remcos | af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82

Analysis

max time kernel
149s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
24-04-2021 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53d1fe3209497d194e38201deb835924.exe
Size

2.1MB
MD5

53d1fe3209497d194e38201deb835924
SHA1

43f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256

af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512

a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

fieldsdegreenf.duckdns.org:6553

aaeeerbbbeee.duckdns.org:6553

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

remcos.exeremcos.exe

pid process

2140 remcos.exe
2868 remcos.exe

pid	process
2140	remcos.exe
2868	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

53d1fe3209497d194e38201deb835924.exeremcos.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	53d1fe3209497d194e38201deb835924.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	53d1fe3209497d194e38201deb835924.exe

Suspicious use of SetThreadContext 9 IoCs

Processes:

53d1fe3209497d194e38201deb835924.exeremcos.exeremcos.exe

description	pid	process	target process
PID 3992 set thread context of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 2140 set thread context of 2868	2140	remcos.exe	remcos.exe
PID 2868 set thread context of 2504	2868	remcos.exe	svchost.exe
PID 2868 set thread context of 4136	2868	remcos.exe	svchost.exe
PID 2868 set thread context of 4968	2868	remcos.exe	svchost.exe
PID 2868 set thread context of 4384	2868	remcos.exe	svchost.exe
PID 2868 set thread context of 5624	2868	remcos.exe	svchost.exe
PID 2868 set thread context of 6056	2868	remcos.exe	svchost.exe
PID 2868 set thread context of 3940	2868	remcos.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f7dcfebedc38d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 74748097dc38d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\docs.microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\docs.microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b27000000000200000000001066000000010000200000009d256ae226f021755f9e36c3a0adbadd7db35660335e14df05797e0c15642ee6000000000e80000000020000200000000ccb8d00a141fd12e003469f512746c541fd92a1c86b728198526481c23a3ac120000000931ad1e1cca56e098ee10bb677bd98ab7edb9669db48db7f8ebcadd616d243584000000041b8e002660d314e7c5f27b5f1bdac80c3ca45a0ca8861dbd0fa778a4773f90cae8cdded1a506bfac8b08bb49954b53e90e449c9a4acfeb7612b2b7182019c27	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\docs.microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000bc95d6795e3dacc36bf09584cd9fce8587fab687acf3b99ad054327586d9ddc7000000000e800000000200002000000076fd45d9af0d2eb704bcc19d87da4e79bb60ac314dc6e64018151a08ed8e69644002000098574a74e121dd1217536173788dba2bea5eba8919f2d421d08e299c19c89d149b9dc410db8a6c33261f3e08dcc6ebb4c51de0a51f8cc9d40be502c971c403754420b96b2192d20a0438a4fa1ccbea7091c5e299d556a6ca692680f92092f00fb5a3d5fe2dbaf57d44413823ae1db5ee97523d1e4379def7b339a10eab32d79c129b5d22ff062af32a6c4c318f6d715c8ba6428ca9fa6a61d71f8ce1aa70c1b4e2fe2d4df577c06d0e74f33a0b89acd74cdbfe011dfd4afa58a1965f542f255277effd26931d0b060c806be5c5ff919de76105f0fff5cf150230f09f8d4977e8d695a7723521015a2aafd36d3dec7bead5d44a4cb450040ccac53e0f5e2b5b8f50fa2249fac05cb4099f427552c7b5c22e6389fa0b78a36cf5a60ba8733153bfb6bcba1a24e49bf8c020f6155ddd5e8009762386899858851d4d9ace093d879717b787cb640628335bee41124553c4006e15e9257f3de095bdc4971824ab13d1e66604cd5041c003ef322d38e6e485f16df5e6c2d1ac47e6c5fd72962a068ea876f38be34236ec7905abc9ac25812de63a79710b6f2ae5032584b4c45f6de303cbb92de41dfb39dca559ebb08827e3a11c8188eb4e8bd525403390b32ffc9b5c641ecba8b0074aa657f1d05904c6f714c3d09847c139b267e436efc06fd84d029b3a391ca40338919fad710379ff99b6f3f901dc720ef77c8616bbee85e33d8b7ed2750df7ef9373f34bf9a5fa8670d9322cbe163ffbab5206a91a920c47d396e09d240153c3bccb1c3846f1e5ccc2daa21b4787910160c9cd11bc86498751b040000000bf8938f091972c42622c597e7bb15cc2d9489354171a097f59331faee1978c20b29432d9e42319d4b6498873816197c78a9cfeffff74c4b3c7d241fe1c8a39c2	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = be0583b7dc38d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 841d7c9ddc38d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34ABEE	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\docs.microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

remcos.exe

pid process

2868 remcos.exe

pid	process
2868	remcos.exe

Suspicious behavior: MapViewOfSection 24 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2212	MicrosoftEdge.exe
Token: SeDebugPrivilege	2212	MicrosoftEdge.exe
Token: SeDebugPrivilege	2212	MicrosoftEdge.exe
Token: SeDebugPrivilege	2212	MicrosoftEdge.exe
Token: SeDebugPrivilege	3936	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3936	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3936	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3936	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4640	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4640	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

remcos.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

2868 remcos.exe
2212 MicrosoftEdge.exe
1340 MicrosoftEdgeCP.exe
1340 MicrosoftEdgeCP.exe

pid	process
2868	remcos.exe
2212	MicrosoftEdge.exe
1340	MicrosoftEdgeCP.exe
1340	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

53d1fe3209497d194e38201deb835924.exe53d1fe3209497d194e38201deb835924.exeWScript.execmd.exeremcos.exeremcos.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 3992 wrote to memory of 2716	3992	53d1fe3209497d194e38201deb835924.exe	53d1fe3209497d194e38201deb835924.exe
PID 2716 wrote to memory of 684	2716	53d1fe3209497d194e38201deb835924.exe	WScript.exe
PID 2716 wrote to memory of 684	2716	53d1fe3209497d194e38201deb835924.exe	WScript.exe
PID 2716 wrote to memory of 684	2716	53d1fe3209497d194e38201deb835924.exe	WScript.exe
PID 684 wrote to memory of 1160	684	WScript.exe	cmd.exe
PID 684 wrote to memory of 1160	684	WScript.exe	cmd.exe
PID 684 wrote to memory of 1160	684	WScript.exe	cmd.exe
PID 1160 wrote to memory of 2140	1160	cmd.exe	remcos.exe
PID 1160 wrote to memory of 2140	1160	cmd.exe	remcos.exe
PID 1160 wrote to memory of 2140	1160	cmd.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2140 wrote to memory of 2868	2140	remcos.exe	remcos.exe
PID 2868 wrote to memory of 2504	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 2504	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 2504	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 2504	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 2504	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 2504	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 2504	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 2504	2868	remcos.exe	svchost.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1340 wrote to memory of 3936	1340	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2868 wrote to memory of 4120	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 4120	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 4120	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 4128	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 4128	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 4128	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 4136	2868	remcos.exe	svchost.exe
PID 2868 wrote to memory of 4136	2868	remcos.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\53d1fe3209497d194e38201deb835924.exe
"C:\Users\Admin\AppData\Local\Temp\53d1fe3209497d194e38201deb835924.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992

C:\Users\Admin\AppData\Local\Temp\53d1fe3209497d194e38201deb835924.exe
"{path}"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
"{path}"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:2504

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:4120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:4128

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:4136

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:4968

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:4384

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:5624

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:6056

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:1232

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:1156

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:1168

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:3472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:3940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2212

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3600

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4540

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5024

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5640

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7U2EECEB\24882762[1].jpg
MD5
905e1cef9ad39a2d0cba0341cd1d56b7

SHA1
0d5c98207854ba27a8933b96a820235ced711ebb

SHA256
62e14d112854a2b2b086741e52eb60713c2286cafdebdd576df02ed319aa931a

SHA512
8aa59589d2e107dd8d91db8e38778e04de1e221aa8e2b8df0ae9f738030915e4bc0039584370552799184e5edd12f7183ca7d337dd8afa6fdb3e1b5ee7d522e5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7U2EECEB\2672110[1].png
MD5
7dc91895d24c825c361387611f6593e9

SHA1
fc0d26031ba690ac7748c759c35005fe627beb8f

SHA256
f37ad9b56d806d06267f9a290196dfe4200edb7729b41d789b8f1ec8adc5cdbf

SHA512
ba27fdbf02294cc78ede7972f20da383c20027ab172a4ea6ad5006ff58e404032d92f875e642dfe73985428c28bbbe1befc546c2666a672afacf23195425d7c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7U2EECEB\6174fc72.index-docs[1].js
MD5
b8cfc1106f3ebe1819c7ac1d0292ae67

SHA1
adf24658ac8dcdeefcaefa1ba205f91ccec33158

SHA256
d56f075448f09148f2161668d16e68f45eaaa596259c358fae5d7dd907e97cd6

SHA512
28b8acfdd18fd9aa836a6d8ee95c434f05be777b24f8f030eb923e3a9154fa41b9728da50dd3ff77b3ef93c6023ba15a7b1839b5c448469e086fcc63da1590e0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7U2EECEB\application-not-started[1].htm
MD5
feab6d4ee08decfe4c85b4c225f1bece

SHA1
39d770c78d313f4e663cfad19b8a80f1ec45b678

SHA256
ac10144bb94deb9bd9063527e4865485f0fe95087727fee58ab4099739fc498d

SHA512
f115f51dab73e25a2c6a9297d58842f48fe81a8b3b8f9f8a0f03450021f997bc5c67cc72cfaa7f81233da75aab2e63772f53c4049e5be6efa5ec4746bbb30f46

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7U2EECEB\fetch.umd.min[1].js
MD5
426331495a2310e355c95c3cabb8cf94

SHA1
2ff04aec423d302524a0d613ac5f84eabacc87a3

SHA256
50a4426a6989263c4fce8242ec99518acf9f216b88043c75d10c764bf732bf17

SHA512
a669a8114de0e05fa0e3878aefa167d51c2c21bebcf2ea515c4487dc9a82f70e1b4f102c4c43d2703bb99cff2a2f95d9d76d34a6a5e86318efd79b88233ebb35

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7U2EECEB\ms.jsll-3[1].js
MD5
a1adc22dac79bdccd4826eb07dec500c

SHA1
c456e7577677d55e28d39366b72041df6bef6f6d

SHA256
7cda7115588ca6583b6dfae0c768b9daf3815567985bd0371df95039ecb801a5

SHA512
e70b72305ec3470c77fc49958ebe4dbb98fe08947c97091b9bba6e1e1c55bd3802a33c3253898391daaecbaa3f2ab5137b1817d3a1a36e71c4b98e5b15e2ee83

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7U2EECEB\toc[1].json
MD5
7bdf223ebd8f0b205630f1ecf716deba

SHA1
a1c787afcb2c1fdeec5ffc56c2a74361108c87d8

SHA256
5c3d7b5b2d8ad34746c79830dc8331f9c0426131285ffe588b27cdc2488fbc0c

SHA512
6444cd8f25fdd1d6ee05c0967fbb9b406e136c813048d40ab3fc1ee24bdf0b6010c70f3c5a4a26eb90ae5ec4fc3f8f6e21ef5a3c1e2375af6f9c0d7f2a727e2f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F0J5R61F\5a66840b.site-ltr[1].css
MD5
21ea9b1eecda5b4d8fca5779308e4aff

SHA1
bb09e40d0a23c8efb9d7b7b7c969e70d40748e19

SHA256
9a9a09e1e052ba15cc2ae070f75a72eb5e5d18133c9a800e22cb7ad3be88c02f

SHA512
322acb02debe79e89274f5e01cdb2caac0fa2f348946bd14213aaf2d941df466acbb39b3b8153f0cd041e31e2ccba45e8079896fa099ca614671cc8a393f5624

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F0J5R61F\8a64e446.index-polyfills[1].js
MD5
c2838dd9c16c1d2d90afcbd2bd542ac5

SHA1
d4042ed31a2ffab7d312c66a527851b0bb8ad7a3

SHA256
aa7dd71eebadc1039eea7308114eae927fb442b27d701a670db43c5da5b551f2

SHA512
df5ad8f7d60ad5b7463192a6fc07310c3b9df443594faead2c9a19cd3da6adea9e58c01775eb9efa37d1024797a61fb45c96d40b9b0af34edd7802e937372faa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F0J5R61F\app-could-not-be-started[1].png
MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F0J5R61F\docons.4e395743[1].woff2
MD5
69f9f54562e945d559172b9abeb2250c

SHA1
d6c010c115511556e036fec786b78dede01ae74c

SHA256
a88fc84d3d42504ba43305645bc1e77e11cbc7179b561efd5cde499848b16763

SHA512
fe77ed0fe1bdc2e63c5cfc41729812a156e979efe720b741119c8a958368178a4bcd9532b673cff5f16bfbc7141b8df7b292e970ab5277ef5063d42917a3f3e8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F0J5R61F\repair-tool-changes-complete[1].png
MD5
512625cf8f40021445d74253dc7c28c0

SHA1
f6b27ce0f7d4e48e34fddca8a96337f07cffe730

SHA256
1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369

SHA512
ae02319d03884d758a86c286b6f593bdffd067885d56d82eeb8215fdcb41637c7bb9109039e7fbc93ad246d030c368fb285b3161976ed485abc5a8df6df9a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F0J5R61F\repair-tool-recommended-changes[1].png
MD5
3062488f9d119c0d79448be06ed140d8

SHA1
8a148951c894fc9e968d3e46589a2e978267650e

SHA256
c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332

SHA512
00bba6bcbfbf44b977129594a47f732809dce7d4e2d22d050338e4eea91fcc02a9b333c45eeb4c9024df076cbda0b46b621bf48309c0d037d19bbeae0367f5ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F0J5R61F\wcp-consent[1].js
MD5
38b769522dd0e4c2998c9034a54e174e

SHA1
d95ef070878d50342b045dcf9abd3ff4cca0aaf3

SHA256
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294

SHA512
f0a10a4c1ca4bac8a2dbd41f80bbe1f83d767a4d289b149e1a7b6e7f4dba41236c5ff244350b04e2ef485fdf6eb774b9565a858331389ca3cb474172465eb3ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LN7BCLCN\12971179[1].jpg
MD5
0e4994ae0e03d9611e7655286675f156

SHA1
e650534844a7197b328371318f288ae081448a97

SHA256
07b979b12f1cb506df7675efe227a2e78accfa1f5954af2b7bb66295e5cf881c

SHA512
07aaae5347fa8e82f86d0ba7c28127fac952d84bad3dce119654b5ba1cd2550c8d064770473f34f89fc383847b2f1594b3600d9fd01e6275d67868c41638e34a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LN7BCLCN\MSDocsHeader-DotNet[1].json
MD5
5b27339798f512c07dc7dc5375d2adac

SHA1
bdf29fa27494e9973aa2a357a042a4912cc912bb

SHA256
8ab847f2e467717c24ca2b35d83336b7d8289478ff21010a27906e12a4ec2245

SHA512
e555dc11d08cf52207e0f49e105e07b052b9d38d9aea6d9a017ae637cd19a5e4f22d90f7185ffddff50a9d63246fb9def17573981f57e511faabdc96eea521e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LN7BCLCN\TeX-AMS_CHTML[1].js
MD5
a7d2b67197a986636d79842a081ea85e

SHA1
b5e05ef7d8028a2741ec475f21560cf4e8cb2136

SHA256
9e0394a3a7bf16a1effb14fcc5557be82d9b2d662ba83bd84e303b4bdf791ef9

SHA512
ad234df68e34eb185222c24c30b384201f1e1793ad6c3dca2f54d510c7baa67eabdc39225f10e6b783757c0db859ce2ea32d6e78317c30a02d1765aee9f07109

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LN7BCLCN\jsll-4[1].js
MD5
211e123b593464f3fef68f0b6e00127a

SHA1
0fae8254d06b487f09a003cb8f610f96a95465d1

SHA256
589303ca15fba4fe95432dbb456ff614d0f2ad12d99f8671f0443a7f0cf48dff

SHA512
dad54d7941a7588675ea9dd11275a60fb6290e1582d1c7a4acb50642af3c2a4aa35e32edd8fa9dd01ce7fd777247d2706d5672a201633bf918b525936e93b14b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LN7BCLCN\latest[1].woff2
MD5
2835ee281b077ca8ac7285702007c894

SHA1
2e3d4d912aaf1c3f1f30d95c2c4fcea1b7bbc29a

SHA256
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f

SHA512
80881c074df064795f9cc5aa187bea92f0e258bf9f6b970e61e9d50ee812913bf454cecbe7fd9e151bdaef700ce68253697f545ac56d4e7ef7ade7814a1dbc5a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LN7BCLCN\repair-tool-no-resolution[1].png
MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LN7BCLCN\template.min[1].js
MD5
6daed083086c521d306f7d9f77b8533b

SHA1
ba854384cd7984635159f57c52707fb8bb8d3b63

SHA256
b1421ef2407b4f269d9e9083a99cf3219ff24bede5deac557aaf60108f197724

SHA512
b0568c40d96dc4c3672040391fddb1afc5be52823ad460eff67c5335b40ddf7eb42ba8dbfa8bcab0004c8e23e7a51e41162a678c8ec01c6eb785091b0b9f958c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QXHAVNCA\MathJax[1].js
MD5
7a3737a82ea79217ebe20f896bceb623

SHA1
96b575bbae7dac6a442095996509b498590fbbf7

SHA256
002a60f162fd4d3081f435860d408ffce6f6ef87398f75bd791cadc8dae0771d

SHA512
e0d1f62bae160008e486a6f4ef8b57aa74c1945980c00deb37b083958f4291f0a47b994e5fdb348c2d4618346b93636ce4c323c6f510ab2fbd7a6547359d28d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QXHAVNCA\SegoeUI-Roman-VF_web[1].woff2
MD5
bca97218dca3cb15ce0284cbcb452890

SHA1
635298cbbd72b74b1762acc7dad6c79de4b3670d

SHA256
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d

SHA512
6e850842d1e353a5457262c5c78d20704e8bd24b532368ba5e5dfc7a4b63059d536296b597fd3ccbd541aa8f89083a79d50aaa1b5e65b4d23fc37bfd806f0545

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QXHAVNCA\bluebird.min[1].js
MD5
8c0479914b7b3b840bf9f62cffe4adaf

SHA1
c33559d5f359521e58ed375d6863a2e85a37eadd

SHA256
aec354e7dea8b95f5a6242c12dbc66c54d6264795cddf1ce685f59de541cba86

SHA512
7c31c0bd521562cc0f6dd604b568267fc217d198daae568b384a49b9cb93e21a27fed0fab3b2a989f3715a864e0f7f867040474799abfa6c344360310caf4c7a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QXHAVNCA\install-3-5[1].png
MD5
f6ec97c43480d41695065ad55a97b382

SHA1
d9c3d0895a5ed1a3951b8774b519b8217f0a54c5

SHA256
07a599fab1e66babc430e5fed3029f25ff3f4ea2dd0ec8968ffba71ef1872f68

SHA512
22462763178409d60609761a2af734f97b35b9a818ec1fd9046afab489aad83ce34896ee8586efe402ea7739ecf088bc2db5c1c8e4fb39e6a0fc5b3adc6b4a9b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QXHAVNCA\toc[1].json
MD5
86f025aac070c2ea6e186279910c9dbf

SHA1
1df78c27dcd4bbce23577e26d61f97b60f3fca85

SHA256
c79a4a86abae68b7d082c3e3dd11f0416c9780471bfb1c2dc1d4ad1eca0d040e

SHA512
58c9c59176c9eb85e68df3237480bf86bfe2eeabc59ab842a4a75598e621e046b9ba760f236b6a55a12003244598e7fead70ff909bacee22ad1891f22343276e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QXHAVNCA\url.min[1].js
MD5
715749b6973b4268c2993bc2b73f8faa

SHA1
405ad2061df73f752ee53623822ebaaec1f89e02

SHA256
e3f01a42ab36248bfca392804d39abfc388b3cabb22e0364526cd3e359d92c9d

SHA512
75b57a03db3aca77c857bf07ec789ea540603001279508edf4889195eadaae1dd629498d58d62a8ab7ae64669a776a0a44d10f0dd342dc863d9082e08fa4f041

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\35R6NUPF.cookie
MD5
c88cb4bbc73f15f1286ad7a874aae43e

SHA1
96f1d586970ebf7a2e5bd52241675964f318bd2b

SHA256
06eba45513a4b9c5ec5024b3b985ea50e6f6c8b7ba32a04f225033adcff11001

SHA512
8690fe35a092d47cbe299ed9a00cc2ac28bcd9c8d7993fea996a8075ed875bac7708895e4aa48b6ee7b8b04315540694c518ecd916385e3a1c89e8e4b8760b82

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\DLZK2D2U.cookie
MD5
65937b078fd1bc09421aaa333d8b3134

SHA1
7f07e245f1b48e024d8290b7e8c1ac7223fa9669

SHA256
26458ce449528faade1ad110c33d23a5839050a92d7b20c5dd3e6d9e38971749

SHA512
8a809d27f3a8feab4d336731ac89cde3ad16d54df13eb65ade2e85674d41cc0e17464a0307102926b51bd285a20758070722f2e5b12546d918ff8a0dd950ad24

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\OUPM0D7H.cookie
MD5
443c8ce3884d2cea3334be9c71890de1

SHA1
858e65cf971b61945136af84b6456b226d37d2cb

SHA256
0ae90682b37c8ab780bf0e3e652521665ef63c809c18d75aa717b8aeaebebca0

SHA512
2eaa127f8a265ac5e9218bda6bbdf36ffb37c379fc4d52e5eca9e0e160def3d29d4bb0d8a648d736706621e84a95d3f0b63b200a0c8fa28cf692e31392a1ae88

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\RAKU1MD9.cookie
MD5
f9ffc58b4ff4165859c91a97cbf90588

SHA1
4aae47221ccbac360113a2d7d90c46dc8698ca61

SHA256
3ae8379ba8ea6897fb81a1bc590430a3f919753a6f22a0e68283b724e5a0470a

SHA512
a72cd198541223dcebea393cce768d06a61c63680d68008d6b260a21bad9ca3edfdd7dc3d70c4bdd1ec712bda7bde811664e83e182110fe77c05d7bea23e37d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\UJEYTR29.cookie
MD5
084437a1a1bc73e7ab8834639c135360

SHA1
9fc40585a7acb1f638ec8078f5a3d26c2012c483

SHA256
6a4c123f9d1bf2bee88de1af4110ceba89fa578fdcb09d7a3e1287ce7693e25b

SHA512
ea2beffc542b8b5644b6b47b5a8333600eac06dcec448cfd79321cdf30c0d379837cbdde3b946bb1223af5ed5ceb8b96cf3692c9d3be5a174fc1087cd9cb2b43

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\UJRN8TRH\docs.microsoft[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3
MD5
b752b8a12ef1dae02091b4941e067f85

SHA1
c45bf4af64a0e1cc87ed35fe605fe8dc031f2c13

SHA256
3e84758bfaf84e04fbb0ce7b9a6eacf9a339bbd0f63e925386a90dd53ea6ced8

SHA512
f2794093e5bcced7f57d6c96faf9556338eb4ed91c09d9e0c3780cdd72cb5ef2eda49ffb4be4696bb6359b6dc105411b14f74f4e46ebb29f5fe2fc3c4c14fa04

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1
MD5
52cb19d14598d9a4589878139ba4b746

SHA1
e7633e8a3a3502a5579ea6b3dc74e88561ec6fb6

SHA256
385e0d118ccb088d47fe03c18994d6769732991aeda61ff2985790a2379e7ae5

SHA512
18fe97a6b19112e8821d709548a7d2430d455098cdce6e20d8b77a0d413c430b652fb6e4ab46d89b9e848810e0fcc5816261de5a1f61936abbf281f79b7806b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
MD5
bafcafce79c137cf2058bdd820c337e8

SHA1
ce3db9f926110fec966007527d5e22c992656f63

SHA256
08c8111447a6feb373a2539cbae85ba1a1767472c256814d930b52c604545c8a

SHA512
64ab83a3e2257a690fc10c1ebd155f58cbbc2694b036ba628396f0527c3fb547c061f64c686d5118a80a3851bfa37317a0a6c6934f38b5983b45aba49a498013

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
6b86268556b9f2d6cea8704b19e4bbfc

SHA1
c65406c37cb1906b39408322d709f52dcfa5c483

SHA256
421b03a819f91cf1ef577c935532e4e629ae279d5a30df6e9d2fa4561f6ff9b3

SHA512
c0308de0cffe12564d0c22d5ec1922c0b29071942a6a9088ef92c980f8980bb14f4a458ab2426d82bb45ad82ece14e3200c3b0c24cba79f81be77fa2219a30cc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
8da42796ee48364c3c8d1df88b52d510

SHA1
7b0bff5c8a1abfe6414faf75b63ec099ef242561

SHA256
509e74c2182406e69d588179dd9701cbd12a5c6aa60e8abc3e89a9203fd50859

SHA512
9c352b58981f87de5e5e17844e13a3bf0954f28e9a8d13a63daacbc9f024b60d99556b19224ca6407f141f0056741b5cf3911d98c26fa22a9e0ea234f4b1e4a0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
MD5
e2f669af7cd410799a13cd57ce744ed1

SHA1
08ecaa7bd092ac901ab2cb41c1fcc78e7594326c

SHA256
f519fc9ce819e5164175095b32727066372eed5dad76adb7e371f900d946e06c

SHA512
0fb65c7ed53b8fc90a7e5c7cd6f8fdff9b38a14037550f7b62d67ab364c5d4a3badac06abacc7c3658f2369e3f4153526ef3345049137805c713f1698c7ca4e9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
MD5
e21d4571d5f9a34c764975bee6554ddb

SHA1
1ab96ff6e5ea7b9fceee63748d9af53c71fc5600

SHA256
a61a512c7a224ba9d3d85c2c72807411e3f289dca7e2c21e453365c9e5cae0d4

SHA512
e047c0606aeac24871ab8a75046a6dbd5f848d8e8228d928ccef16bd935d6f7afc28fcaf7455e1fb335c55d2aef2253d447ad5a4cd340a431b6c3097c2191a55

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3
MD5
bc02a173094f544fcecd19546a3a37ec

SHA1
61b31e31c694afa6bd2a2c04a7b7f5c708ab136d

SHA256
d621f2c7b60acd94209e70d5902454339935d01c2711c168fe4f7ebe5041b235

SHA512
ab2ee1b7ca79b699f84cfeb07314145b58bed74ceff33afeaf2e6cd159b055e9b0415855840230fc15c6e63dd653665de648309d6e07416a7717f24fe5ead0f2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1
MD5
15df25d174c3ac31aeeb8a158a45e238

SHA1
01d2ae7c51bff10ea38e13a652f633da542e0742

SHA256
3bb6e1108e3db4570124d0e3a2e7b2235a6ebf5f92bde674628581070ed13969

SHA512
71ccf94807ead6cf4c4c7c2d9a2796a9a0aaa42ddec7912be626adebb18fa771237ee05e501db4198ac717231de784462b377ee656c0d004fb2e38e1a44bcb64

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
MD5
be139b47ace59abc351b654e350d42e1

SHA1
97513020c8df1fb6f783e1a27133ad12aad00409

SHA256
dc8cc36a8e89b5a347d18a21dd5e7acfce594748fac5bbe1a589ba36286b5531

SHA512
0335c7d277e03e1c3ef5b3bc9629ee9ac38c2581b902d0b2ff883e2e26575172f4574977507d8c62076243586c3ab29b6e1a242434b084c8af3435679bcb4526

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
7eabdbeef647c3324967155d974c5129

SHA1
72d64e381c7f131d448d2a41ccdad9fa3c54928c

SHA256
9a6db9b6502f59f947629286d54a303e57c0fd94c0e66dd0609a6db7b7e3e68e

SHA512
c878ea0650d67538ca356f3650bcd6209597286c87fe35b5c56a4b300d885fdcce6600ebd4b50b416a81c654dd7f888dd9cfc75650365793f0a984f0d5598c24

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
6c2422b4b6b7bfc0496e26b26799f802

SHA1
71291553e933ef1ddb17bf963e7097bb38fdbaa2

SHA256
1424cfc16806a9c6ce4bc3a5034f4e77c92030ae7876659cec0b7f18bc46c476

SHA512
5c39ff96ad149777290a80ba21865c23ef978b3fc598ecdaf053813b09b146412a8592f807df7f5681413fddf2943f2589c1dfdef77f12f668656a634a1ac62b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
MD5
35f519ef6cd9596cfe917b35f5c1296b

SHA1
d618166f25b8536c63e5ebb5225cce03e8365e37

SHA256
5e937fe91169a03e4a0578e9c6d074c16b531c292072ab05d7db4fb7d2d534ad

SHA512
e39aa85be9348728209e6c7a110dcf5fd7482b4f1f5107bd98b67f324bc31b849061eda682801ecaf25384e3d04d5d576d466220694802f2a1379e7b27206a1a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
MD5
a68e8c4f653fbbe7af3f276f8490613b

SHA1
8865a4702cd7fbdf79f19345dc12eef20bfdf6c8

SHA256
a65941417e626a9afd3997bd2f9789541742ee3c1fc74d71c15fd9eac1dc7d51

SHA512
1b922874167ce6dfef43800f03f2fb248aed45fa64c0ca4d27fb0a896262dc86b95af5930a90822b5ed23ad00b94abbeeaf02ce5edf927a6f6f53a7bcddb700c

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
b92d64fe5b1d1f59df4b738262aea8df

SHA1
c8fb1981759c2d9bb2ec91b705985fba5fc7af63

SHA256
fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a

SHA512
2566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
MD5
53d1fe3209497d194e38201deb835924

SHA1
43f4315a82d7cd359aec38eac9fa37602d8baac6

SHA256
af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82

SHA512
a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
MD5
53d1fe3209497d194e38201deb835924

SHA1
43f4315a82d7cd359aec38eac9fa37602d8baac6

SHA256
af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82

SHA512
a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
MD5
53d1fe3209497d194e38201deb835924

SHA1
43f4315a82d7cd359aec38eac9fa37602d8baac6

SHA256
af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82

SHA512
a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2

Download Submit
memory/684-127-0x0000000000000000-mapping.dmp

Download
memory/1160-130-0x0000000000000000-mapping.dmp

Download
memory/2140-131-0x0000000000000000-mapping.dmp

Download
memory/2140-141-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/2504-149-0x0000000000611E5E-mapping.dmp

Download
memory/2504-148-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2716-126-0x000000000042EEEF-mapping.dmp

Download
memory/2716-129-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2716-125-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2868-146-0x000000000042EEEF-mapping.dmp

Download
memory/2868-150-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3940-233-0x0000000000611E5E-mapping.dmp

Download
memory/3992-118-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/3992-120-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/3992-117-0x0000000005B60000-0x0000000005B61000-memory.dmp

Filesize
4KB

Download
memory/3992-116-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/3992-124-0x000000000C780000-0x000000000C7F4000-memory.dmp

Filesize
464KB

Download
memory/3992-119-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/3992-123-0x0000000009EC0000-0x0000000009F6B000-memory.dmp

Filesize
684KB

Download
memory/3992-114-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/3992-122-0x0000000009CD0000-0x0000000009CDE000-memory.dmp

Filesize
56KB

Download
memory/3992-121-0x0000000009D60000-0x0000000009D61000-memory.dmp

Filesize
4KB

Download
memory/4136-155-0x0000000000611E5E-mapping.dmp

Download
memory/4384-211-0x0000000000611E5E-mapping.dmp

Download
memory/4968-205-0x0000000000611E5E-mapping.dmp

Download
memory/5624-217-0x0000000000611E5E-mapping.dmp

Download
memory/6056-223-0x0000000000611E5E-mapping.dmp

Download