remcos | 82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/02/2025, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
Size

372KB
MD5

e0095cb04c541581431c07adeb6db8ee
SHA1

dc91e896abbce7871b66897b66f9b760793702ca
SHA256

82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98
SHA512

ff640005f33097a20703ae9b800202aa9a6a85f3d103199b8acb052e3bbca097fb39c0b19b37916c89b7e885294a541b845710369be1f9fd6d916cff30d67b39
SSDEEP

6144:tRdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia+:tjqQx+H2i+8LBNbdypazCXYU

Score

10^/10

remcos tino discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

TINo

185.140.53.140:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
true
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-5S9O07
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Modifies WinLogon for persistence 2 TTPs 64 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 64 IoCs

pid	Process
372	hab.exe
2764	hab.exe
2664	remcos.exe
2648	remcos.exe
536	hab.exe
1804	hab.exe
2428	remcos.exe
1924	remcos.exe
1984	hab.exe
1628	hab.exe
2500	remcos.exe
2976	remcos.exe
2328	hab.exe
2016	hab.exe
2476	remcos.exe
3024	remcos.exe
688	hab.exe
552	hab.exe
2124	remcos.exe
2072	remcos.exe
2708	hab.exe
1916	hab.exe
2876	remcos.exe
2544	remcos.exe
2620	hab.exe
2728	hab.exe
1752	remcos.exe
1640	remcos.exe
1316	hab.exe
1156	hab.exe
1912	remcos.exe
848	remcos.exe
2856	hab.exe
2464	hab.exe
600	remcos.exe
672	remcos.exe
2980	hab.exe
2012	hab.exe
2368	remcos.exe
1540	remcos.exe
648	hab.exe
2696	hab.exe
2132	remcos.exe
1596	remcos.exe
2300	hab.exe
2708	hab.exe
2888	remcos.exe
604	remcos.exe
2408	hab.exe
2880	hab.exe
2392	remcos.exe
536	remcos.exe
1640	hab.exe
1860	hab.exe
2792	remcos.exe
816	remcos.exe
848	hab.exe
3052	hab.exe
2316	remcos.exe
1092	remcos.exe
1776	hab.exe
2980	hab.exe
2992	remcos.exe
2572	remcos.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
372	hab.exe
2880	cmd.exe
2880	cmd.exe
2648	remcos.exe
2648	remcos.exe
536	hab.exe
2032	cmd.exe
2032	cmd.exe
1924	remcos.exe
1924	remcos.exe
1984	hab.exe
2940	cmd.exe
2940	cmd.exe
2976	remcos.exe
2976	remcos.exe
2328	hab.exe
1656	cmd.exe
1656	cmd.exe
3024	remcos.exe
3024	remcos.exe
688	hab.exe
1596	cmd.exe
1596	cmd.exe
2072	remcos.exe
2072	remcos.exe
2708	hab.exe
2956	cmd.exe
2956	cmd.exe
2544	remcos.exe
2544	remcos.exe
2620	hab.exe
536	cmd.exe
536	cmd.exe
1640	remcos.exe
1640	remcos.exe
1316	hab.exe
816	cmd.exe
816	cmd.exe
848	remcos.exe
848	remcos.exe
2856	hab.exe
2940	cmd.exe
2940	cmd.exe
672	remcos.exe
672	remcos.exe
2980	hab.exe
2256	cmd.exe
2256	cmd.exe
1540	remcos.exe
1540	remcos.exe
648	hab.exe
1564	cmd.exe
1564	cmd.exe
1596	remcos.exe
1596	remcos.exe
2300	hab.exe
2640	cmd.exe
2640	cmd.exe
604	remcos.exe
604	remcos.exe
2408	hab.exe
904	cmd.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe

Modifies WinLogon 2 TTPs 64 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 2240	2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	31
PID 372 set thread context of 2764	372	hab.exe	33
PID 2664 set thread context of 2648	2664	remcos.exe	38
PID 536 set thread context of 1804	536	hab.exe	40
PID 2428 set thread context of 1924	2428	remcos.exe	45
PID 1984 set thread context of 1628	1984	hab.exe	47
PID 2500 set thread context of 2976	2500	remcos.exe	52
PID 2328 set thread context of 2016	2328	hab.exe	54
PID 2476 set thread context of 3024	2476	remcos.exe	59
PID 688 set thread context of 552	688	hab.exe	61
PID 2124 set thread context of 2072	2124	remcos.exe	66
PID 2708 set thread context of 1916	2708	hab.exe	68
PID 2876 set thread context of 2544	2876	remcos.exe	73
PID 2620 set thread context of 2728	2620	hab.exe	75
PID 1752 set thread context of 1640	1752	remcos.exe	80
PID 1316 set thread context of 1156	1316	hab.exe	82
PID 1912 set thread context of 848	1912	remcos.exe	87
PID 2856 set thread context of 2464	2856	hab.exe	89
PID 600 set thread context of 672	600	remcos.exe	94
PID 2980 set thread context of 2012	2980	hab.exe	96
PID 2368 set thread context of 1540	2368	remcos.exe	101
PID 648 set thread context of 2696	648	hab.exe	103
PID 2132 set thread context of 1596	2132	remcos.exe	108
PID 2300 set thread context of 2708	2300	hab.exe	110
PID 2888 set thread context of 604	2888	remcos.exe	115
PID 2408 set thread context of 2880	2408	hab.exe	117
PID 2392 set thread context of 536	2392	remcos.exe	122
PID 1640 set thread context of 1860	1640	hab.exe	124
PID 2792 set thread context of 816	2792	remcos.exe	129
PID 848 set thread context of 3052	848	hab.exe	131
PID 2316 set thread context of 1092	2316	remcos.exe	136
PID 1776 set thread context of 2980	1776	hab.exe	138
PID 2992 set thread context of 2572	2992	remcos.exe	143
PID 2192 set thread context of 1068	2192	hab.exe	145
PID 2528 set thread context of 2200	2528	remcos.exe	150
PID 2208 set thread context of 2260	2208	hab.exe	152
PID 2768 set thread context of 2732	2768	remcos.exe	157
PID 2652 set thread context of 2332	2652	hab.exe	159
PID 1108 set thread context of 1752	1108	remcos.exe	164
PID 904 set thread context of 2592	904	hab.exe	166
PID 1608 set thread context of 2348	1608	remcos.exe	171
PID 2676 set thread context of 2420	2676	hab.exe	173
PID 824 set thread context of 2460	824	remcos.exe	178
PID 1820 set thread context of 1092	1820	hab.exe	180
PID 1632 set thread context of 1664	1632	remcos.exe	185
PID 1716 set thread context of 568	1716	hab.exe	187
PID 2212 set thread context of 2356	2212	remcos.exe	192
PID 2176 set thread context of 2072	2176	hab.exe	194
PID 1916 set thread context of 2108	1916	remcos.exe	199
PID 2768 set thread context of 2644	2768	hab.exe	201
PID 1600 set thread context of 2028	1600	remcos.exe	206
PID 1496 set thread context of 1712	1496	hab.exe	208
PID 1376 set thread context of 1748	1376	remcos.exe	213
PID 1644 set thread context of 1984	1644	hab.exe	215
PID 788 set thread context of 2500	788	remcos.exe	220
PID 980 set thread context of 1212	980	hab.exe	222
PID 1528 set thread context of 2852	1528	remcos.exe	227
PID 1164 set thread context of 2368	1164	hab.exe	229
PID 336 set thread context of 1068	336	remcos.exe	234
PID 2412 set thread context of 2528	2412	hab.exe	236
PID 2756 set thread context of 2260	2756	remcos.exe	241
PID 2772 set thread context of 2748	2772	hab.exe	243
PID 3040 set thread context of 2788	3040	remcos.exe	248
PID 1600 set thread context of 1108	1600	hab.exe	250

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
372	hab.exe
372	hab.exe
2764	hab.exe
2764	hab.exe
2664	remcos.exe
2664	remcos.exe
2648	remcos.exe
2648	remcos.exe
536	hab.exe
536	hab.exe
1804	hab.exe
1804	hab.exe
2428	remcos.exe
2428	remcos.exe
1924	remcos.exe
1924	remcos.exe
1984	hab.exe
1984	hab.exe
1628	hab.exe
1628	hab.exe
2500	remcos.exe
2500	remcos.exe
2976	remcos.exe
2976	remcos.exe
2328	hab.exe
2328	hab.exe
2016	hab.exe
2016	hab.exe
2476	remcos.exe
2476	remcos.exe
3024	remcos.exe
3024	remcos.exe
688	hab.exe
688	hab.exe
552	hab.exe
552	hab.exe
2124	remcos.exe
2124	remcos.exe
2072	remcos.exe
2072	remcos.exe
2708	hab.exe
2708	hab.exe
1916	hab.exe
1916	hab.exe
2876	remcos.exe
2876	remcos.exe
2544	remcos.exe
2544	remcos.exe
2620	hab.exe
2620	hab.exe
2728	hab.exe
2728	hab.exe
1752	remcos.exe
1752	remcos.exe
1640	remcos.exe
1640	remcos.exe
1316	hab.exe
1316	hab.exe
1156	hab.exe
1156	hab.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
372	hab.exe
372	hab.exe
2764	hab.exe
2764	hab.exe
2664	remcos.exe
2664	remcos.exe
2648	remcos.exe
2648	remcos.exe
536	hab.exe
536	hab.exe
1804	hab.exe
1804	hab.exe
2428	remcos.exe
2428	remcos.exe
1924	remcos.exe
1924	remcos.exe
1984	hab.exe
1984	hab.exe
1628	hab.exe
1628	hab.exe
2500	remcos.exe
2500	remcos.exe
2976	remcos.exe
2976	remcos.exe
2328	hab.exe
2328	hab.exe
2016	hab.exe
2016	hab.exe
2476	remcos.exe
2476	remcos.exe
3024	remcos.exe
3024	remcos.exe
688	hab.exe
688	hab.exe
552	hab.exe
552	hab.exe
2124	remcos.exe
2124	remcos.exe
2072	remcos.exe
2072	remcos.exe
2708	hab.exe
2708	hab.exe
1916	hab.exe
1916	hab.exe
2876	remcos.exe
2876	remcos.exe
2544	remcos.exe
2544	remcos.exe
2620	hab.exe
2620	hab.exe
2728	hab.exe
2728	hab.exe
1752	remcos.exe
1752	remcos.exe
1640	remcos.exe
1640	remcos.exe
1316	hab.exe
1316	hab.exe
1156	hab.exe
1156	hab.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
372	hab.exe
2764	hab.exe
2664	remcos.exe
2648	remcos.exe
536	hab.exe
1804	hab.exe
2428	remcos.exe
1924	remcos.exe
1984	hab.exe
1628	hab.exe
2500	remcos.exe
2976	remcos.exe
2328	hab.exe
2016	hab.exe
2476	remcos.exe
3024	remcos.exe
688	hab.exe
552	hab.exe
2124	remcos.exe
2072	remcos.exe
2708	hab.exe
1916	hab.exe
2876	remcos.exe
2544	remcos.exe
2620	hab.exe
2728	hab.exe
1752	remcos.exe
1640	remcos.exe
1316	hab.exe
1156	hab.exe
1912	remcos.exe
848	remcos.exe
2856	hab.exe
2464	hab.exe
600	remcos.exe
672	remcos.exe
2980	hab.exe
2012	hab.exe
2368	remcos.exe
1540	remcos.exe
648	hab.exe
2696	hab.exe
2132	remcos.exe
1596	remcos.exe
2300	hab.exe
2708	hab.exe
2888	remcos.exe
604	remcos.exe
2408	hab.exe
2880	hab.exe
2392	remcos.exe
536	remcos.exe
1640	hab.exe
1860	hab.exe
2792	remcos.exe
816	remcos.exe
848	hab.exe
3052	hab.exe
2316	remcos.exe
1092	remcos.exe
1776	hab.exe
2980	hab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2240	2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	31
PID 2132 wrote to memory of 2240	2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	31
PID 2132 wrote to memory of 2240	2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	31
PID 2132 wrote to memory of 2240	2132	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	31
PID 2240 wrote to memory of 372	2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	32
PID 2240 wrote to memory of 372	2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	32
PID 2240 wrote to memory of 372	2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	32
PID 2240 wrote to memory of 372	2240	82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe	32
PID 372 wrote to memory of 2764	372	hab.exe	33
PID 372 wrote to memory of 2764	372	hab.exe	33
PID 372 wrote to memory of 2764	372	hab.exe	33
PID 372 wrote to memory of 2764	372	hab.exe	33
PID 2764 wrote to memory of 2304	2764	hab.exe	34
PID 2764 wrote to memory of 2304	2764	hab.exe	34
PID 2764 wrote to memory of 2304	2764	hab.exe	34
PID 2764 wrote to memory of 2304	2764	hab.exe	34
PID 2304 wrote to memory of 2880	2304	WScript.exe	35
PID 2304 wrote to memory of 2880	2304	WScript.exe	35
PID 2304 wrote to memory of 2880	2304	WScript.exe	35
PID 2304 wrote to memory of 2880	2304	WScript.exe	35
PID 2880 wrote to memory of 2664	2880	cmd.exe	37
PID 2880 wrote to memory of 2664	2880	cmd.exe	37
PID 2880 wrote to memory of 2664	2880	cmd.exe	37
PID 2880 wrote to memory of 2664	2880	cmd.exe	37
PID 2664 wrote to memory of 2648	2664	remcos.exe	38
PID 2664 wrote to memory of 2648	2664	remcos.exe	38
PID 2664 wrote to memory of 2648	2664	remcos.exe	38
PID 2664 wrote to memory of 2648	2664	remcos.exe	38
PID 2648 wrote to memory of 536	2648	remcos.exe	39
PID 2648 wrote to memory of 536	2648	remcos.exe	39
PID 2648 wrote to memory of 536	2648	remcos.exe	39
PID 2648 wrote to memory of 536	2648	remcos.exe	39
PID 536 wrote to memory of 1804	536	hab.exe	40
PID 536 wrote to memory of 1804	536	hab.exe	40
PID 536 wrote to memory of 1804	536	hab.exe	40
PID 536 wrote to memory of 1804	536	hab.exe	40
PID 1804 wrote to memory of 1712	1804	hab.exe	41
PID 1804 wrote to memory of 1712	1804	hab.exe	41
PID 1804 wrote to memory of 1712	1804	hab.exe	41
PID 1804 wrote to memory of 1712	1804	hab.exe	41
PID 1712 wrote to memory of 2032	1712	WScript.exe	42
PID 1712 wrote to memory of 2032	1712	WScript.exe	42
PID 1712 wrote to memory of 2032	1712	WScript.exe	42
PID 1712 wrote to memory of 2032	1712	WScript.exe	42
PID 2032 wrote to memory of 2428	2032	cmd.exe	44
PID 2032 wrote to memory of 2428	2032	cmd.exe	44
PID 2032 wrote to memory of 2428	2032	cmd.exe	44
PID 2032 wrote to memory of 2428	2032	cmd.exe	44
PID 2428 wrote to memory of 1924	2428	remcos.exe	45
PID 2428 wrote to memory of 1924	2428	remcos.exe	45
PID 2428 wrote to memory of 1924	2428	remcos.exe	45
PID 2428 wrote to memory of 1924	2428	remcos.exe	45
PID 1924 wrote to memory of 1984	1924	remcos.exe	46
PID 1924 wrote to memory of 1984	1924	remcos.exe	46
PID 1924 wrote to memory of 1984	1924	remcos.exe	46
PID 1924 wrote to memory of 1984	1924	remcos.exe	46
PID 1984 wrote to memory of 1628	1984	hab.exe	47
PID 1984 wrote to memory of 1628	1984	hab.exe	47
PID 1984 wrote to memory of 1628	1984	hab.exe	47
PID 1984 wrote to memory of 1628	1984	hab.exe	47
PID 1628 wrote to memory of 3048	1628	hab.exe	48
PID 1628 wrote to memory of 3048	1628	hab.exe	48
PID 1628 wrote to memory of 3048	1628	hab.exe	48
PID 1628 wrote to memory of 3048	1628	hab.exe	48

C:\Users\Admin\AppData\Local\Temp\82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
"C:\Users\Admin\AppData\Local\Temp\82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe
  "C:\Users\Admin\AppData\Local\Temp\82731e1c5228adc5b1880df339da2e95f7c9287f7f4f396218dc3863d2042d98.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\hab.exe
    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\hab.exe
      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2304
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        12⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        17⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        18⤵
        Loads dropped DLL
        
        PID:2940
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        22⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        23⤵
        
        PID:948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        24⤵
        Loads dropped DLL
        
        PID:1656
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2476
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        28⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:552
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        29⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        30⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        34⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        35⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        36⤵
        Loads dropped DLL
        
        PID:2956
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        39⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        40⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        41⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        42⤵
        Loads dropped DLL
        
        PID:536
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        44⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        45⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        46⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1156
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        47⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        48⤵
        Loads dropped DLL
        
        PID:816
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        51⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        52⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        53⤵
        System Location Discovery: System Language Discovery
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        54⤵
        Loads dropped DLL
        
        PID:2940
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:600
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        56⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        57⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        58⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        59⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        60⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2368
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        62⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        63⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        64⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        65⤵
        
        PID:764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        66⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        67⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        68⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        69⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        70⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        71⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        72⤵
        Loads dropped DLL
        
        PID:2640
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        73⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2888
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        74⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        75⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        76⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2880
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        77⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        78⤵
        Loads dropped DLL
        
        PID:904
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        79⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        80⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        81⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        82⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:1860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        83⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        84⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        85⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2792
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        86⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        87⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        88⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        89⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        90⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        91⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        92⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        93⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        94⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        95⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        96⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        97⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2992
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        98⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        99⤵
        Suspicious use of SetThreadContext
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        100⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1068
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        101⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        102⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        103⤵
        Suspicious use of SetThreadContext
        
        PID:2528
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        104⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        105⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        106⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2260
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        107⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        109⤵
        Suspicious use of SetThreadContext
        
        PID:2768
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        111⤵
        Suspicious use of SetThreadContext
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        112⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        113⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        114⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        115⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1108
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        116⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        117⤵
        Suspicious use of SetThreadContext
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        118⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2592
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        119⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        120⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        121⤵
        Suspicious use of SetThreadContext
        
        PID:1608
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        122⤵
        Drops file in Windows directory
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        123⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        124⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        125⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        126⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        127⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:824
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        128⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        129⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        130⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        131⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        132⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        133⤵
        Suspicious use of SetThreadContext
        
        PID:1632
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        134⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        135⤵
        Suspicious use of SetThreadContext
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        136⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        137⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        138⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        139⤵
        Suspicious use of SetThreadContext
        
        PID:2212
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        140⤵
        Drops file in Windows directory
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        141⤵
        Suspicious use of SetThreadContext
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        142⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2072
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        144⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        145⤵
        Suspicious use of SetThreadContext
        
        PID:1916
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        146⤵
        Drops file in Windows directory
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        147⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        148⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2644
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        149⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        150⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        151⤵
        Suspicious use of SetThreadContext
        
        PID:1600
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        152⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        153⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        154⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:1712
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        155⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        156⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        157⤵
        Suspicious use of SetThreadContext
        
        PID:1376
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        158⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        159⤵
        Suspicious use of SetThreadContext
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        160⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:1984
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        161⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        163⤵
        Suspicious use of SetThreadContext
        
        PID:788
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        165⤵
        Suspicious use of SetThreadContext
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        166⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        167⤵
        
        PID:668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        168⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        169⤵
        Suspicious use of SetThreadContext
        
        PID:1528
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        170⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        171⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        172⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2368
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        173⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        174⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        175⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:336
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        176⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        177⤵
        Suspicious use of SetThreadContext
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        178⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2528
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        179⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        180⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        181⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2756
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        182⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        183⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        184⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2748
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        185⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        186⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        187⤵
        Suspicious use of SetThreadContext
        
        PID:3040
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        188⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        189⤵
        Suspicious use of SetThreadContext
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        190⤵
        Modifies WinLogon for persistence
        
        PID:1108
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        191⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        192⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        195⤵
        Drops file in Windows directory
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        196⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:1960
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        198⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        199⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        200⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        201⤵
        Adds Run key to start application
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        202⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2600
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        203⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        204⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        205⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        206⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        207⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        208⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:772
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        209⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        210⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        211⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        213⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        214⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:1456
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        215⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        216⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        217⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        218⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        219⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        220⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2816
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        221⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        222⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        223⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        224⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        225⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        226⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:2156
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        227⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        228⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        229⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        230⤵
        Drops file in Windows directory
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        231⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        232⤵
        Modifies WinLogon for persistence
        
        PID:1708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        233⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        234⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        235⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        236⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        237⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        238⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2348
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        239⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        240⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        241⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1344
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        242⤵
        Drops file in Windows directory
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        243⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        244⤵
        Modifies WinLogon
        
        PID:1776
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        245⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        246⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        247⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        248⤵
        Drops file in Windows directory
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        249⤵
        Adds Run key to start application
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        250⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:1716
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        251⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        252⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        256⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        257⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        258⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        259⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        260⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        261⤵
        Drops file in Windows directory
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        262⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        263⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        264⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        265⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        266⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        267⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        268⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2104
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        269⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        270⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        271⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        272⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        273⤵
        Drops file in Windows directory
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        274⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:1096
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        275⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        276⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        277⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        278⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        279⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        280⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:1344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        281⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        282⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        283⤵
        Drops file in Windows directory
        
        PID:2524
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        284⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        285⤵
        Adds Run key to start application
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        286⤵
        Modifies WinLogon for persistence
        Drops file in Windows directory
        
        PID:3004
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        287⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        288⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        289⤵
        Drops file in Windows directory
        
        PID:2364
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        290⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        292⤵
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        293⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        294⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        295⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        296⤵
        Drops file in Windows directory
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        297⤵
        Adds Run key to start application
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        298⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2204
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        299⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        300⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        301⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        302⤵
        Drops file in Windows directory
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        303⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        304⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1600
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        305⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        306⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        308⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        309⤵
        Drops file in Windows directory
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        310⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        311⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        312⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        313⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        314⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        315⤵
        Drops file in Windows directory
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        316⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        317⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        318⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        319⤵
        Drops file in Windows directory
        
        PID:1064
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        320⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        321⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        322⤵
        Modifies WinLogon
        
        PID:980
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        323⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        324⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        325⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        326⤵
        Drops file in Windows directory
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        327⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        328⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1540
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        329⤵
        
        PID:992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        330⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        331⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        332⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        333⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        334⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        335⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        336⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        337⤵
        Drops file in Windows directory
        
        PID:2780
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        338⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        339⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        340⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:3036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        341⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        342⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        343⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        344⤵
        Drops file in Windows directory
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        345⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        346⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2424
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        347⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        348⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        349⤵
        Drops file in Windows directory
        
        PID:1004
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        350⤵
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        351⤵
        Adds Run key to start application
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        352⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2796
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        353⤵
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        354⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        355⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        356⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        357⤵
        Adds Run key to start application
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        358⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:1780
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        359⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        360⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        361⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        362⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        363⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        364⤵
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1208
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        365⤵
        
        PID:688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        366⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        367⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        368⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        369⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        370⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2352
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        371⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        372⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        373⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        374⤵
        Drops file in Windows directory
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        375⤵
        Adds Run key to start application
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        376⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2808
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        377⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        378⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        379⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        380⤵
        Drops file in Windows directory
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        381⤵
        System Location Discovery: System Language Discovery
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        382⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        383⤵
        
        PID:860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        384⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        385⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        386⤵
        Drops file in Windows directory
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        387⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        388⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        389⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        390⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        391⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        392⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        393⤵
        Adds Run key to start application
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        394⤵
        Modifies WinLogon
        
        PID:828
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        395⤵
        
        PID:824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        396⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        397⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        398⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        399⤵
        Adds Run key to start application
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        400⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2508
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        401⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        402⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        403⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        404⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        405⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        406⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        407⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        408⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        409⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        410⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        411⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        412⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:2756
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        413⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        414⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        415⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        416⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        417⤵
        Adds Run key to start application
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        418⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        419⤵
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        420⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        421⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        422⤵
        System Location Discovery: System Language Discovery
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        423⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        424⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:1348
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        425⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        426⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        427⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        428⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        429⤵
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        430⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        431⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        432⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        434⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        435⤵
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        436⤵
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2524
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        437⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        438⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        439⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        440⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        441⤵
        Adds Run key to start application
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        442⤵
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        443⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        444⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        445⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        446⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        447⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        448⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2304
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        449⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        450⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        451⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        453⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        454⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        455⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        456⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        457⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        458⤵
        Drops file in Windows directory
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        459⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        460⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
947b67b24363a94f7a75575762cb04f8

SHA1
ce96063f72442992cfbb90bc1fe2c2d20d363721

SHA256
29f44718dfffa1fa24c3da779557f63efc1922e389de96a68204af5cdf2719e7

SHA512
8c2d4b7f98b66f14dbdd9ce394e8ca960ac46d80e59b11df5e17c5d6ca5b210abf0027aeedf01dae2703335b346e26bc4b85535781c68f69f43b8ff1a21a11b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
e21bfc0ed63b607e87eb0a80171d868d

SHA1
9cf3c3d402ad16e576b88eb688e9b4b8d282e633

SHA256
19d2159afcb653296dcb7f822a83de786bb6a4f42cf385991ce58cc8488bb7b5

SHA512
52d09a3304ac53ffd0a7246a54a2039918236935778b0ee4f7da968f9a58025be8981cae929e2396c3f720ba1c2b3e2cfa86d7fa4bc4663ddc90805cb42d1c80

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
f3585a74ff35484564c0bb3c06231f92

SHA1
430ddd0d3609cc3c4b8145d166c87760f0cc7247

SHA256
4783ce837ffa55c0c91da1b0acbec1eef786ea7806bce847f2fb317f8747d72b

SHA512
2685e1fcea5a814d919ed2763e22a03124987d7869e0aadb3cd73ec07105a9cd01c76ca5465940f73635273a6acd6de8b3f02af3ebc4e5a710b5496316bacfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
6932af0f8393ca368be07380f6090fb1

SHA1
649edf55a1aa708439ca501de2a4b79e1d0919be

SHA256
bab88c11bc24dac9b4e2d94caa357f1adc0d7ef908b77603fe4ee79a499cb4f6

SHA512
3ef05491164e5ab1a3479a37958999173e524bff7a7e68dbe256505995854692bbfcd8c6b1b841557dd4d292f3c75835fee10d326950dd6afa866f45bea57d69

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
7c2264831e1846b7cd58df55f06f1fc1

SHA1
e423b52cf677b0272baabc232aef5f259b157c78

SHA256
61c168233bb94bd28e54231d2f54f3b85aed27a8cb355c1016767647b431db19

SHA512
0167760e27f5b2caaffa5e0bfb703dc8bae588842316916cf22da45dee4ea61c7c57d95bb218a3f8b33ea11312f8c139590ebab3407b7432b7f2bec6604d1340

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
33b732966f298509b16617dc7a6c3329

SHA1
76f990970e5763d99aa53a8d8351f9e64af90f68

SHA256
f093b010d929662723038fa12aeaa139fd2fb646c59f9c66909e6af98f561a0b

SHA512
13cc8ded8ccaedefec093377a2809ff6ed903c1e271c73e0900cb093fa3bcf0b7c478236c1d22340e76020d38156602998858858704991bbefaa5b1002ab20d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
e0f6013b299219e2f90aac3f8a26d457

SHA1
8cc8c2abc1da7ed922fb4f149040f210abca5a79

SHA256
e49b4abc15737ef570350853e4af2c6819906f0e2a263f8500c9666bd7f64616

SHA512
8677c2a80d08238b15249f6eedafd2ab63f0c797cf545091aaba3403efdca6dddbe1f630e9d2d8bd3fcb37b7cf6254138d9c10c8991eb2835d34fd6f898f91c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
23f8d33b5877cd7bd129d3e09a5a1189

SHA1
5bf3296e3b007f5357762451993e7cc7df39d736

SHA256
e1068bb124d0129607af8c4bcbeac3ecda29e6830d8de71cc95dae38174b345f

SHA512
8ec264ab2c6a118fd1bbe2fff3da6936ddd3ad564eb03a98bf836465d5d65975903ab64f5217b02febfe110dc06408b6cba0694bb59e95a1d423bf896a53e5b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
980f4675bada344ac02a122c02ba20c7

SHA1
711ac10b12baee6524e7814bd383d1534a0206fd

SHA256
42206dd174fe4fc1a1a0a2573cfe1e91f7494a8fcc046541699d9eb92f9e358d

SHA512
4ba17b19984c9647777d05d2a35ffe445af160e278a01ac05b2636e54c9f63467ae5a71f120bc3037effd08f6eaa91d199bff34b07588435f8a2da31611bcda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
03d608cc917542153e67be383b580a28

SHA1
f14e97712b6cf8b58e34106de4c40da86b78710a

SHA256
c7641a93554e98436e4eebf117022344e53f3bdb950bd1ba2f2acbecbb8866f0

SHA512
fa99987e648ebb55802ab21b15c6e68b7c236a7c4d98ad05435255387e676aac6bc3fe9246b9615965f3412e260ab42af77f52beb5c76defebe6bfc4c76038e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
29de6557dd17c9c490a7b6741f06b5e4

SHA1
4dfb11d90af5ee0564c48d8d9be4a8d6100d031f

SHA256
8869e93dd1eef0c3c07ab80ac55d547ffb06cefa79b389f31fadf77fe4f385c6

SHA512
a70df20b6175d77d946f2596262518b77535e60e881425c0126e191591c425a61695b2be8bc597aaba6caf4ff4a68a2c86151c12b1fe63ba4933d8305faa7343

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
b5a72ef072582be4d490051623bb71f8

SHA1
3d01c790730382eb66f8bd2702a3a1b248b6c13b

SHA256
1b6d77ee1a886508bfa48dc69c174a752f9082bb480adee045c217a46e9643a8

SHA512
a5d3c5321951360e99a53d31776a0a9320f13608208794405fa81569bc7f91eb909e898922212cb73ac957656362988d70e61a38efd3f0eaba9320cc5ce48da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
39907a53022898b2f28b259a2ac63566

SHA1
bc77061b28a669f17d515b1cf32089499e305914

SHA256
4b9fbe0fbe65ad3f1f314d0e127602d72d74ace701cf6102e4a53397d6eb0179

SHA512
c9560f9fe1fea7658d7d938582c9049451c4f5f28d54fe66e98999efdea7ff8487168db1b175c26c3b87f8732f5faa3447504df40b0eb074b604b31efabb2614

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
a69093b75eb9e4e965968017d43ebb1a

SHA1
f20776831a7055f575b21112e075c86e6d5017be

SHA256
55f1cc369df2d8aff5dc18676429592a272540a0a6d7bfdd8518ed5a5b4374b7

SHA512
83c643c0c46753c02a3d9952da2a73d83da41bb0614b63f20a75120d12acdb2d46744770fc62bedb20b0b00d8d0a0b73de34354c99b519932ca05570e5973777

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
8f4644a99ad0e070ac071ffe34e74412

SHA1
56cf91063d7e5d8b72069d77bfa98d1dfd0cf009

SHA256
144ad4833574ff6150c6c1ab1aad3f9e8bb03d562fa8cb3da6e871725bd0a81c

SHA512
b0d399b52383ea722a71df0101f64d76f2d254855d22037283e648aa64460e710c06e746c52d2a31aacc75a20e7e4c2255ee3c385533c0c815caee34b50be9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
e988e67666068b17c8bdd675b51a2dd8

SHA1
b8f3bd298462838a0ee1fd3d6e60d8afcfd5f30e

SHA256
ca2545aa684583212f8487ed2c2bf7b1c222ef6f5587ec8f4e18e377d928ce2d

SHA512
e7a644a7a3152a060b91a76b3dcef8c5334f047aff691a3350e9c447fdb87d359d6a8351c59b04cf5d3a4f92c650028e07800ea069c3d56dd52d08b637561791

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
710c5faaa46dce723704af1e838df0ce

SHA1
8987b8c9b7f122b42a0e96ed5af72d4c32d15320

SHA256
9d8ff1e782b3755cad275e798f8bb261de251e7dd9ee1702cbc9e35fd3090d99

SHA512
824db7e186ace5c4489cfba0c8d57bcce13ebd1983a0959f48e498e437301e51c329106ea0377d1e4c7ca4b45896f85c6dccef196062b47d0e7ed64d7447c35a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
e90067ce22d9a9d06a687319ff10f680

SHA1
ca4dc732fc7f5a02c315f6e60c535d934eef0fd8

SHA256
9189ebf249db5ae4a825ee974b6043402e8bcde36ca47c37dc366550f8594bf1

SHA512
8a6e10766e67bc7ba9c50d96a7ad6ee003c26f7abdf915a99192ceb10b0768630baf226ab1bbac8b48bcc49a78c5b34332f1d65e914f3c13fc13e73e9d76afec

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
2ccd90b33952c6368fdd222d85eda12e

SHA1
a92fbd42bca3a1740fcdfcc4f59ece2044e15e62

SHA256
c9dc37ff360a0d0d7f2e9610bf3eaced580a64587ab70ff7cb2730e6bea899ba

SHA512
0bc9194692beebac4924463ec34d56c4f4b15a0db112449cd04dc03d927e51dd53e880b11291a01800c024a5a8aaa54dbb6fbf73ebac7762bd8904c875b2ef92

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
1fad1910d4caf0293797a792a4f83958

SHA1
d90d3ec784a58ffe3b03485c0768b02cec7df6f5

SHA256
13b645dc5719fef41742efd6d6345988588b55f10e5dac4a758b8c94ca87fa72

SHA512
dfcdfffa95e30827ad087830a1045474f0ddeb0ef472f89b39fd81febf5d6b84a1ee5fef46e61c63a7b445fd0e51d0ed919aa761d6bd7c23cafe0bdeec989cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
99e63a42e1ae171b7f5c37232263116b

SHA1
493b54665bfe08c207755838dd332753c32c553c

SHA256
f886d1efd9cdb968c9a687c0ab3ce794e876bb4d908e388383b84a5e0dba2970

SHA512
9eb37993e635eaebbf4606fdadd29d92f5ae739a115b275ba26e7036e0c3ca4c911818bcff10d196b731dea250e428be0a88f1da3588f662ca5dc640a4324eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
3772e52d2e9079296ed99bc54620e3c6

SHA1
bf3aa4f29e8db4931fa580afafe7d5cef14bb639

SHA256
15b0633bc249716bd78193f406a71bf9f0cb88d27a28b0370c67e6ac7efa1c42

SHA512
7245d64d9e7a5329548562a7cd811aa62cdf757c9c09e1aa2cc916ae966f16ce7c962e6e54711ca18e9a1c3cec45fa3eb7eaf325f5b9857a561fb6abad103685

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
9caf7d8502163a141487a3a99390178e

SHA1
745bbcb9f9245386ca3f55c8edbfa874686459f3

SHA256
50eb375c498b8f8cab73cf5da6979e9d8ab24ce658d849f91ee247c8e35383cd

SHA512
dbef1b038529a781e3e152ac4bf431e2914891cd73c416fab957d5369283f3e8efea555f2f52ea507d597dda2fa22dd3f5834524860df4a92885b7882c29e337

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
80292a7153a97bd0530bfea23aaa0520

SHA1
5a21ef3b097c415d78d56d41a23a10e33464ffc7

SHA256
646295763ee150f21e49019ba59847764f7f5463df848251fe9c9600fd72bd7a

SHA512
bfdc184dfa47de81738cd575ac2cb3420ebbaf765a3d6167a721d03309a5046a0d304346aa0bf4989dbc2c5f96fc3a1d71528f49b928d3f220754dc6cc269cd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
3fde74828c4b2a015cdd71a0c4c3af30

SHA1
1a5183a281e43159948ce0d0c0b16723ef231db4

SHA256
dee0e705eda4636a762de38f6534aa6e8dde9b9d5dba7fa160352458b43f4ebf

SHA512
662661ac898d7057230cd0460828dabd497288b9a64be1e49440428ab45e3ae28aacf739f6996a148a4b85c9c50c142ba301aaae90d9087f1c0293dc68eaabf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
6e5123a7c6a4f3d0ab17197fa8d22a09

SHA1
20931454677d9772e31c33bd4ac51a2d0138c7fa

SHA256
660e12e07cbe7df3a82fdd10ff4664f530c717df2018c410a7d2d1f7003e45b5

SHA512
02deedfda5448a06146ea7c091e2f0d66192b2b73b06510bfa757814e83000f53be563fe0e4139f7b6ca29b0fb6c0b2279bc4144eda906c3502ad344a8637617

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
6de8a7de8befa9d49682af39daf8089e

SHA1
fe9212869ea5e835478f89efd16b4f9ad3fc5d3a

SHA256
900e6f5029968faca532c3b8aa5e8cefe3c53feb6d6356b668c62358beab8f69

SHA512
c179a212b35e5f52583a1404d5ed3c1330e0c181a11c6811aad08e59a2f7384f64e43d0873e8455c50a9198231c006fdfb081e5e11289262e016153d8de33be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
bee349cb4c0b46cad58dc49b0aa8bba1

SHA1
69d8ea0e8466c536407fe0edab659ce5e9742f86

SHA256
4df107fd95ec9d6922eaf2ab86ef3f7889585851d2053bb5dd9a5a8c6b9bdd89

SHA512
449605a86cae5d1b9ddd2c53b8d971976b9c5e6bdcdd125a350d0f9b998d2d2066694067475197ccab2501cfcf1a7a4de49d60b43c23504a051ebe2e3e41cf41

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
bc18b3136eeedfeb7890fda8beb2e9bb

SHA1
ddbe4710faa03a443516ad2e0c79c822ba9e1c00

SHA256
97f0c003e5301af1d669ecd7d9ec4f1b3e04630de31b955bb6658cbad7de208d

SHA512
9711f5e4c496080eed845e41c6c334496e1effcd33a8c46f124cf50123937de59e737d68069f7daa358b1b5182b2bb4f593bc58de907c49828f96f05d49bb258

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
eb85de1f2b870c8354e63e2f7e12a214

SHA1
fa2b3cf174bc59ae13f04cc847341faed2c69aa8

SHA256
273e48b39e93cb7ab9051740766c91a96c14565a20329a6de17d3e27c3305743

SHA512
282bebd4002e5de98db05066a89e3053fb99985306f68c10726d6352d1fba84ceb5d2c01c059882c1d594537f6dc872710a43c9672787376b6e6ec347881664a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
0dde6aa1cec53d03e0139a52d1a83bfd

SHA1
36497c52fe922ffd0674e3dca0f0a9a098bfebad

SHA256
15a0dd2f8b91af6b6196392c5bb4b640cfaddd37be237a3256555bdbc1d39fec

SHA512
5ba687e145a5e851821f92a4ab869534695d8d0a83b6d8c9ee8793a2169785ffd91a53811cb167121a589aad6270e57f9a94d8a068d5dcf74254e1304269bc98

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
344bfdc31783f522c42f661bcf232f4c

SHA1
2f16d4a44a4d4296a63ed06e0909367d059eb38a

SHA256
48a0281eefa83fab187c9852a8a475a32c5c3a80f7375f306a43a01b09356822

SHA512
88863f0222510c1b0d758dde61d0e54e38c028c6912343f81d6f82facb53f4e1fa1f4ecf6292cedb9f110971bf8949a2a114f41129e54e955a1d4f7f56afc773

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
c840b4e02cf0129a18801c6bdc246a70

SHA1
81fb4824eab07b1d98ff7e71857e22dd0d8d088b

SHA256
37c6feb337f854c0d3039fe0c887f8a65c9b2b3756193cafa72adf2ad702da83

SHA512
d6c7b1535ccf8d3aea01cfb2a0a1b27e3a265db132586e1b7f2eb6f7ce323d185ae0abd9424508ead3b912ad02b092c28f63e905906617cb85e6addcf0a08000

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
266414e2bcf257b40a6955ab4ac4cfde

SHA1
17d66277bbf6843ddd9519d9baad1451ab26a72b

SHA256
0017da9d9948dc435f853ae210e21e76c192527be1c69cc3954b417fe5e90229

SHA512
9675aebf71d6ac72c8b5226fc5544fc396af77a41409da99aa04678f79f4b466701c5952c0f6891d55b4c7b945432d86232d463e5ad6d00d33117674ced9a8e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
906726542437015c6819c30715cb1ef6

SHA1
70ff33beda3b73345b1edb1b92ded70d427ed9e6

SHA256
1faddc507193475969be5d71a963f8923323b1bf549e5fb6146188f891e2acca

SHA512
ee3c44c26fa9d1e89cb123395f88b947a3ec1808439af64f44d902d778bdc34342df769d41a5696836e892c35828f85a85088bb6085e0200bebe746cdfc66d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
dfdb6a88cf4d50e9b6ad4318f09e692f

SHA1
f14ffff3b966a569fb6e60768a3698e26c854934

SHA256
4406d5616742e0c8b5b79b0c4df7a90fba74d459e90868bf91da06b9d1485afc

SHA512
e058d07da9ce93d492c4123769a4c56ff82f5b272bc54c2d71d4647a1c051fe2477d2c09ec62adaecb8e7282c63ee07c3a525df7dded459f07de9d4369c52429

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
00853212f7454c786b545419cb451a29

SHA1
21550c1ba5a83edc5566b55ae9f99f764a32edd1

SHA256
b8755df30eb1f8a389cf71cf811a6c72e373acd51b37f000e08ba3b56e30ff1f

SHA512
46968458fa6f864173dcc1e426fad5d008091a074f2651b0c687c79f53c55f2d195cfe091b71f1fb91e2de3decf7ea9dd6ce3371791f07b913e5104375e8bcdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
d519e74856fc9d79ffc9eb31834ffa11

SHA1
a3308bde1d9e8025b314ad28cfb678371da96116

SHA256
597d21718f2dfefb216c443263536e0742b8ca85aad896831f0fa5fdb20f2f07

SHA512
116643b5fd6de11ba880215974f4f03e5f75630970c1d31f10136993fea7006609ebc200635ac176978e023e69d9be165d6063ff9fbc966405650d4db1c241fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
e85af2c2bc90e27cb92aebd4e1c9c033

SHA1
c872d37873de9194b57a874d0ddfc47ef5ea040d

SHA256
f416727b4ae8c4482be95908bbd0c8a3aa805c0e69d89bb71a0dbf11dbe30ed4

SHA512
7fc0c60e23676eb1086a32669c42f722202e720ed102fe5806ca3f938b9513a24645a6f794208386bd1cfd506a5c1f28228974cffe0bf40316a35a458b1d9143

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
998b5e465bf52b2bcb6ddc2329b2260e

SHA1
8fddd23fb6e07d9ba6644fb9814d0fe5ad72de2d

SHA256
8fb3a4f43c79a5c4a3860224f11a9279b12e5608ab811ce20f4eabf6eaeac964

SHA512
e3320b7185891f3f4500806e0ad497d2366d74a3d0301a2699f1e0ef09c05934ced1969621c938469be368f57d991166b3fcc9ff7993ef710dda9fdbf934edca

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
7e52a792fcde93ce1c7dab990f0cdf9e

SHA1
ec69a83fe183e6f4369cd80481868c2841d99fd0

SHA256
626d499007518d07a9f3035aaaf638fa92e22617a26a33547e8e184506b8478e

SHA512
fc978294b24aeeb81c622dc69c3deceaa10f9c85ff0c92220493d46e8ad9d6f19f1c58a720e56359b2e45b883618f1775d893d835e9d28d21691f5f96ea584c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
c4746e54288c5d1d7f24b2e2b978d300

SHA1
49fbefd729599c570d9e098d7b0cf3f53bf1ce88

SHA256
92355aff466ea55d905e41cb5ca8882f628256dd063994d68d96a340f3135fc5

SHA512
126726cd34a73db214db51ea0759b7822cb429d79e7005d36937370aa7ef8c188ecfd881e6b385c97c3ac7e5ac9b878d597fc059766de15b66305574fab88e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
ff79a437e2a66df52d5794aa513ab7f0

SHA1
543f85989323d5675cb6c8308f99e259aedbca29

SHA256
4ae547380e6f6b766df71883c85be7e3d60ad82b2c506db23eb4cbb39d17e1f4

SHA512
b8b234ff15510d23a158ff3de8cc79a0f07bbc120b7e111a2759e133782f5cc498bfdc09141a6a0fbb6f37726191c611f43319c6ece29a62ed181a7611f01b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
d58ffa44ec9625fe9544837dffa9d634

SHA1
a18695ed9af7d351e3e2ed5f0863d3fe32b47856

SHA256
7f1e46c5710a60f91e817fa69619dbe207a58220f36173554aba65366d41f374

SHA512
9851d5deb5313bf8d28115dfff0ab325ff1cf45563e3ed210beef96e36fb2ef1ca4257ac0098d9012d040b6eb8355fca15f3c43a7bd4385fb980814e62ebaa23

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
90f147ba7a01104f37f9e5550439b299

SHA1
711ed8b84b44b0aee1623422eab69adad400e0bc

SHA256
37a0992dcb1ae2658eb39add774b80cdf6707481ae63698eea78da096fdd8192

SHA512
2c7c5501add86b9b38e1cd40d56f0def32d90a1a73071334b0f2d262cef9254aec3631b4d4eb1facc11ac0b969ec98dcc2e8aa3be7d16392fc4804508f8d13aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
a516c9bfe14c059203fbd00e58393582

SHA1
76e00b7bf04c06e3fcf8d418cf297d67d6155963

SHA256
8cbde36fa6f2d0bb4fab4f135612f246e38aa08c4e7ca4c37cdc009208671838

SHA512
c84b01fd57f85c69efbcd652e846a7a03c7bf2c6f50c424e5aa4c28234ad47b9894fa87272f70d04f659531ab99904fd9c9addfd7a65bd3f15bf9cce1ebf29ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
16537eff9521bed1cdc020669aa42bfe

SHA1
8a2e41ea3b0a3dec02e0bd7b06b0113f1c6abd0e

SHA256
68b4a178e8301804692b81bb185708f69601ddd6a0609584d672509fe46e7dca

SHA512
92c18bb035e940083a07a14eb126feab3e50b00188c5f01bceb6e3b8503510c6e6ee0fd3fba022f4787345f6086ada7d0e92c86a51b02fa7843c899ee0edaaf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
23b19b130693203706c2514cdf256c71

SHA1
0b0563349a2a6155a95869f669b362eb5ce86b80

SHA256
3b9ea3aeab2c9317c9b270508759ab19e2b4edd05f30a5803e7ac692d58bf9bc

SHA512
c04d46e07e6cfb1a0ba0324a230944d181f21bc9b78e7a61561b8a08ce84b2e8b1727a53a358ca2c043a963ec42418bf6f99b51ccd9043e745c11d9cc700a497

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
f392d8d4498b5b99ff078b188c9a9ad0

SHA1
84561d14d66bd59bed79683aa79652b9b9d45247

SHA256
b681efcca164561f9972dadaac7a4f31d5d864b6cc3cea61dcfc2c9ab7ab0f09

SHA512
bb51a4fbad091fae66bd630d2372dc1a9575ad6fb1d3e72799d3bb392b403959a72dde1effd4fd1db29d28088eb10912cd4373e1307c034c38758d83ac16e3b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
8d44cc612fd4a9b48f97c7d42d2e7f12

SHA1
2568eef0e6667abd6a7b7941d26d273c12c1065c

SHA256
a73e5b96bc8714a7c702b6beee338de297144c44d2d2c24e26d1a175785551f7

SHA512
e65a23de71926cb1ca8e9c46e932c12437037bdc51253b2ca808c1bfb6946af319e7a68cd281ce57414cb57bf130f6d9fdf2dd02c3c7ea438869c35717af5f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
9e3c605f4da6fe813ddd7093ebf377f9

SHA1
eb6b5b9de19ff28e9d00d9d8f9c57eb75c5faf49

SHA256
d560220682aa110deb887769ef8e315304859d5c339799f60479f9a9aa2e7ac5

SHA512
d81d4cfd69134d2df5064f39ae6b3a9ae083b01a49f8a05080a48c87d92b2d63038451be4265e668a174b9713da9e27830b88ba816332a630b18f801a6733108

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
ae43921c48413ef570cd8d5886466101

SHA1
23c8d78836b05ffd6d8b536fe8d82a9ac5f02d93

SHA256
c0e31f21bc4b79e3ef30bd3b5a2745c7e500c8f9211baf9709df8cae4aae01d4

SHA512
d3109a5746823aa624d2a95c42a1a0fca5b1e742b58601d0abd156ca52febe7e2ec336df523394eb6f2c7c5a5c5e4e7d046e6f6b45ad0d8c515b9f1f3571ac38

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
7bac4b34df7f936312d00c78e737decf

SHA1
3da6d5cce88833b0ea210ace7ed50bf618401475

SHA256
7b9e51ff0037a86fea0ec1ac1b0257ba8b8bca39a0d08d59e5fa37689a3ba08b

SHA512
e107e4bcfefc7bc9783383133b12c13a6059560720c6be31292173937637e5040094c7721986eb839634d253906497d01c57a21c4d107da412b01cec9ac752cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
c72bf3e9a0c625d69c304dd51c3abacd

SHA1
8d1adf74d09b217d7c4074d592ffd670a9986a2f

SHA256
745fd72720f2a55d7f918173c18c58b34933833e070b288fdf3c91f8f1420d09

SHA512
708a75295a456c907d593ae062ab838f376904fed86e140dd390abbd00fad9fd2126eacbb77a7889e043b6e91bd46324c40c6f126f27f4711327714933fa16ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
11727b9ded7b6508fd782f5069094607

SHA1
f06c1739717577c03b8cb9dd9d7ebbed4952bea8

SHA256
fd1360b0add99d157a153bd1f7411cad0e286833365db7425a6907e1ee7e65bf

SHA512
41a687747ef884be39b39770d9561a7deb94a875454ac1f8fcf49967f8153c27b766a3adce754380d0ca6c6b7a7542c680959d63aaec22ea32a018d717da1e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
b88750fbe837eb7a6700397289e487f2

SHA1
2b4466dcd89c6bfbe431bff6cf07351530e45e10

SHA256
c7a8a2ffe9c10d2d0bc9e5c6eb974657e5101b263e8e5aa63702b3da91188d79

SHA512
a2b7c7d66ce3e88aeeea3f09ac9f1724e0b02e92259843aa7f63a94353fa21f6ee237cd58344171dc7fc3155cc8020eb73617c5d10bf6ba235039d3e801bca87

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
53eb7b2ba7b65891862dd24b4b06d004

SHA1
151b453afb2ef0178db109b19694ff1e684ba709

SHA256
a35b17194c96b90208a099c7289b2eb6e0d0dc3a266d6579a362c6564affdd3c

SHA512
03fd789969435012cd196442eccd32d3d3bf8827a1401bfcd59b7adb91c83cb76a40985e90f92eb6e3f6cb047d81d56e5b7bed0d65ff80c0bfd4ccfe94871467

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
1a2a1e8d9f1b66477d49ec3d208cd5a9

SHA1
2508b7882e053eab50b5e1f267603052b9b52e57

SHA256
eca22e84229adff9cb575bdc05f7a2051afd1ce35c56a929e743835e347ef451

SHA512
812127d6939828856fef69ec2b354313d800cc4f3553a5be50ca7aeb05a0e561d07fc9393a151401851c6d24dde1c8aa44fb1bf4f00a9716ef2652148976e28a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
ba349f4db11b361f82ca59f90c6aacd8

SHA1
9564e80c9e4ff7f7a6ba3ec1d9e40f74400de5d2

SHA256
898851bc246f9d76e09c10d13580fa4d647f81178375a580a65adb29cd577db1

SHA512
0ea3ea25864e73447eca6d7948685613e511fd18098e36f5cdc193d6d9b30f0a715e22df3b9e969e6ab98eeb75f0b4de0b469601159006ac8730faa6f161b88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
bfac4a84fc3a0aa9bccb91ce4907cad9

SHA1
e52e958500cedd31446cb4799dfcf2d93c4e8698

SHA256
16a65e11d0833eaf1d249737a5b230e9efaeaa1592aa0964a2c57c552de0bbc9

SHA512
c003af3dc3899b2f183c683b89acdfacf0ed924e950d9ec0dfca2105fa1f5e8804254c8a7f8dafd33b234a99c66b24beea75bb055c4892ad3db0d96b10db0c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
5270c84e25fc0811a7de98d6f5b20368

SHA1
d979c0533950572b2220e600532052ed25c09277

SHA256
02f8e3dc2f3b365b2d9396538031a837f198c08ff29864519c05a73c9a4345d7

SHA512
b7ea77f78ac2cf9f4ae0feaffa756551913488b1f7c542a67f6f0e144d8e161317ac7f537b55da8680f57f73a2bf461d8263134ebbca60b54908756bf23f8194

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
13f9733431c9e7d32ae4ac567a29b868

SHA1
39bf8908be70dd3ad957b07f0cb89368fb6eafa4

SHA256
b604262d541bb41aeef704f36c61dd21cddbe6de79ef01146639bd81ddc1144d

SHA512
5827eb805ac3d587fd4a7bac01f972bc544ffdb33781b81079de6ac7f441d6ea1bfa5309f635689aaf5bdc1966b9828db0c7287c9bf9a9dd7dfa22e270007ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
3c555ab0401537fcfd72b71e2ca8bf0a

SHA1
5569d3d80984e5a48a7b52c7aad20ef3b347c44d

SHA256
2b36f0acdcc7c55731c0e906b3b06c805d8ccfd066cb9240ddc0071bb36dd9fd

SHA512
9ec56bf1e41f180051206bcb628c471969936c41836da11697a569e5710932f057fb38c4f556135e82c1d314f58e6bb3043945eb08883037a2be7dec4f4840cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
36f9378f716b5456e198d62f6addd15b

SHA1
a8d9795a271eb4b569546fc151c0e6d6a958fd94

SHA256
611c62a7c9cefeae683b9cc5756569743049b6a42a2ef8249a0b4102d42c5edf

SHA512
32e6aaff635862f0dae158aa6fa7ebd8982bcbca900c31916e3b1a5edadf43a7cf3bcfd4fbf72b70e512ef32e1fbc50661c1974b859d9617586272ffda3148d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
c874e01a3d7241ed28e601fb41e6c94d

SHA1
5a5c3757f9618681bf3f1b7adbbffd771cdad5aa

SHA256
3a55bb93b739bf6c812f77af58c395ec588980b356dfba9e746b6a6b91e49f0a

SHA512
a853adfdb3056c9a515902b5d4fb16a4ea8ed4f5f20e247bed31ac8a8e18dfb3f0d69212914cedf6743452954c77266ece0bcac16ef64a07637e2126eb2a41c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
ba9d90931f7e37eeaade381a2291d66d

SHA1
b02f9ad280a7d0702f39a428c5685a916436c897

SHA256
ac64bfceee2e069b2564a3de5447aad672b09027ac4978c20f4ed09910ce6b5d

SHA512
57f06d18ec0130864a5fbc66111e7bdbcab5ea683c4f8ef020db43248963a941e0e3a25848cd2c613e9c9ee76f71bc73e5a39a518857cb6fd8aa0c307fbcb63a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
8a6d7ca31d7731584fbc9cad90f8d6aa

SHA1
487ff41ca6395693ed42be70b241e1d8d4238a61

SHA256
a152022c0ee83a719647bf9e3919f923e466aa4d2bc163ee7c83d5e236a77c95

SHA512
0ecf4d1f79e8c3cf903af491a780a71a442bf9c6f89f69dd1914e538ab0cb37940d5d8997523a53faf911ce61824d24a804aa454d9066a9f2061246ae40aa4e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
3d73f20ed197589dc9082651c2e5316b

SHA1
a9906f221ef20e5a1cc02ed184c5f6345722673d

SHA256
d08d38a13ba5b2c44df720ffb3b6175db27ca90266fc7afffa1be15449cf30d5

SHA512
18fbd9254f6714dcdbad09b61d1a22807f5e10cb297d62180ecfdf4949b457ebab626dc796ba130958f05df45a8bd7e719ad67b9f9c93f042f7c1f306aa5a455

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
4112be8ba9288946bb261fdb6231f836

SHA1
cff068897ee3e642556e7fa666c7c9043829f1c2

SHA256
47fcf54f02c53ead050869b3aaef28739aa70987ff5f9f3e11cec91f6accd8d3

SHA512
d1b4b104b8e3c83ada2d23e1c096faa0c13d1c832ba1924f2227f480671ea841c344d729c70d886f3c3ea478f33b0a048f972d48fc79f42f571fd9909cd44f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
40fcb26366d8a0e9cf109ff67fcfdf98

SHA1
bf885e816502431c56a48b11b9a3d2ab91da56cd

SHA256
1fd764e59257ac03b32683c55791e62b44d575fb8f805542c67792f0bb2734e2

SHA512
89db5ebf98160327a82abe26acf988fa653e6d3706c45f521158ca4a8bcb7692e82277e4972b1f62008f7430220d0bcefe64bb9cae5fce6ac8f58c410df4f631

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
ef8f14b226c797cb777edb2e0dd797ee

SHA1
f6c97beb2916251c86f284d87cca33cea75d0be9

SHA256
2b8e46afc6dc9a3fcba922f306a30799802f6c411b88318760208b47dbd8ae26

SHA512
92fdc5da8c896aae0bd51ab7131d8775d04ee8b85706901530f974798a768612d218e21e302f5d00a6a31a00ee03131b8ef0fe8c96ea5a3db7601931838b3ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
3fe818680052d5a82b06e7ebbdf50e8b

SHA1
f463464c49fc6af350b3c6a691ae4c41ec25a2d0

SHA256
cc02044a0a087b03e8312be2419d3274c33c6a1e4b70f2553ab7b5a5e77a9661

SHA512
5473a875173167f3a637b92e6a9546fe76965c6c11b550ba01a93b98cd2e2874ddff3648a589d50af4856974576522c0585524e996d01485b8c9762518f4c2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
6311e101f661c3c93d8fdb9379ad6e86

SHA1
ea2f9e3d8ac28a95b142dadade25522dd45f8892

SHA256
f17a206c63dee3288c97a690882876f286d3f542f5bf76b4ce4ea7f27b7d03f4

SHA512
0f6006a49b3639650b08b22ef7ea965b85d699fb7ec35ae11ec975570f7936f2a1005e315ea4bdf353176df93c7bf1afefe9c9c934fcbfa908442d9338b8191b

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
536B

MD5
b4118bddcc9fe0ae73396b2b1b58c970

SHA1
23afa06fa78bbcc9c11e8549681fd4956f9d6c45

SHA256
e5d5005f7c9fdada426273f14e2ebe328b84f9161e80acc1396dadbe9897e98f

SHA512
fdc29fb8fafb990e52487b9ec22140dcbc8c684efa53da41e348584c623fff1a7ce1a9b3deaccdb25867479b393d52d199c8f09cb365e6c84e5980f6d4285b67

Download Submit
C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
f72ae27fb75e1c48f31496a84d5432b8

SHA1
ee77a08828a2c276e74512f8b7beaf374b174f99

SHA256
fe3efb27f9c0e2846107ab60b94bd1b6ba1febe8bcefc38693abdd22df68dd60

SHA512
87fb9a691cc0125e274cb1baccff36a92e0f36b6dec290141a69fce92db0bffd296823712dbbc1eea5b70b1b564ecda52bf2b62e5431bec9e68f0554339a7139

Download Submit
\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
7cb0f128bff72b1cde5c3b2a614cc1c2

SHA1
2f3638ad63a9b09f29b128a34199c88b01235aa5

SHA256
ae4f5fc9d6a36c38f04327a7512cbfccfddbb2cbe54c42dac18e9db9c750d8ba

SHA512
07dd44c4ad119c4cdc513eebbf2eca036751e5743078311f22b3d9cf2c7ce1e8879a4a59510e472fc5d12485a047d51665933252e2f98ba505a6fdfb32a47765

Download Submit
\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
631bee4b72a76627d4b2d47ed7363447

SHA1
9b12810763e713ba6f63ed20c89a75d3fa37d0c9

SHA256
d3b91c1b78ddb4a121c8351d0602c23f023cfe592fce6826beeb0dadf8fe4dc3

SHA512
6908d73873014ae3bb439caaea8bef8111d4162c650c331fa9998a6f33692f69a6bff494d4b26bce0f8171ccf42e238fd9367ab2f77e5c067df1a923026639bb

Download Submit
\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
6fd30761d4ad89e5c06a478d3950517e

SHA1
d9bd246c4a097bfd4bd923b358a4b801ce3ece6b

SHA256
1bb67c1439218dd25115add510d84eb92d8d96491349ff48a427d17d0d2f8d74

SHA512
f1d7b3ebc1bd5d3811e08befed99a3836ed6bddc0a9303dbfcdb1d0b148e766dc53bf3c726a7011a8d5b1d032663185a8dec86e11de7c25692ffb331401b4260

Download Submit
memory/552-197-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/552-205-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/552-199-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/1156-280-0x00000000024C0000-0x00000000024C6000-memory.dmp

Filesize
24KB

Download
memory/1156-286-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1156-278-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1628-120-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1628-122-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1628-128-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1804-85-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1804-79-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/1804-77-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1916-232-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1916-226-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/1916-224-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2012-334-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2012-340-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2012-332-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2016-163-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2016-165-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2016-171-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2132-12-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2132-4-0x0000000077181000-0x0000000077282000-memory.dmp

Filesize
1.0MB

Download
memory/2132-5-0x0000000077180000-0x0000000077329000-memory.dmp

Filesize
1.7MB

Download
memory/2132-2-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2132-13-0x0000000077370000-0x0000000077446000-memory.dmp

Filesize
856KB

Download
memory/2240-14-0x0000000077180000-0x0000000077329000-memory.dmp

Filesize
1.7MB

Download
memory/2464-305-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2464-313-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2696-359-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2696-367-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2696-361-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2708-388-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2708-394-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2708-386-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2728-259-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2728-253-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2728-251-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2764-42-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2764-34-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2764-36-0x00000000008C0000-0x00000000008C6000-memory.dmp

Filesize
24KB

Download
memory/2880-413-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2880-415-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads