Overview

overview

10

Static

static

3

c3a763655d...6N.exe

windows7-x64

10

c3a763655d...6N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2025, 18:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c3a763655dbd277ce4f256c3567fd8523574d848e21181387b3dc047e79f1496N.exe

  • Size

    372KB

  • MD5

    b52779497b912f5b58c9f1713bf7a4e0

  • SHA1

    15842a82d1b7b6a4016d6492e126a1e0379eabcd

  • SHA256

    c3a763655dbd277ce4f256c3567fd8523574d848e21181387b3dc047e79f1496

  • SHA512

    5ae97636030e074d3ce5642e90a4309cae0f36763fbce33b086487afd9dcd0951bfc1af42d69928a83404baf921e5d341cd7e6e670e4d67e0e0fcb4953174dd7

  • SSDEEP

    6144:t8dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi+:t2qQx+H2i+8LBNbdypazCXY

Score
10/10
remcostinodiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

TINo

C2

185.140.53.140:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    true

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-5S9O07

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Modifies WinLogon for persistence 2 TTPs 35 IoCs
    persistence
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Downloads MZ/PE file 2 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Modifies WinLogon 2 TTPs 35 IoCs
    persistence
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 35 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3a763655dbd277ce4f256c3567fd8523574d848e21181387b3dc047e79f1496N.exe
    "C:\Users\Admin\AppData\Local\Temp\c3a763655dbd277ce4f256c3567fd8523574d848e21181387b3dc047e79f1496N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\c3a763655dbd277ce4f256c3567fd8523574d848e21181387b3dc047e79f1496N.exe
      "C:\Users\Admin\AppData\Local\Temp\c3a763655dbd277ce4f256c3567fd8523574d848e21181387b3dc047e79f1496N.exe"
      2⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\Users\Admin\AppData\Local\Temp\hab.exe
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Users\Admin\AppData\Local\Temp\hab.exe
          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4972
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4156
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1500
              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4568
                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4768
                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                    9⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3436
                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                      10⤵
                      • Modifies WinLogon for persistence
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies WinLogon
                      • Drops file in Windows directory
                      • Modifies registry class
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3148
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2648
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2808
                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:3484
                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1216
                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:4576
                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                  16⤵
                                  • Modifies WinLogon for persistence
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Modifies WinLogon
                                  • Modifies registry class
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:1692
                                  • C:\Windows\SysWOW64\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                    17⤵
                                    • Checks computer location settings
                                    • Suspicious use of WriteProcessMemory
                                    PID:1040
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3032
                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:4688
                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:440
                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:1952
                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                              22⤵
                                              • Modifies WinLogon for persistence
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Modifies WinLogon
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:2056
                                              • C:\Windows\SysWOW64\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                23⤵
                                                • Checks computer location settings
                                                • System Location Discovery: System Language Discovery
                                                PID:752
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                  24⤵
                                                    PID:2312
                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Windows directory
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4600
                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                        26⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2876
                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4496
                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                            28⤵
                                                            • Modifies WinLogon for persistence
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Modifies WinLogon
                                                            • Modifies registry class
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3172
                                                            • C:\Windows\SysWOW64\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                              29⤵
                                                              • Checks computer location settings
                                                              PID:3388
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                30⤵
                                                                  PID:4464
                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                    31⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SendNotifyMessage
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:1568
                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                      32⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:936
                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                        33⤵
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4700
                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                          34⤵
                                                                          • Modifies WinLogon for persistence
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • Modifies WinLogon
                                                                          • Modifies registry class
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3832
                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                            35⤵
                                                                            • Checks computer location settings
                                                                            PID:3728
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                              36⤵
                                                                                PID:5100
                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                  37⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:5032
                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                    38⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2084
                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                      39⤵
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • Drops file in Windows directory
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2056
                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                        40⤵
                                                                                        • Modifies WinLogon for persistence
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        • Modifies WinLogon
                                                                                        • Drops file in Windows directory
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:5068
                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                          41⤵
                                                                                            PID:3436
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                              42⤵
                                                                                                PID:3212
                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                  43⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Windows directory
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:60
                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                    44⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:3704
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                      45⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      • Drops file in Windows directory
                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:4200
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                        46⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Adds Run key to start application
                                                                                                        • Modifies WinLogon
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4392
                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                          47⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:3400
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                            48⤵
                                                                                                              PID:4092
                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                49⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:2948
                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                  50⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:1172
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                    51⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:4380
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                      52⤵
                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Adds Run key to start application
                                                                                                                      • Modifies WinLogon
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:4284
                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                        53⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3708
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                          54⤵
                                                                                                                            PID:232
                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                              55⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4752
                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                56⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:4928
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                  57⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:1908
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                    58⤵
                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • Modifies WinLogon
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:3364
                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                      59⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:216
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                        60⤵
                                                                                                                                          PID:960
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                            61⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:3212
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                              62⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:3920
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                63⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:876
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                  64⤵
                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:4392
                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                    65⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:4168
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                      66⤵
                                                                                                                                                        PID:2636
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                          67⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2384
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                            68⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:824
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                              69⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:2324
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                70⤵
                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:4868
                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                  71⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5044
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                    72⤵
                                                                                                                                                                      PID:4088
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                        73⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        PID:4756
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                          74⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:456
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                            75⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:4564
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                              76⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:2584
                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                77⤵
                                                                                                                                                                                  PID:2368
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                    78⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2492
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                      79⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                      PID:4880
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                        80⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:4992
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                          81⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          PID:3528
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                            82⤵
                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:1628
                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                              83⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4464
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                84⤵
                                                                                                                                                                                                  PID:3968
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:2544
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:2632
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                              PID:232
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                  PID:2892
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:1304
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        PID:3276
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:3820
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                            PID:2876
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3680
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:3520
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        PID:976
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                              PID:4472
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:824
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:3372
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                          PID:3588
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:5032
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:1304
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                  PID:3952
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                      PID:828
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:2524
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:4992
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                              PID:1692
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:3320
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  PID:1572
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:2348
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                        PID:2636
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4432
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2544
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                PID:4216
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                      PID:4988
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:2584
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                              PID:1600
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                PID:3904
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                    PID:3920
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                        PID:1396
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:3608
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                              PID:2272
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                PID:812
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:2636
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                      PID:1272
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                        PID:4760
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4224
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4564
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:4840
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:2600
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                          PID:2024
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            PID:3528
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4048
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:2012
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                    PID:4980
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                      PID:2668
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                        PID:3032
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:3316
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:4764
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:264
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:3012
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                  PID:976
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                    PID:2508
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:2892
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:2608
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:1620
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:2020
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                            PID:876
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1352
                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTQ0ODhBRjEtOEY4Ny00ODA1LTk3QzMtOTc3NjI0NDA1OTAwfSIgdXNlcmlkPSJ7REQwQUE4OEUtNTk3Qy00NzcxLThBOTUtQzQ3Q0E5MDNBRjY2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QURGQjhGQzUtNzIxRS00MThELTg1RDMtQkIyRUFGQ0I2NjJDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzcxNTI0NTUzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                1⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                PID:1424

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                1104fe4dc66d7efbc99652f9e36e896f

                                                                                SHA1

                                                                                cc34512692d5c6cd081bbe4e5494c381231c0a6b

                                                                                SHA256

                                                                                d20792b7788f00103e5adb53599ba91b792c140d25a2fcc5a6f7de2d06d73194

                                                                                SHA512

                                                                                f94f2ff67eec82c7aec4c1fdff8dfa91ca292810a9b81f29fc343c74aeac63161141b3341474a66e047d13512706c875a87cd4eaa3e670a9d32186e1db2970ee

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                a609b54643881b58b26cc6f2142e7b96

                                                                                SHA1

                                                                                4cc5cf952b023565c317fa02fe2091b15de84b05

                                                                                SHA256

                                                                                880b5ade2a6a99cd93d611a1701f6670488a2128d9994735e853d19fad0cbae9

                                                                                SHA512

                                                                                384a07bd0e3e6af0ad08cd86f4a98d8d98862a5cf2d4ba5d58b5402271820379a9d71fb74da3a4dd954e4ff941c1d2960073050e030b2b27eb892a7dfd6e6755

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                a547292c41471967a0fe77b84d4521f0

                                                                                SHA1

                                                                                5844c0346ea410e82fdb32f7784b22c86bfdbd23

                                                                                SHA256

                                                                                622c4f8f235f80a2570929f3e55ef605bf359c82ebfbd6d1e8df71b68f071515

                                                                                SHA512

                                                                                77065fb0f3298c083f6dff710d9a96dd0374270d3d0d3002736882f465b7bdd177a44017da937e05c53ef97a086917a25394400fc736d3a519aa483f85207b6c

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                b77630ed8b80f0135b32aa8a821e756f

                                                                                SHA1

                                                                                803fb2684fc2049773bc54237d3dac3c166fa5a3

                                                                                SHA256

                                                                                012d00ba9115eb7665a117372a18e75a476ff986d8f77f8b0d66d7dc5dbf9f33

                                                                                SHA512

                                                                                755e7b9c6fb20eeee82b96393b8b5f836657c021f04ddafa0974916a3cac8fe6d2891935f9929f6a0d1283132bca382777670f22bd95f892fdf892543027363f

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                370025abd2ec8a546a87917a18148112

                                                                                SHA1

                                                                                02d31d9da81e33d9845306edd7b7be296ed3fb42

                                                                                SHA256

                                                                                25d4a8a89c8ba7980e397a84d796edb2bb171b0c64a34b0319b6c53dd8e8c2cc

                                                                                SHA512

                                                                                ae2040713f65172d5d824c7959b8e8c5e9ad5b17607d44e0b68317624e8da6abedc980d68f544fc164b4ab37cd999d21ce9787b95c28ddf00eee0b20399e4b44

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                a9dc35fee3c1a6c938c8634ba05eaad5

                                                                                SHA1

                                                                                20ca2a4b54c69603ab806dfd864ad625dd7f92b8

                                                                                SHA256

                                                                                4bab6a8a1fc424d31bbb77c4803df8631e749ac3ea6df3f0ae417f8531a1978c

                                                                                SHA512

                                                                                253731964e6498d7c371fdcb483b67a376a5e5443b3a80fe2fd1795016f0bdb60612986478ab333fefccb796e1ad3c8a59c2674641092f1e054fbe330f13781e

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                a3b7a187edef75d3b67d0a4afec28d14

                                                                                SHA1

                                                                                1e31f8e561a003c8fd6360d3f7c428f08ff7fe58

                                                                                SHA256

                                                                                c7b128d4d6050ba4684a5d19fb711eeac1ba645a03325fb7fa3eecb6d6af73b5

                                                                                SHA512

                                                                                8da348ea93a86000f5a50587967affd965cf35d9046b465afce9d50f129303b95b652b1913441a558b4b2e8b42f04612c2f547b9f2f171cb5acedd7006936b7f

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                956c27032482c79cc34acef27b0d0d64

                                                                                SHA1

                                                                                eaccb06b9b0a53fbb426e79708dc500cf10a9083

                                                                                SHA256

                                                                                b8d67698556ebc2db0cd1268bd4158ec3c9d412a50f65d28ebde0c77393f7d84

                                                                                SHA512

                                                                                09e72668fbe16b63d376494bca5ab16e98541563bd68fe3bde744addb0101f1ab916b4b96e11c5cb4f0f838147aaa1c4629bddaf9cfbe39debabb21d5c3d9bc6

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                233e45d922eecfbd157f0c1475c88428

                                                                                SHA1

                                                                                ca5fc3539217970c014a62078070284c8060463f

                                                                                SHA256

                                                                                c19c9757f72cbafbf8b2d2892f506343f2e17172133eff8241e6e7a9b7ebce1a

                                                                                SHA512

                                                                                8632b19a8009654ed0cd40f07b6078680fbef441c93b2658ec72d01b7daa5b600cf4f4fb6f3042778726618597e9db3d907c469406ca2ed8c725696440b77760

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                da4adf03db9c76c60953fae195c58430

                                                                                SHA1

                                                                                bf3f2160424b9d99dec621707cfa2e66be3fdbba

                                                                                SHA256

                                                                                d11a884d9d9c7726794eff027f9cf119472ccd60675fc8fb8955045e7d3cc677

                                                                                SHA512

                                                                                3e3a069d2195a5cb4d7a6dc368b606ff528e25c6b4fa13a9c0748bedf8d1e94bf49dee13782a6fddf4972b8797de7f3f5edf85033bd6c3056ad08c661fb7e4f8

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                d8ff1d9a06e300ec192ac4f9eb43d80c

                                                                                SHA1

                                                                                0d41bbfc749f947b02eac7593cf1f40aa5f5bcf9

                                                                                SHA256

                                                                                f108a39713a16888b91e8f761c9c8385526688d95e12dd8dda5c3ff71d49f9d4

                                                                                SHA512

                                                                                4a668d3e9f027e18ccf71fc2faa29748f1a8bdc3ce2ab8e6bd73cf9f78a07ed9adcf1833aa20394168e6afeb1805bbb3116ca08b96035e560ccf2bcf9b71cfec

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                859f339eba79dfcfdab6c09843ed98be

                                                                                SHA1

                                                                                cf799a011fbc6455a89380c9d3a83a3f7fd3918f

                                                                                SHA256

                                                                                cb7e1c98db19ca84302ee396288dec9556001004276fd000dcff0683931b920b

                                                                                SHA512

                                                                                dbe63da31975ff2bc21d315c8fc88d66d16a49f70c1ad725e698a5de740d529f445debd68cede24ea43e998452964e760c9e8afcaaa0ab6fb40c330df8a31328

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                c81ef171d2527f253d39cc3c5d78c593

                                                                                SHA1

                                                                                0e7dc30357d20b3b82e1dc155a277543abe00dd9

                                                                                SHA256

                                                                                c87b55cdc9f9e060bd5c5d371f9bd3011bf76e96dfe045018e1e089607d2abc4

                                                                                SHA512

                                                                                346a81c37e2db0f00ee827ae1b444a3050965cb5b77a60d0dd1008acc9ee7a544051c6056b62431fb3841f95765788f06fa56bc90c92081cc023f87e6fed9c93

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                7c2253a1dc332b5353079d5c5aa5c110

                                                                                SHA1

                                                                                72ef3c9bfd1fea6e69eee85abea3be02eb6d3088

                                                                                SHA256

                                                                                193dc97cf7c84c8f206deaffde8d7d8c7e72d7f54beab79dbc5949bfce84fb4f

                                                                                SHA512

                                                                                cd95e1b0b3cd5daf804f7c47986d68816cca83c7da4fe2446eceb61b1d2886f5f829f6b5d841e3af635624927187812b6c1862127c551829ec13ee6b5c7a3c47

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                b35c860efda4d8b520845ad94189d65d

                                                                                SHA1

                                                                                37ac548358276765d631c2e045860c38e035d29c

                                                                                SHA256

                                                                                04c5e138ca1ee27eca45068c3c11e7d8ae1e65de91018c2e73d4f693d9bd0cb5

                                                                                SHA512

                                                                                44e6cc76f2de697977f092d8d047ec0cc1110ddc4ccf237f550e31a5c570f214f8bf70796e3f0da57b9824f9a1b2681a4a190f95413cb3b386b15564c23a3009

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                56f5295a81bdb0d87f8a9a090707f544

                                                                                SHA1

                                                                                6d0882768da4d10c90409b4140d1bba4c274c5ba

                                                                                SHA256

                                                                                cfba4bc2cb48c9552b88d4090db0179c55fca158d7e4154ef5068bebb2cc0f55

                                                                                SHA512

                                                                                ae29169bad4261317ab9592c82b9d0b654ff88451c156c323b7b4f97a7096e0441c749a3c80b6fe800257a396f6e3ba839bc2966a4f5eb96405c5f8204ffe95e

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                4239156d6fec6ebddb2fc99a657d992c

                                                                                SHA1

                                                                                5cf52c8e6c3563977bc9c2bbabad1df60f5de284

                                                                                SHA256

                                                                                a404b8b3657a12e97ee9df8ac60e417d16a7d098b8920d484beea71a017c4418

                                                                                SHA512

                                                                                77dad18e386daabd995b164fad7ed6de1335cc8e2f805266110eb82864d491730bb33607144333a703c454fe65ceed6f3621ca6bc3a8b3bf563493b89bf18457

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                fa03d4d21e3753c06b22d98df1ff0929

                                                                                SHA1

                                                                                cda4b8e3bd52fd2d7ddef3ca04d027991dc79336

                                                                                SHA256

                                                                                e6d599f132659a106c8d82ebe3a209aa4435182f2520d03e7a38da7cb502df71

                                                                                SHA512

                                                                                11cb21ade2d270feb4888d1d577747742a58a87b8163a87b5b04c9dd1bd1aa555079606cf1d66d0f93abf2476b3ccbd4d0e770870d3d751a9c606900eacae3ee

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                6c86c291b46efd5796d01756256ac9ed

                                                                                SHA1

                                                                                fe6b28d6423ced3046ca0c1628220804f6511da3

                                                                                SHA256

                                                                                2a2318e1f97cee8fbc16df236fceaf9cec9f80c86ace87fa13bd581bdc063fbb

                                                                                SHA512

                                                                                5764709939c3724be6aa11ecab6c83238c01a44855312470f78faaa4e3f34ab62e5216c39621bec6eee4660d30fdffc9cb63098abe741744f489452ebeec4d91

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                4c3fdedc90390516e5f63e49393d5f9c

                                                                                SHA1

                                                                                b0c97d24c29c23d7faa981e07d5f719b7bbdbbbc

                                                                                SHA256

                                                                                3ad3db4d89346d0608ec3bcf1057fa81c677103a98296ba29feafd4315b27e9c

                                                                                SHA512

                                                                                23303d2f809ba9470adf922250c790609dca259d4944c0ec818c740e3593af7c2f2ce5e0597f17c4d563b10337751c611b75d079632882292bcc0f3624172ac1

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                067c926426c755736e7daa0e2f82822d

                                                                                SHA1

                                                                                64fad0dd89785826115077d54984125e280ce928

                                                                                SHA256

                                                                                1e4a5fd42ed5ca0b90e844a17159a4398f5b7bf594bd2de5e7e6207dc2b7e1b6

                                                                                SHA512

                                                                                2de25bd201dabffefdec2ef0f5d5bc1f8f4d1c4d6760dc67f31ce632140eacf87e1f416f7bf98940e7b8b75aa1a774e2495e6186c0aae3ec3ccb76b99f6a4453

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                59ce0f338f4c9bb0ce4491d3ed0c5444

                                                                                SHA1

                                                                                fd7f2aebd77b3d196dc251feb68fa6c6229e253c

                                                                                SHA256

                                                                                34d779265edcaa60e0121934dccbe002f66ef0fda07b4896626d1a1c40fa1e0d

                                                                                SHA512

                                                                                72bed50cfb03257ea345cf5d6189d21921e0326175e2de99e62123fd962d3ef29505f16295a4a3a62434eb1cc921b96c7df19050e62466e9431a1235ae973ac0

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                28c3ace3e63e4ad06416ced931ba1018

                                                                                SHA1

                                                                                d8029507acc5164cb28cdc93a5418de1bcbddd71

                                                                                SHA256

                                                                                956acffc4609489c0f1a4e9b0e1a356936c9e6a2a4ec912e92de119c2ca857be

                                                                                SHA512

                                                                                a802b5a74041ff58a9c13da332256219362b13eb6074fd548685c71c4efecb806b8679800d7f974b3e3354f26489735e98be831d9a39d9cc314eca3964700118

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                0ac229985ebc40dcc10a2615ea243a3b

                                                                                SHA1

                                                                                621efca54eefbad08517da420703c641946f2950

                                                                                SHA256

                                                                                ad554b8a9dd9227afef083adb630fd8d1736c5ca60d9ae0ecb9b86e366c73ccb

                                                                                SHA512

                                                                                54ed6bb9b64245507a7bfb24b8001bb88bba941b2be4ae4bae1c6e793b9e8a7d5229614c1e1ffe366f6534a8501f8c0d9122d672942c95688328929723a13da6

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                27166ab24fbd9c2efd42e7b74a6de4f0

                                                                                SHA1

                                                                                2917fdd2459ecd72d3454114c3eb66f497dd2ec4

                                                                                SHA256

                                                                                f52e5485b7d8f20f5912c18cb436f3d4c22c03a86a95bac31147056178bf719f

                                                                                SHA512

                                                                                301b4efec278e92dc5f67069e4612e28d991b7538bfe76128ceeac8f888fb92cf97ca6ddfde0c3335515d8c1b92dac0cb21d16084eac36493bbb0350ea02d850

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                72c31dd4b2c942c48b66e945454e2e40

                                                                                SHA1

                                                                                4e007a360bf0f0c4db3bb6e513ae61c23fa5859f

                                                                                SHA256

                                                                                1d11881df93b621fbd01192412538683dcec6c96a23ffe67565fe8a26aad0f20

                                                                                SHA512

                                                                                16ee9d078524e980befec19971d000f09023c902f95008e4fe6fecb03053a9d51296548b20d3b587882d8f67133d04f21cfa5e7394344425af2a08fa182c4dd3

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                6a9b8e4a0d8fbfeaa47e5f1a2eb39083

                                                                                SHA1

                                                                                08681ef0e837a25fa4dad034269eb2550554bfac

                                                                                SHA256

                                                                                52444599fa9061674a0ee54ab03c2d7c1dc4bd6bd525c2fa5e725577fb502dec

                                                                                SHA512

                                                                                968001ea9f20c58737bebc5070da60b41a6fc27aeaa692c7108707b1bb239ec0506649996d1072056255f315666863cf6935b119c89bb49526a6118aff9f08a7

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                dc3035274877e5a40703a4cf760f5bd1

                                                                                SHA1

                                                                                060bcde568cdeea745f8ca51e479635c45941551

                                                                                SHA256

                                                                                121d1e86b19d3b1a602be15fedda0b44e0753d7455e3036a2bb9d5fbe73b4eb0

                                                                                SHA512

                                                                                f2eba1e1346a3151175aea25cecd91fa98cdf49d42ef924c2b242dd1c765c852534ed8a20d135591177c07fdb0f61a8f3db1194a7f6c724ad681f030648c2fe1

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                165d231797b3711ba588fb3fc7c05bd1

                                                                                SHA1

                                                                                e0a1ac73d49711f7f236c40c48d54a6dcbd4f4d9

                                                                                SHA256

                                                                                3a3dc3fdb21b994b31f3919b82b570fad4052ddfbc46c43aedff066e3a0c052e

                                                                                SHA512

                                                                                39c0416c30b5badfe5f843ec2340201ab350d2dbeed2d86affb621ff1c2b0be87eecc9a85de87ce0e001383ba340cc9f99d8000b60605b7d789c086ac01b557a

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                084161b5eccae1e93c71a400c59f6674

                                                                                SHA1

                                                                                e519bf61da5804c2f1ac24f017e272ebdee9777e

                                                                                SHA256

                                                                                ad095fd5a65c289874f0905de2ca4d5335ca7b4a17779ac2109a8aa6bd74c751

                                                                                SHA512

                                                                                f505d57e1e07a44ac43370d6d410304f2be0ab03df8250a40f5c81ebba64977637a71235e4381c08c7fe5eded8a35ba246cefcaea4c9a524c0bc373d295a4fa4

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                ab5ddaafb847139ebb5de6634aaf4cad

                                                                                SHA1

                                                                                20b70feb92c7bc6686e27560213626817d2e74bb

                                                                                SHA256

                                                                                f5ad4e9324e84bf24399158f4ce9d829474a4f93d151a5d46ed0ea76634e3934

                                                                                SHA512

                                                                                fb106a6ecabbaec582b6c1854b40808198845598a24ddd079605f4e73eae5af43f076035f8de5be84a16306003d7707c5448bcd30db71395a0aaec2f2643f592

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                5bef40062230739455dcbb34d6af18dc

                                                                                SHA1

                                                                                1381356108e265cbadb196fc3b21cf3100e9cdf1

                                                                                SHA256

                                                                                d8dd99294da40b8294a46d5e87589d5f538c83131858b80088ae853e28b13ee4

                                                                                SHA512

                                                                                6b249bc44485dc54a0c75a015d80b99f4c56964fb62548aee42228eed4065dfe37f1b62fe227df0c72f474ed1cd714246114997a27ebdb94c4eb0e443573ce6b

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                132439f83579f22bb6f3089943641b48

                                                                                SHA1

                                                                                243588507c3f72edee7541db9722c7989d7e890f

                                                                                SHA256

                                                                                5602db2e89de2210fb029971d02537fab30a77403d1b9a90006b298d125fb3c6

                                                                                SHA512

                                                                                4832477d97716797d0eee2951f6947d08410d0b81c8de1d704f1e1f9257c7f2b77415c4c50b7615a027b07589acd8fa99255733d253318d642461a58f17504fc

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                e1952424ceb23768c42f9bcbe3f496b3

                                                                                SHA1

                                                                                d6d22efd749c93a7a3181330d2724d55346085fc

                                                                                SHA256

                                                                                7d12b24158b5e5eb79022d1fa6b7da526a2a57652cafd82d98ee9ec810916e4c

                                                                                SHA512

                                                                                cc7ec39027fe5c7741e29b6035565f80084be26cec7bd97c7aea7197ca81864de8534a78a1c8456ee4f46ca0405d3adcbf3d3f62a95488953f0fb1978544e3ed

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                3625d67387f14df497b590084a6a463c

                                                                                SHA1

                                                                                d2ba2d006f8f8b5f2862fc106084e67a92413e27

                                                                                SHA256

                                                                                a0d52dccc89ce82d70b0abb5671f0b4b017c9bfb8fb0dfa305bf445aa045cac4

                                                                                SHA512

                                                                                960da73dc64612b0f0749369508eb4231fa2c82f4cbc2103942d5e2a2abdcf3a7ebf9ed2e8a25ff744c7512bdf2a9430e048fb3ff9409b243046d634fc231a5d

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                Filesize

                                                                                372KB

                                                                                MD5

                                                                                5f3ca9db42a765fdc7abeae6976ddc6d

                                                                                SHA1

                                                                                accf2e5e591600dea0d8e907cd9fe9c3b7103770

                                                                                SHA256

                                                                                bc8f721a2e2211ddaf6e0967c2fa5ecdf6940aae52d9882742cde152a442f064

                                                                                SHA512

                                                                                2f671d215ad0c36ae27973042d833547d252911224cb13f518f18ca45657a6f7ba96604d7646bcd11145901154784909d3a3864cf386093ab3c8ac68ea99d7ef

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\install.vbs
                                                                                Filesize

                                                                                536B

                                                                                MD5

                                                                                b4118bddcc9fe0ae73396b2b1b58c970

                                                                                SHA1

                                                                                23afa06fa78bbcc9c11e8549681fd4956f9d6c45

                                                                                SHA256

                                                                                e5d5005f7c9fdada426273f14e2ebe328b84f9161e80acc1396dadbe9897e98f

                                                                                SHA512

                                                                                fdc29fb8fafb990e52487b9ec22140dcbc8c684efa53da41e348584c623fff1a7ce1a9b3deaccdb25867479b393d52d199c8f09cb365e6c84e5980f6d4285b67

                                                                                Download Submit

                                                                              • C:\Windows\win.ini
                                                                                Filesize

                                                                                123B

                                                                                MD5

                                                                                6bf517432f65eb7f0d18d574bf14124c

                                                                                SHA1

                                                                                5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

                                                                                SHA256

                                                                                6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

                                                                                SHA512

                                                                                7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

                                                                                Download Submit

                                                                              • memory/936-12-0x0000000002040000-0x0000000002046000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/1568-2-0x0000000002120000-0x0000000002126000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/1568-4-0x00000000777F1000-0x0000000077911000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/1568-9-0x0000000002120000-0x0000000002126000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/1692-127-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/1692-118-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/1692-120-0x00000000021E0000-0x00000000021E6000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/2056-171-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/2056-162-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/2584-485-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/2584-487-0x0000000000710000-0x0000000000716000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/3148-76-0x0000000000610000-0x0000000000616000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/3148-74-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/3148-83-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/3172-208-0x00000000021D0000-0x00000000021D6000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/3172-206-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/3172-215-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/3364-388-0x00000000020C0000-0x00000000020C6000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/3364-386-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/3364-394-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/3832-252-0x0000000000720000-0x0000000000726000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/3832-259-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/3832-250-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4284-361-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4284-355-0x00000000021C0000-0x00000000021C6000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/4284-353-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4392-322-0x0000000000550000-0x0000000000556000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/4392-419-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4392-421-0x0000000002130000-0x0000000002136000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/4392-320-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4392-328-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4392-427-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4868-452-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4868-454-0x0000000002110000-0x0000000002116000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/4868-460-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4972-40-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4972-34-0x00000000020D0000-0x00000000020D6000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/4972-33-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/5068-295-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/5068-287-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download