b8046bd19b85cf07369744b55c9732004e0c2b4e12fb3b73

                                                                                                    SHA512

                                                                                                    462622162affc367b0a1f7baa6f22ae19c5be5a57599ac3c25c40c0ac61f66fc3274ae64a7dae8dea5339b11d230c409b6c8f40dafb3fcd2c3f2334a8c898351

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    dcb111a64ff5f278f687110edd915978

                                                                                                    SHA1

                                                                                                    d041f65cf2b7850f809df1027b1b21e7ed20bf26

                                                                                                    SHA256

                                                                                                    6534dd5266cfdf5916553933d2cbc4b19d334e4ca8a5c4afd2d5fa168e3bd792

                                                                                                    SHA512

                                                                                                    08d847da931f2b5451415a644efebea60fbfb341a9eb0505b33fb0aa888314ad67fb4bdd05cd0e34b640f3783b0bf34239e42ef3077a4df27314932d28770e6b

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    34688cceea2f4b3521f11dca899a8436

                                                                                                    SHA1

                                                                                                    9f991bce5a672cf6058b9e9f72748c85963ef2bf

                                                                                                    SHA256

                                                                                                    90d0a92264123584276f4aa8546625af05b1a7f5b3233e4969a8f2f965733038

                                                                                                    SHA512

                                                                                                    2db26ddb829ef526dc25b45a690444fcbdac62e539f79d78a0fa929ff388618672d7d29bd2d10808b117e0d309cecf530e71466361a729fde79e3dab565dc9f5

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    bca2980519c3e7060767855b99649264

                                                                                                    SHA1

                                                                                                    23039564a968be92a8e2d3ea8f3b61a0ec87c8cd

                                                                                                    SHA256

                                                                                                    c605a22d6a61bbc0b0cefbdf1f58735130e0c8931cf3af01e2d684173d4575b7

                                                                                                    SHA512

                                                                                                    58cbae9bae20bf46ab2f774c42f5b6c7cedf7f6f457f3250948c11f484f27209c0c43e56b16f15b6b7072166db1ff12bed30f97f28fcdf77decbfbdab83d9eea

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    a509c2f55233e49e578206cd714083ed

                                                                                                    SHA1

                                                                                                    b48214cd0dd1fa57edbf9ca09ac24354c59a819e

                                                                                                    SHA256

                                                                                                    c1e59ec47f47cd66806d0ae89a6c66ae1e31041c07ff5dbccb6e4a7b077722d7

                                                                                                    SHA512

                                                                                                    cac7e10b1efb2d3fbd72445ac5ccb8e2ec1cdcb9b0eac85421a3589d19479bb937cb5418ad293892a456d8e4989ba6eedad306c7093d6f8b2ac7cfc73d42426d

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    e002cc261d0a82a13221bc2771e08dd1

                                                                                                    SHA1

                                                                                                    157a1532daf1c12f4b836973eedf4d3e93570b26

                                                                                                    SHA256

                                                                                                    4a635b6ee1716844981c02838a71d32682ab827231fec62f8c495f10e6e8fada

                                                                                                    SHA512

                                                                                                    387c341887253fdb79c2b9853c370f70f603e03ee7ec38b7ebe51bf34a81ff585958745213ae09f42016eb34b6b7074f9ddf2aba62ad3e66f02420e950d718c9

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    021ebe4f9bea0b67c2483c5589d27304

                                                                                                    SHA1

                                                                                                    96c6ab234c318081bfcc349ef7cf33f4be5e607f

                                                                                                    SHA256

                                                                                                    a8d4701eed5786a2d3c42d2fcc2aaf7f78406c8f2e1ab38235bd27ffd694f1be

                                                                                                    SHA512

                                                                                                    6c2bd22b69b65133b1f58a008c7453a6f9a30eadc56ce8e2d54b6336f64312c08545d95a8b12d017ba0b5b2667ecfe628a855dad284652169aed374f21dcc0b4

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    4e5d9b6bef4f9937e1faf6788775045d

                                                                                                    SHA1

                                                                                                    ebf6ec246e6844a2ec38d0d42d63a0e3353d61bd

                                                                                                    SHA256

                                                                                                    3337d2d84509f7aee8fd0a866fbc82487ee2504751a62f76a4e807d058db1114

                                                                                                    SHA512

                                                                                                    324e7585d20bd7d0f00a81cefe128ced620b265a079c4284b5848f6f80f086283c48222c027237b9c3785b94261915ee59cb20f383936cc28bcfa0422fdfa6c6

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    7a784638d8f62af00a970417f7dcc64d

                                                                                                    SHA1

                                                                                                    09782cafde25eb67e93d937a6db22d6072d77fe9

                                                                                                    SHA256

                                                                                                    0815e08b27bc3f804cdf0d4c8e2e506e920d5d91316aca1d6299f8288a35498d

                                                                                                    SHA512

                                                                                                    9c26a38c57c6a48a4e52bd09d339b4cad5add85eba6a92eb562d60c8b86f61c0005c7e681fed4f662dd5ad786878fec4e889f7b309de0b8d663a92a60edaf0cd

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    8fac40f7d79ca1b73841f3389318f4da

                                                                                                    SHA1

                                                                                                    1a02e41fdde3e0555e81b627e5cac14c99086856

                                                                                                    SHA256

                                                                                                    7975fb421e95b369de08e4a7aeb227ff7dae07635e84088e47745fd447d8e039

                                                                                                    SHA512

                                                                                                    23213b83e3fa5b3b73ac0743c8edaea035110ab2b14856472666e8edbd23372bbf46592da7d0420388891549d3f8844c8a4f440f84ff5757dcdb3260937e6211

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    ca81bd8bba7cdec923544cd2b8fe109d

                                                                                                    SHA1

                                                                                                    a483980985c55a039f2d91101daa232ec2e94ffb

                                                                                                    SHA256

                                                                                                    734cb3a2a8928be0053078e22ab27ad4323d630ae6a3d5cb06a962554d10b4d8

                                                                                                    SHA512

                                                                                                    9bc2e0bee7965814a8ab313a469bb522e505fcda7e9d9351f4d6dca82223a0e3ae003c7101b32325b9a81c285440e225ae8cc8e274876ae54f9030caf26f1a45

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    70570ef7e39538d36e43c86a626eb20c

                                                                                                    SHA1

                                                                                                    7d4c3e3b3cf98e566851a190b45a99181d673db6

                                                                                                    SHA256

                                                                                                    8b6525de1c1984ec34b92d63eb947d5e46024ee618db9d61652a76fcd3455bef

                                                                                                    SHA512

                                                                                                    ed8434852da7ab3f5bf6b2e617a516bdecc108c225131c47921e481672ccca407a15119c6942f6aff9c47b6e080675ec55f6b5924447d3874dbebbf6df98f98f

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    705f18c6243d0794cefad164407d65bc

                                                                                                    SHA1

                                                                                                    8e1938dca31282d1267f02907e9742c908bc6da8

                                                                                                    SHA256

                                                                                                    d30f3fb2d7cb6ad1242403ad04ec9aed2dc33e20ef4d7e96b97e7b2bdfa9241d

                                                                                                    SHA512

                                                                                                    0b0911cd4296fc570b3217acb9325a7c174bb6c9e1e7bccc6544ba17187ca338acf1d081083c4ab55b03055b4a709f1d409c485574d9a36116dcbf5ed02a0fc7

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    353881c2def91ca97c912cca4f63f6d7

                                                                                                    SHA1

                                                                                                    aa73a8b64476bd0751a7fc8da6dee86649cba9dd

                                                                                                    SHA256

                                                                                                    6cda79897a789779ea1f76c57446934edb676eacfc765d1dc2e42def4d86502f

                                                                                                    SHA512

                                                                                                    99f1e9a2c8cf970aa85482589de947f7bdd94b092b39cb3343024069784a1bd130a31862586154f2973041d17b3f685456d54150e0bcde2f9d6959ce744f9877

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    cc79cbfd82c0c2218482bc62fd6dfd6b

                                                                                                    SHA1

                                                                                                    fdc6c94bad30ed7e9caeda0ff99d9c451757acfb

                                                                                                    SHA256

                                                                                                    2f1839fb8644b8bfdecb29bb686e8f2752a4697ee533597d8094be8c3f8422df

                                                                                                    SHA512

                                                                                                    9f1e27ed644e8d8d0963b30cbc671bf1ec6ea3f43e00a78693ff1f410d2d409a6bd8ac14274505875305e674b98e723845e0b169538a61c1b282b3316eb465ba

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    aa76169a7ebb34aff8ba3efc781d8a4c

                                                                                                    SHA1

                                                                                                    84caee90ea76f83122cad0a9d3087cd04621ac1d

                                                                                                    SHA256

                                                                                                    7671f49af32a75cbd221bfe4db585fadaacaad99afa2c538c43f0ad19b9c4844

                                                                                                    SHA512

                                                                                                    f3694c0a888e9b822cea90152f7eb3369d47b98b38942cd8ca8a8a1b44e2f69bb07c3951c9f9bcd5918b08eee211a7962e5100f0a2437e8ca0ab574ac1aea731

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    31c8dbc4547f583c9c5644726af217ff

                                                                                                    SHA1

                                                                                                    6383460d2796e1b97967ce08eec038b056129be3

                                                                                                    SHA256

                                                                                                    c2c602b515c84f93f8cc52628f80884427961897ecb80a66a2a747e226bf5b99

                                                                                                    SHA512

                                                                                                    52044af0a36fd8cd6b10501e4e65141d6bea30c5e9330cbd53dd685ccafff88476ee41a8b8ccb96029bc26d9333f6e3f5fb52087b38732c3d35474fb93d9226e

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    fea8fd2e9426839384f4d77572cb025b

                                                                                                    SHA1

                                                                                                    2595084faeb1af579de181fbd39184dfa2bc6d38

                                                                                                    SHA256

                                                                                                    be07c87348c6a358f59b7733e20822b85674ea629d9f88d195857d8f76586c66

                                                                                                    SHA512

                                                                                                    9347f63a2d4202b8875ffdc749d23d09af5ac36530736cf3858d8b790015f9c0aa2a65c8ae72daa14f63a0087e06107bb342687004721d9df631460964b86a79

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    ceadd805e6b73d7f4c2419628226626e

                                                                                                    SHA1

                                                                                                    1a7ab112482644d9675588cdf8ec9118689ac5e1

                                                                                                    SHA256

                                                                                                    ac91957b56ecdb931b574eb68b939b2c40851db4363d1971edf8a14bd28a7f72

                                                                                                    SHA512

                                                                                                    26dbff3f6b43f20faab00fff206e1e340cb9d4204aa9f858bd49637ec089a49500b5fe778d577d082680b93c46c2ad1f95a0562c01e05b88a26a41353a8cca2a

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    14397a5769f85881c2d52d2e2a5f3335

                                                                                                    SHA1

                                                                                                    13194a60bdcac6bcfa625c29d766f21be616f543

                                                                                                    SHA256

                                                                                                    84c3cee4dd2c8f66f623d511791cabfcc39d71cf9430f4ea0e34df758230c493

                                                                                                    SHA512

                                                                                                    0730d0ce418a30734b190d83cdff46d9e46a8350f69a38e885abf2d22568f7724db1ef28005da8c6142f48465abcaa3043610d4f5c7c73c1eb2fea38cc694eba

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    2027fb2d5fd066d0c5a25d8c06bc2d92

                                                                                                    SHA1

                                                                                                    036ae516e83172fe000e0bedb984e651c3b99907

                                                                                                    SHA256

                                                                                                    95841bb0e0d882debe500b1474e50d883eb649879dd9d90c33e15fd3bb325e1c

                                                                                                    SHA512

                                                                                                    c9161e9023e519258af7cb81af7d9096ab754e4e59dd183eebe8dbea32f498e1535fb798e9bcc6b03824780bfb55a33e88ef1bb1f62a58ec8cebebd2140bec71

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    e1630f6d1d22f144f1955f6464fba523

                                                                                                    SHA1

                                                                                                    e66ed06eb5e2604d416dcec87acf69e8a681be8b

                                                                                                    SHA256

                                                                                                    6b97e3585a30549ff3f71996d92ac20f92585cda9591fef7eb4ae97ccd544021

                                                                                                    SHA512

                                                                                                    9da188658d263a8fb12d5c457010ad3f0b4a3a5ecfcb7f66a9b152b14ba251cab43e23dc5d2c176b80cd3e7581c29b7efbe8506faab770448cf318b942896bb7

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    2d34d114e0c0be658075185d5ee68501

                                                                                                    SHA1

                                                                                                    9e8af978a75f557bca0d74cbad61ba23fe876e70

                                                                                                    SHA256

                                                                                                    e6a702b04e73bdcbb6c4b4aa67376a1c23e206ea720b4b01168d37db14c723e5

                                                                                                    SHA512

                                                                                                    af60fa058506565a15ef4ce8c95a5a882942dcc5272dbd571427510eb43fcfd6f0dc538b6997eeafc02a12aafcedb21a8b34be405ef07c3558f1b4aef6fb2ce3

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    6f8c83aed35c8d56f11d0cc00b3e4cd2

                                                                                                    SHA1

                                                                                                    9c9f6754d7a7498aedc09ce4da6f4f47716272ab

                                                                                                    SHA256

                                                                                                    b88f3920b1498823c7a12443411d43319ddedc5b382f0afc925297de0c2e215b

                                                                                                    SHA512

                                                                                                    2bc77e874bbfa1ec7e49f757098c9c5a2eeee19c466bc423232948d118d93a05f123ca580fc20a3a0cab5e0cbafd192de9b198866d2b758fba97365676dd0ea3

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    da69b4e113d538996cdcb3c99222d480

                                                                                                    SHA1

                                                                                                    036e1e40e466562ccf1b9adbc6c39f37720da9f8

                                                                                                    SHA256

                                                                                                    4cdad5f7d71cb69f6ef1cc32976f4fb150bb8ab728c5b141ad2b6dda089ecbd6

                                                                                                    SHA512

                                                                                                    faf011f7edcbaf3998afad5815bcecb29becd1c23a58ea09686842303f2fd412420aac7b25f2e874ea628cc20c1e20e151f6c02a616cd51e84ce97ca6cbe42df

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    3d96b387b78c5861870b288e87290b9a

                                                                                                    SHA1

                                                                                                    a36046a24190d8422286c7b7ae93a28c135d0711

                                                                                                    SHA256

                                                                                                    41fe3f6a2b7564b164ae49d9341e72ae8332b80404688fda6257848053f1d60e

                                                                                                    SHA512

                                                                                                    e4f63b254c2b60233c1a05b8c65bb999b1111991a651108364f8056656d09839b556e401bbb463b3291849822ba054882ad75a149dc94ac352b368f610df26e7

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    474312f8397340b5dc95511121445091

                                                                                                    SHA1

                                                                                                    624593f6713774668d2166d98551391fe570c4b6

                                                                                                    SHA256

                                                                                                    a1ffda62311222bf698c7d2af07124f8eb59bf6feacdba9a2a19e6a4c51ee221

                                                                                                    SHA512

                                                                                                    6f7672341e58c124da3617cff30969913573a1865affc7469c4b650c3e1dca87acdc8b8f439acf124adcb4d0eeb66d0820e08d165f46012752c5cede03c83a40

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    3d28ec84d16fdbd4c77bfbd3d021f688

                                                                                                    SHA1

                                                                                                    13a2428343574b3d789f0a00aa8a38d36ddb5784

                                                                                                    SHA256

                                                                                                    ccafd7dbc8e73f300872e1578bf2dbef618eddddcfd7f48f3607b421b4a5ef51

                                                                                                    SHA512

                                                                                                    81e35c3684d4c4f7348f6e378446aad4746368dde79fc6d3a07c19d6b835a4af8dcb412313fabfd748daaab62fe6c01055f5375a22f44c70c22b69eb1433cea9

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    Filesize

                                                                                                    372KB

                                                                                                    MD5

                                                                                                    25f4184bf9721fbe9f711cc1477458eb

                                                                                                    SHA1

                                                                                                    57f2f8e18c60e633c57425a1f6e3f5a268b4b19e

                                                                                                    SHA256

                                                                                                    24038a7005a7a7446ad473cb201bad798abebb783c142c6e1ce8b2fd7326bdb1

                                                                                                    SHA512

                                                                                                    ef6786c8bdc3f52b442f470743f29b1169dda39d4de32a5b0ae6c65bfcd5c0f8b749e9521bd168631a9992ba5fb9e720b7ea047287e8cda1c021a0ba5cd21818

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\install.vbs
                                                                                                    Filesize

                                                                                                    536B

                                                                                                    MD5

                                                                                                    b4118bddcc9fe0ae73396b2b1b58c970

                                                                                                    SHA1

                                                                                                    23afa06fa78bbcc9c11e8549681fd4956f9d6c45

                                                                                                    SHA256

                                                                                                    e5d5005f7c9fdada426273f14e2ebe328b84f9161e80acc1396dadbe9897e98f

                                                                                                    SHA512

                                                                                                    fdc29fb8fafb990e52487b9ec22140dcbc8c684efa53da41e348584c623fff1a7ce1a9b3deaccdb25867479b393d52d199c8f09cb365e6c84e5980f6d4285b67

                                                                                                    Download Submit

                                                                                                  • C:\Windows\win.ini
                                                                                                    Filesize

                                                                                                    123B

                                                                                                    MD5

                                                                                                    6bf517432f65eb7f0d18d574bf14124c

                                                                                                    SHA1

                                                                                                    5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

                                                                                                    SHA256

                                                                                                    6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

                                                                                                    SHA512

                                                                                                    7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

                                                                                                    Download Submit

                                                                                                  • memory/740-77-0x00000000021D0000-0x00000000021D6000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/740-75-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/740-84-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/1996-454-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/1996-462-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/1996-456-0x0000000002720000-0x0000000002726000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/2648-487-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3212-207-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3212-216-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3240-35-0x0000000000600000-0x0000000000606000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/3240-34-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3240-41-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3424-395-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3424-389-0x00000000020E0000-0x00000000020E6000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/3424-387-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3444-128-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3444-121-0x00000000021E0000-0x00000000021E6000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/3444-120-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3884-421-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/3884-429-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4000-289-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4000-296-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4072-172-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4072-165-0x00000000020C0000-0x00000000020C6000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/4072-163-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4240-10-0x00000000028B0000-0x00000000028B6000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/4240-5-0x0000000077081000-0x00000000771A1000-memory.dmp

                                                                                                    Filesize

                                                                                                    1.1MB

                                                                                                    Download

                                                                                                  • memory/4240-2-0x00000000028B0000-0x00000000028B6000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/4240-4-0x0000000077081000-0x00000000771A1000-memory.dmp

                                                                                                    Filesize

                                                                                                    1.1MB

                                                                                                    Download

                                                                                                  • memory/4332-260-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4332-253-0x0000000000540000-0x0000000000546000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/4332-251-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4408-13-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/4660-323-0x0000000002140000-0x0000000002146000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/4660-321-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4660-329-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4720-354-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download

                                                                                                  • memory/4720-356-0x0000000000730000-0x0000000000736000-memory.dmp

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    Download

                                                                                                  • memory/4720-362-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                    Filesize

                                                                                                    384KB

                                                                                                    Download