Malware Analysis Report

2025-01-02 03:24

Sample ID 240724-d6kyfawdrq
Target f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
SHA256 f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054
Tags
remcos 2404 discovery execution persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054

Threat Level: Known bad

The file f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe was found to be: Known bad.

Malicious Activity Summary

remcos 2404 discovery execution persistence rat

Remcos

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Browser Information Discovery

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-24 03:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-24 03:37

Reported

2024-07-24 03:39

Platform

win7-20240705-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"

Signatures

Remcos

rat remcos

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3028 set thread context of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3048 set thread context of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 2164 set thread context of 684 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 940 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 2628 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 3028 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 2320 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 2304 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 2016 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 2932 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 1424 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 1232 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 2404 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 2884 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 set thread context of 2332 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427954129" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507588dc7addda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000048bbc84c2d882cf495f518318892b4c25470a8496cf46093ec1fb7b6dd7bb4d7000000000e8000000002000020000000732a2f8f8c98295bb478a7a5d84af57a88905c71c5b11a658855fbb9857a5016200000001b6ba069adc0f0b11522c3d92156ff4669c9dfba208e4d9fb8cc8768e94b06d7400000001940eb4567ad8a6f04ec4a64c281dec8768c3ebf72cea476e2f133675b52b9353edf6b6d67d9d78c028c533730e754dbaade7629f9a679fc115e2aed81075150 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000007145ac35b0a4c742671cd39aeaebd168ef3188dd9702889937db801b3c19fa37000000000e800000000200002000000025bce5bc5d1f75c5e73f5cdd9e8c166e83be4ca6832a2f0ba2d0f85580d508c69000000074c9189d9fa016396153231998f39c796e8b67deb4b8230804203e90490653dcccfc74200721af745d3f4fc9b492e33ad2824ff8641b0d027fc7fe33c926e8019c1859c96caa93122113ccba6125b729189589f0dbe0236796612915296b2a9e04242e5097d138609dc294c85ec44df9bf99bcd9a90f7d07af33a24afb2155f24c79a306400a020d6387f41a45df7acf40000000708bc09a04c92e3c6904abc5995af441e6077358637d1e8e9da44b29c3928fbcd6b7b803ce4b98cfbee3f047b4885a12789c15c960070ed53a0409ac3510363f C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14975921-496E-11EF-8A2B-F235D470040A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\schtasks.exe
PID 3028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\schtasks.exe
PID 3028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\schtasks.exe
PID 3028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\schtasks.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 2856 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 2856 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 2856 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 2856 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 352 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 352 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 352 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 352 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3048 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 2164 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2164 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 684 wrote to memory of 2360 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 684 wrote to memory of 2360 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 684 wrote to memory of 2360 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 684 wrote to memory of 2360 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2164 wrote to memory of 940 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe

"C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZjibU.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2FD7.tmp"

C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe

"C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZjibU.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5D8B.tmp"

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:472068 /prefetch:2

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:472094 /prefetch:2

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:472121 /prefetch:2

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:734243 /prefetch:2

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275502 /prefetch:2

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:1651742 /prefetch:2

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:1717300 /prefetch:2

Network

Country Destination Domain Proto
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 learn.microsoft.com udp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 learn.microsoft.com udp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 learn.microsoft.com udp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 learn.microsoft.com udp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 learn.microsoft.com udp
GB 23.46.73.240:443 learn.microsoft.com tcp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp

Files

memory/3028-0-0x000000007441E000-0x000000007441F000-memory.dmp

memory/3028-1-0x0000000000A70000-0x0000000000B54000-memory.dmp

memory/3028-2-0x0000000074410000-0x0000000074AFE000-memory.dmp

memory/3028-3-0x0000000000470000-0x0000000000480000-memory.dmp

memory/3028-4-0x00000000004E0000-0x00000000004EE000-memory.dmp

memory/3028-5-0x0000000005B20000-0x0000000005BE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2FD7.tmp

MD5 10204a29c411861ffe663b1d39533f2e
SHA1 0acc98a0fab56c00fdbf1f5fe656707d4edfecca
SHA256 fffda148b24d6e53d7ebd1ac1d40251c58049623eecc5da7ff412346c5c9b9dd
SHA512 bee3d8b2f01e6f1a437cb907893978280a84bff4321239e96c1a5fdc0d691131c050aae72dd8d8f5e7373df0235df4a31273136f2263983801132302f8615aec

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 14dd5bb1dafd6502e964e4d482f695e5
SHA1 4e99969ad75c61d934e4ce3b8d543704bb841d82
SHA256 edb93e90c9eb16ffbf75475bd77a2040fa0255bdca43bfd9e0940a185e12a20d
SHA512 e8ee78b5438bd2067f88689472a1356ab24c8e52267dbb8087e2d7fe63ad2e46f1c69b8947842460c36fa20c61fd5cb34f6fdf0eaebb2cbfc64874b2cb2da0a0

memory/2856-18-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2856-35-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2856-36-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2856-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2856-32-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2856-30-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2856-28-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

MD5 e34683e560b0c2a5cddcffe98956ea62
SHA1 89a3dc3e4b06a8c4bd94bffc48adac82e620d910
SHA256 f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054
SHA512 4bf4a8fef3b740ba3e6a04bedaaa90970a60b72fc950d53de6e2bf597d89d5d399f9258f9f8088f0ea6304bfa219c5537271c9df59c463893d9589370a27ebff

memory/2856-26-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3028-39-0x0000000074410000-0x0000000074AFE000-memory.dmp

memory/2856-24-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2856-20-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2856-22-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3048-46-0x0000000000C90000-0x0000000000D74000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2164-79-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2164-83-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2164-80-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2164-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/684-86-0x0000000000160000-0x0000000000244000-memory.dmp

memory/684-87-0x0000000000160000-0x0000000000244000-memory.dmp

memory/684-85-0x0000000000160000-0x0000000000244000-memory.dmp

memory/684-84-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2164-88-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2164-89-0x0000000000400000-0x0000000000482000-memory.dmp

memory/940-90-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/940-91-0x00000000000C0000-0x00000000001A4000-memory.dmp

memory/940-93-0x00000000000C0000-0x00000000001A4000-memory.dmp

memory/940-92-0x00000000000C0000-0x00000000001A4000-memory.dmp

memory/2164-94-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2164-95-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7C15.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar7CD3.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 946f2db56a38678be5a87c7122eec6fd
SHA1 c9ce81e7c4b88072b3537fa92af6cd3862d68def
SHA256 97a866e5e5e58a5ddcbc22cc4e5028d000609c189ebce83190de88b4db3c5a5c
SHA512 a9e47b215816b307bdf701f3887854838c6479610abe99f67b5e6ad9b7f60592d838f9b745148b4cf74ef49c357eade154c3e3983bbb317e0587394fd5782127

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b4619bef8b5ea98bdb0e65abfb576e80
SHA1 f8a6c0f060ae411636b508155ec200f3cd062e91
SHA256 1e0ce0ed00ac725fd71ab464463773e702e7e07fd13d1363d8d932560c3a727c
SHA512 9d352992531a30a934dbe1453adbc5e2a535b6652c30439603659874536727a90e30eb8bc9743b9a40eed3465ccadb9dbd24a7f39fa5d464238265baa7a21a53

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3653fa95455a4972a72b9602820918e2
SHA1 a58115a6a0a76c43acb4ad485209791c2475fc53
SHA256 64f55cefd10fc077780f1920daebb334da9c23a7c8fea496f68da8199f0d768e
SHA512 a38231995fcf28ebb51f52a041a3ab1c7647ed4a49a536c83d79d3d3dd2af051cd489f3091fc7335948e3843efe13cfd5d32dede9d52c8207e707a4a9ecb75da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

MD5 f55da450a5fb287e1e0f0dcc965756ca
SHA1 7e04de896a3e666d00e687d33ffad93be83d349e
SHA256 31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0
SHA512 19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 018653befbaa127f9339ea1c440e007e
SHA1 06b2761182b0b08718f5b3b3a05c1211037def3a
SHA256 d07ba5be64de3dfe00f4f48c30fb6fabf92c20d2f36ddcb7876468d663cae6de
SHA512 559ec1eb8991f30f00e385b90f84d18c46c6d543e51b8986e71df0a76d6caddb9cd1ffbb55d5e4a229bebfc80339024f656ec84f3b19c574e81509dd53279ccc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d7df3fc166b25afeb86986c1190bd153
SHA1 685ea1b09b34fb9f12cf17eb94457ca7bb9618f3
SHA256 74b347fb566f7e8ba6d269ca1ed59096f56a20d5702ba3a850dfb7cd20781056
SHA512 b5d5f1db40ab0c038cfa3cf5d677609f8473173e3abdf5662da5ed6b0df6810bd23a518c729ab467da5b36f1435cb2fa2ad3216c5c13000d2b073e254045e267

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 16c2aa746108a9e12315e616a4e27789
SHA1 8f5ec1f13eaed5e744c2f03b094c33f5af8356da
SHA256 8292d25656bf590f1423e70744bc672e235965df2158334f558f7ee4402cd4b1
SHA512 2577088362127473e4c140aae1b01d848a0ae16ef7604fd6d79ef44ffbe3660c8ed6090c8b5f1daa8fd5ded574fcff9da0d72b93f7e59d0b957dd90c260e990e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e76666c16d1d4d401586c4c3675bfbc8
SHA1 cfaf0b8de92a1850043ecc333ab3bb98295c770b
SHA256 182ed0b4f76aed81f5dd40b2c786ab9db5054d2ce048f9f4baa70a0d906f48a0
SHA512 eca898929d82b1d6716c89f3a32ffdfb80a2c463b5e49a84ecd477a5c1ee71818311a80b4c66e0ef7063f78edf7ed1a0fb14b9751ea889ae68288eae99553183

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

MD5 6f22f295b68358e0e2a820ab75699873
SHA1 02ee040c529e6f641e7812922252e196a1c3f521
SHA256 25ee23f1a0a68ecb8a5a5296877c90a038867cf5a2a56560b6ddaba7cb164d71
SHA512 acf7ad44795ae255b4b28706d6e3df70354e1a6f3ac7adf03344dcbfb475135e77df31160a5c2b2ca9861aa71ad63cf19e75a198e917dd905ce141578c191b24

memory/2628-422-0x0000000000150000-0x0000000000234000-memory.dmp

memory/2628-421-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2628-431-0x0000000000150000-0x0000000000234000-memory.dmp

memory/2628-430-0x0000000000150000-0x0000000000234000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2b9469712da5b1f51d2a7d956c9b08c
SHA1 8c376a6da55f42d9e0609af814d855f1060bc34b
SHA256 781f4166f05834d1ec2504dfd8439337190d93ba7ae1bffe65021514908e0f2e
SHA512 357922e2169db5cf50022481e61b588484b5f15f6e69f9346d5934f7e7f16abe13b11e36169590ed45c544a0e5abc85798474d2ffd7770828f93c4365aa531f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f9bb50d1fdc09d143364b841a9bcced1
SHA1 47527c72c5750fd7500b8fde1375b9dca347dc83
SHA256 e9dba893be53dfa12b0a30793dacc9c70fe545fe0d82409247b28db11e7c9594
SHA512 db0235ea60911b7e3cdf327d3a4f469377d2922f57d98eac654485c7a456de676c0d46ca2b5ad152a18826eb7cf2e71be0a4c2a3007ced8926020343bcd2c37f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7bb288b3707e1aa8f04b3790a63ed291
SHA1 8294e6173a1feb3fb77bf000b769a157e750302b
SHA256 8147c9207ff02db3c55c9787e625ec56d41a91600b2ee2cd3ff0804961a67389
SHA512 6dd493eb21454bf458a776723dd1d5d9455366d05f59a57e5bae17f84c5eb08fb9e4b90a7159e7140068697e67031c9292454c42e5290395179d16bdd6fd7700

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f37b8d4726efa33d6d42c7b8e8d5ac03
SHA1 4352090a1e0907235a06ab702c8212537a54b8c9
SHA256 1fa45918b772a4c76ab157d31842ce593d86f6b607586abe90f76f26526e8777
SHA512 66112ce0918214c67bc12b6fc6d0a492fb4615bcad6cb59e1f6393d7a14012c56d538e9389c84eba52282ce7b23829d8514a72247e769490133d59a5caa9af08

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb9a5d1665b504b6b2b48c4d973af25f
SHA1 a22f742080fefb26171eba7990deb09fa551539b
SHA256 7f40e04876c079f9f8cc351f70aed665fb9c2d4b88a9adc2ccdbcc05201b966b
SHA512 b5ccf4a525d0003c568b9b24432363d254987ac71fddfee9e20be98ccd5a2fbdb7a06c37798c546b183fe149821a9ce939eda4b05f945adbae6c92a8b8cffabd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f1c2b8b1397cc73dad39fb6866b62c92
SHA1 36daef70fbd9ea028ea63c9a7ec8fe3ed4c5722e
SHA256 c7703476ccacd4d98b0f428fa7182a0bb0cff229ef518db98576e3bcc7d3a068
SHA512 ef4f37b096d76d2e63d72cce5e0dac20683b9d48646a4e6e8528f6a29af765b6a1445af67e7705950624f5effee3b961b690712dbc198ad3f69e05087e38574a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3bab22a2410e739448cb99be6d6e263
SHA1 25857c5ada4e158fb21f8e0b2425fbe8550c7048
SHA256 a3086a3ed16f95f0e61090b7980923b02e8be69d7018f043142faf98aa6118d0
SHA512 fa1e27b5d41b117eed3808eafe8483360f125a0485cbec7fe18d4349909ceb2589b3d7eabd855844c1ac0d0a4fde092162696743b8efcc7fc7671f1dfaba0484

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98b1c4408bf2f1dc4d061be46d8dabcf
SHA1 714af7adba7cd0870ad5f099fc110757933dc14b
SHA256 2552ca3970caf24e457a2c76612ae6a4bbde8c0d1fb4651fbdbc5f4e9231a0b8
SHA512 982d7b245fe1c618acad32760e9fb1528c6298a39e2174b5711b872a425c1f3236c17507971915a5c4434a0aa8f1e29ec23bae7e93ed91e19ec0614472c18399

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e16125b58c1987f52c7e2be19dea63aa
SHA1 4edc196eedda95d42a638890140f29bb68623152
SHA256 2f32702adb51668bdcc4ff69b225a70f61bbae7adabafc28cfe45858210b722a
SHA512 f057ec881616d847c989467c73fb33e2981695730522e7ca830fb945e370704f5623d7e7c817e79df4117d9f85981def52f0fd1701bf205c33819f7ce694da4e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb6ff16ff38c4870b1086b2d1e89884a
SHA1 4c2c240b7b6a7bc72f232354a9d17cf2e4a595ca
SHA256 96f50378ca4a85df257cf92ee9e1cfb8330e4c1d16444b2037a0fc3750059a3e
SHA512 6b5ef4a1bbbdc2d0f31d04fbf27c926fc16c7f12030424607ae36d30eb438e987ee3c514fb79944ddd58e27af05aa0da94eff1a3077a4306118abd7bcbd3d271

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a94340ea4ed156ee6b559822de35e02
SHA1 4acf5a16950e2f93670a1bda3d44edc8ce94d496
SHA256 3d8978ccdc555bbef9eac45e03ce1b2ed7362737c8b58ed843a185f6c6bd7ab7
SHA512 0db557888fa25d8af5f5f256d206c93fa3094205d37c053c0f3482292c1ef8c9018a95dfc0cbf451b1b20c2180cbb3e8eb0c0e68a4c3e981487c48ca611a4b58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 939fcaafb2e2de23d6dee0305ad112d3
SHA1 091e622c803f34322c435fdb541a707977ae1379
SHA256 8f36474872a9b4d080b8f6d24e3dbc7e5d92573d2b19ccd9b61782496415919f
SHA512 932a207b1d40e3452a1e1fbcd491457cbd47450d1230249579bde565e0a9f76b22c4d5b38473d148e12ef09c10b28ceda16742f85904524dd4b6f63e13aa696b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d447a5c0baeb5e025cf642ae40947d1
SHA1 29b5f23ab0a9851cf5b4adf5db4363c110bf8dfb
SHA256 7fa1fc1d23f79c345d7b7f8db0a828887127ab2315d54ec0880efa4b81e4e1e8
SHA512 cd65e79865fe1a9aebf08530d1acf3ee3cd9046765c59231f6258eea8d1e4eed1dbc6e987b40adcf9d117728b81d0aa5bb51cac1c22989a114cfc8932208ab22

memory/2164-987-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2164-988-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2164-989-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3028-990-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3028-992-0x00000000000C0000-0x00000000001A4000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2137b13c8691b2b41387ac0746d832d5
SHA1 5a029318bc1a5e19d1293807aa74031c0e435ea2
SHA256 a72a5e8bc44c9e969e2978ba1a8f5b1d13ddc35bf21e775fdc00f728a6c0e511
SHA512 1a4b80c83343c2d8d2abbc4d33c6d8835152005c8a2cdd1a4eebba61809ce2b02b6d70c84c63ca25d4f66d6d4a4eddc25fe48fcd0080b707aa8070a6419d1947

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 40b5ec3ed8de68bf3b084c91f3456c9e
SHA1 593b49f61bceb88897c4a16dfcd974375ce73262
SHA256 563c685b03a7ca731c986842645b7c84e9480f2c51d8095f8bdc9822c86b5d4d
SHA512 0fd66c688e52fa869240e45abd2f1bd5b411d51538bc54d36af15ceeaf14d0826971233cdf93bcf690157f33f3144ae8b33af4ae9cd8ead879339c8800a0ef35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 237e1cd6ab15d910725a0e19405e1e8c
SHA1 fd6ffc043cae4ae800763292650933cb9b38959d
SHA256 13c3a52368e54654ba0dc8c2bc8b3ba1a52937366b79b535972929a6947965c3
SHA512 0dd78f10e80b1a48e434dcbe99545ed1d15d68b054a04c9cabf993b9a53de5895f09a946c93a1f72369c36fb1d5b5ed046043039dff88461a4b5add01a0c0e9f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GE5J41S2\invalidcert[1]

MD5 a5d6ba8403d720f2085365c16cebebef
SHA1 487dcb1af9d7be778032159f5c0bc0d25a1bf683
SHA256 59e53005e12d5c200ad84aeb73b4745875973877bd7a2f5f80512fe507de02b7
SHA512 6341b8af2f9695bb64bbf86e3b7bfb158471aef0c1b45e8b78f6e4b28d5cb03e7b25f4f0823b503d7e9f386d33a7435e5133117778291a3c543cafa677cdc82d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GLOK2QLQ\ErrorPageTemplate[1]

MD5 f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1 f4eda06901edb98633a686b11d02f4925f827bf0
SHA256 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
SHA512 62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\errorPageStrings[1]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\httpErrorPagesScripts[1]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\invalidcert[1]

MD5 8ce0833cca8957bda3ad7e4fe051e1dc
SHA1 e5b9df3b327f52a9ed2d3821851e9fdd05a4b558
SHA256 f18e9671426708c65f999ca0fd11492e699cb13edc84a7d863fa9f83eb2178c3
SHA512 283b4c6b1035b070b98e7676054c8d52608a1c9682dfe138c569adfecf84b6c5b04fe1630eb13041ad43a231f83bf38680198acd8d5a76a47ec77829282a99fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\red_shield_48[1]

MD5 7c588d6bb88d85c7040c6ffef8d753ec
SHA1 7fdd217323d2dcc4a25b024eafd09ae34da3bfef
SHA256 5e2cd0990d6d3b0b2345c75b890493b12763227a8104de59c5142369a826e3e0
SHA512 0a3add1ff681d5190075c59caffde98245592b9a0f85828ab751e59fdf24403a4ef87214366d158e6b8a4c59c5bdaf563535ff5f097f86923620ea19a9b0dc4d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GE5J41S2\green_shield[1]

MD5 c6452b941907e0f0865ca7cf9e59b97d
SHA1 f9a2c03d1be04b53f2301d3d984d73bf27985081
SHA256 1ba122f4b39a33339fa9935bf656bb0b4b45cdded78afb16aafd73717d647439
SHA512 beb58c06c2c1016a7c7c8289d967eb7ffe5840417d9205a37c6d97bd51b153f4a053e661ad4145f23f56ce0aebda101932b8ed64b1cd4178d127c9e2a20a1f58

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\down[1]

MD5 c4f558c4c8b56858f15c09037cd6625a
SHA1 ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA256 39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
SHA512 d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GLOK2QLQ\red_shield[1]

MD5 006def2acbd0d2487dffc287b27654d6
SHA1 c95647a113afc5241bdb313f911bf338b9aeffdc
SHA256 4bd9f96d6971c7d37d03d7dea4af922420bb7c6dd46446f05b8e917c33cf9e4e
SHA512 9dabf92ce2846d8d86e20550c749efbc4a1af23c2319e6ce65a00dc8cbc75ac95a2021020cab1536c3617043a8739b0495302d0ba562f48f4d3c25104b059a04

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\background_gradient_red[1]

MD5 337038e78cf3c521402fc7352bdd5ea6
SHA1 017eaf48983c31ae36b5de5de4db36bf953b3136
SHA256 fbc23311fb5eb53c73a7ca6bfc93e8fa3530b07100a128b4905f8fb7cb145b61
SHA512 0928d382338f467d0374cce3ff3c392833fe13ac595943e7c5f2aee4ddb3af3447531916dd5ddc716dd17aef14493754ed4c2a1ab7fe6e13386301e36ee98a7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 166074c20c974e88f619dfb66c734fce
SHA1 598c385c6a48da5b964c3adeae47cc365df1b680
SHA256 e2e53e3b4b68e53477c61b9414dc9aec1a8ef7145ca322848123b34ac664c81f
SHA512 a3e960e0a8a20ad6918fcb2d02f1f6dd0b0b61c8403291e747bab00d962df59d572e320962114adef1dce0b9d4992f6e28553a022069aed3b052a83ee1e8d538

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c48f238f5d085b053c79304fc5036592
SHA1 12d719d80e464dcb366e6f687680baeb0e641ae5
SHA256 641ef26a30bb009c8c0e8d3a62a1d83fbd8cceea1e2b6481a7089ba465691857
SHA512 c64cd1acac0ff24f36c238b28e98947585bbff6fc54ed0fc54758e58e48a85bfd980128854def53669f654b3aeadbcaefda60c908087a7974f154274ef011542

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 400358ae7363bff47bd5f022c732d623
SHA1 cb1382eb9bdbe0389f12fbd114fdcee828bf24ef
SHA256 c83deefe69441fdc00f3c3358cd4aab736858c45477404d68df74ac1b18968bc
SHA512 3411d211b233579efc8fc60e2f6637cb3e6e41dd6436c5fb53d9fd5bdb8a4bccc0148dba6dc9178a40ba9ec2978dbe92a9daa5a6b72c211de9326750e7d535cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8ca34cd9a055c686db2c36351fbdd210
SHA1 81224f4f897034c8fa1a1035848a47c18e38c0b7
SHA256 3f4da8d716e5d5483b48a2f1eaa0ba282550347b3e4338cd5e4d1430de849b6c
SHA512 67d12f2259b146845791dad9b138c235c845927e2f7e8df9ccc8c669f48d680ad151bc57b013da3635980125b341b8420bfe2cdae1a07ef49d2c70d6437d7826

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2718074ce84a91924093b84a9979f821
SHA1 2d9e4cd3aa455d3f7247bb22a9a15ba8fd8d9d35
SHA256 d89ba7b0937820509525fdb82069aa94447837d7ac185b257a4119fb73a34f78
SHA512 6015daa9b42c72c119787819abd9d8552f4d263e2fc8a6b2643fa45913fa372d91422a1232828f851a3b40906ffc156e6f8e6c44cbf688340c2b6dbc3cfd34fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8716680d8a634c4211ab70d519cd940f
SHA1 a8c6941500faf2e96f10a752cfc2e71d16fccdcc
SHA256 4ccc861f618cfb472a0baed4534237b79669131b756e3c25fa9e3fb9a2877dfd
SHA512 722bf612263cea61df7c5f905830bc0d6df1d4156d9c8b5d386e800c2743d29b262ffec11b5fdaed7ccaf4325ea8b10293b332add8cb3d927695c982f21af22c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1202d8077c8d2a563bc357673cee6f40
SHA1 deeb99f1c6388aee9184a37b72a9c2cbd165e67f
SHA256 626527e764e826e159b8c3039e0c46800d408dee753563b58aaf16121ffb9f67
SHA512 1d3f4a0d43ac821672532fefb3d7f1689d9e2a0f2d0a134cc4d57436d8697d6353058c054f09d7a2ec3dce0f7c23d242812a567c7c2a83da4783996195ddd9b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 23bc9b4be980fc6133e079f546bebd64
SHA1 108c189f319f018d987fe140d9ce5ccd0a85a80a
SHA256 58059aadddf3581d3af42fbf3ff16c4f84243bd93d6ecc6cff45fbad2dc8698a
SHA512 b21d6e6d9b8b1d962c6073839225e9d1c60384bbb62311b02fd41fb4d5a1041234be3830ac1b7fc59c6439547d5a3f9518a3ad285b3cfd69f2f0722ac4cd8e74

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4fc02e012244b2f2389b34709fbb1291
SHA1 25de45e2fcf58069d4dbc4b6cfcf060e1dc04e6a
SHA256 689db4ad67c0372ead99c1e6e51bb7c6dcd1b2353c066dd33d41ea6eff2ec76e
SHA512 9c91f73863fbb34d6c44c1616f484bdf080bcd09f5506eb6713e0f92a3b2a40bffdd0aa3f418bad7c05cde9395602ae567cac4e17e76cc30a8e27df4e315a2ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c0bc2f80e018488823be94307be42a81
SHA1 5c56bb585b145cefd1bc54ce00cd4f2ce1854723
SHA256 4466497e24a4fd7652c043d8bc4ef88f17f039bd2f988831bfc9728198dcc511
SHA512 1aa5147fc6e8689683c078d891a84ee643bad7d0eac71835b1a3cecf131582af90f44d1f9e4cb99228a861d8c447bf1e27611fd84e4429eae67fe0cd8e34cc35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9940dac901349c62b31475b1ea88d909
SHA1 6657301d438474f00c0e63f5253a9f14446d3803
SHA256 bf800fb4838d82b53519117f74f587a91734332d77e1b3e2fc12649deeec3557
SHA512 deb643db5ff18eb7c3a16cc557e38e7f449255baae6ddb565bc63ac692d88e9abaa517e94c0a75a4b356ce0521db4edce132947eb3120ccd9e24bddc4e176f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5b2623ae00bcb80ae4fff4a35b24735
SHA1 b29fb87c3bdb6c34353803e378e48fa01878800d
SHA256 5212819386e624948ae81934de952946f824373a5c48506efd7aef5524118ead
SHA512 509a2132b406c51b5e4abd31b09a811d46e15dcc5a18e07f0a32b91ce88fc652d028fe2ad686993593dddd57c19e3f41d2c5f9cdd57b56ce546ba5db02789788

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6327f73a29420a55caee7df23760310
SHA1 9978fe0c275e35df86fdc3946769f903a46c9076
SHA256 e9883288b4175d04600ae012091cfc78ce59a4523bc8aa76fb13d5a14e8e11a4
SHA512 c58fabe4fd93f649e6434cc44effa729f09e2bfa03bf6a6be52217de10f5d9fe7a3c2ed7eefc376f1b537657adfd20c23fb761e75158b22f537861ed9aff455d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aa071ce3ac7ec0a9f76bc15b318d79e8
SHA1 5c1fc4e839500783d462f34eb0ab799abdac4c18
SHA256 eaa149ebe76080883a5cf5a79315bdeab10aeebbdd77a5384c327fd839d3e488
SHA512 acdf536959f778b3f327238baceee408347c446989575b7e06b5a7c69dff105e274771f9093966019ffbcb767b025c8f5f7e263f44272f5cbb41c1b8d5886a58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 76fa99a9140d318c1786cc811fa29e1e
SHA1 3dcb86226e47b8934358d4eac8bb9df8b0d27282
SHA256 a54bd7d9074f8b8cd83556809e21435c8a2e81f7f0385f5333bcf37bc89672e4
SHA512 35552ee49ee0fa9defd2c02dd35732097353fcf04c64fa05971193d283bf8e1213238d9606200766a8d0a832088a11f152d63ebb06148ed546fec9c0b9c4d466

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ba52cc4a773c72af4010c266e2a87c8
SHA1 f095fa511f5611a01568aebde09f1e7d5bb68b66
SHA256 fb95c846f010d4bf879d9da5e30a4285ef6ffaa3d592e8e6910ca546ce82c4bc
SHA512 0e41b5d85c57590c5c01d0ec62c079a9ecbc882d5a7f7d0981b7970e82908bc1216a994c83d7f05cd8adcba7c4a9f4099977d07928a79714d11d46082d3ca825

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ae86a704e7c377ca7c5700ab23bf10d
SHA1 e15a701bc2285aef861e310b108e2b86b65d1be4
SHA256 a51b1ee51d7f52a3fbb49536f54d639673b1cd42af16de9db6c52ca347e552f3
SHA512 2d5ceb46936ec9bdd6a2b6f85e9dd428bd67fa5ecedb2d8beb9a26119343ce7bd28b5dd176e40f1f306590a69e78d2e0a632a75e1c4a8dd61e090890b5358bd7

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-24 03:37

Reported

2024-07-24 03:39

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"

Signatures

Remcos

rat remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4284 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4284 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4284 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4284 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4284 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4284 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4284 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\schtasks.exe
PID 4284 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\schtasks.exe
PID 4284 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Windows\SysWOW64\schtasks.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 4284 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
PID 2936 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 2936 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 2936 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3664 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3664 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3664 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3664 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3664 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3664 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\schtasks.exe
PID 3664 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\schtasks.exe
PID 3664 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\schtasks.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3664 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
PID 3156 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 3156 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 3156 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 3156 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe C:\Windows\SysWOW64\svchost.exe
PID 2740 wrote to memory of 1268 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2740 wrote to memory of 1268 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 3668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 3668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1268 wrote to memory of 1988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe

"C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZjibU.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC709.tmp"

C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe

"C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZjibU.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFBA6.tmp"

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 learn.microsoft.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
GB 23.46.73.240:443 learn.microsoft.com tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 8.8.8.8:53 215.169.36.23.in-addr.arpa udp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 240.73.46.23.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 20.42.73.26:443 browser.events.data.microsoft.com tcp
US 20.42.73.26:443 browser.events.data.microsoft.com tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 mdec.nelreports.net udp
GB 23.73.139.11:443 mdec.nelreports.net tcp
US 8.8.8.8:53 11.139.73.23.in-addr.arpa udp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 learn.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp
US 107.173.4.16:2404 tcp

Files

memory/4284-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

memory/4284-1-0x0000000000E00000-0x0000000000EE4000-memory.dmp

memory/4284-2-0x0000000005F50000-0x00000000064F4000-memory.dmp

memory/4284-3-0x00000000058D0000-0x0000000005962000-memory.dmp

memory/4284-4-0x0000000005980000-0x000000000598A000-memory.dmp

memory/4284-5-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/4284-6-0x0000000005BE0000-0x0000000005C7C000-memory.dmp

memory/4284-7-0x0000000005D80000-0x0000000005D90000-memory.dmp

memory/4284-8-0x0000000006C00000-0x0000000006C0E000-memory.dmp

memory/4284-9-0x0000000006C40000-0x0000000006D00000-memory.dmp

memory/5116-14-0x0000000002110000-0x0000000002146000-memory.dmp

memory/5116-16-0x0000000004BE0000-0x0000000005208000-memory.dmp

memory/5116-15-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/5116-17-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/5116-19-0x0000000005280000-0x00000000052E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC709.tmp

MD5 1312fad2ce7820a0b0f788b12214a446
SHA1 dc4defaa5640cebe332d98fbe737f426047cffa6
SHA256 98faa34cb8378ef8326f42591e0488a5ed4e0660d6641b31d0f5d4af0b18b561
SHA512 0812942e0dbec3243e37f8e3a89a46e6e6c9418a88e317b19974d5e62e9fb57a07d6b11272112e747a869f6fcaebb2c5ef6119b998b23c637643639b447cd24c

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_asvn5whz.ecb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5116-28-0x0000000005420000-0x0000000005774000-memory.dmp

memory/1752-30-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/2936-35-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2936-31-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1752-22-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/5116-20-0x00000000052F0000-0x0000000005356000-memory.dmp

memory/5116-18-0x0000000004B60000-0x0000000004B82000-memory.dmp

memory/5116-38-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/4284-49-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/1752-50-0x0000000074A30000-0x00000000751E0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

MD5 e34683e560b0c2a5cddcffe98956ea62
SHA1 89a3dc3e4b06a8c4bd94bffc48adac82e620d910
SHA256 f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054
SHA512 4bf4a8fef3b740ba3e6a04bedaaa90970a60b72fc950d53de6e2bf597d89d5d399f9258f9f8088f0ea6304bfa219c5537271c9df59c463893d9589370a27ebff

memory/5116-99-0x0000000005A40000-0x0000000005A5E000-memory.dmp

memory/5116-100-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

memory/5116-111-0x00000000069E0000-0x0000000006A12000-memory.dmp

memory/5116-122-0x00000000069A0000-0x00000000069BE000-memory.dmp

memory/5116-112-0x0000000070110000-0x000000007015C000-memory.dmp

memory/5116-123-0x0000000006A20000-0x0000000006AC3000-memory.dmp

memory/1752-124-0x0000000070110000-0x000000007015C000-memory.dmp

memory/5116-135-0x0000000006D60000-0x0000000006D7A000-memory.dmp

memory/5116-134-0x00000000073B0000-0x0000000007A2A000-memory.dmp

memory/5116-136-0x0000000006DD0000-0x0000000006DDA000-memory.dmp

memory/1752-137-0x00000000070C0000-0x0000000007156000-memory.dmp

memory/5116-138-0x0000000006F60000-0x0000000006F71000-memory.dmp

memory/5116-139-0x0000000006F90000-0x0000000006F9E000-memory.dmp

memory/5116-140-0x0000000006FA0000-0x0000000006FB4000-memory.dmp

memory/5116-141-0x00000000070A0000-0x00000000070BA000-memory.dmp

memory/5116-142-0x0000000007080000-0x0000000007088000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ac1505474e2d61eb07d04eec0305481c
SHA1 bf9045a5a19b75e8490ef30145fdc2496a85a859
SHA256 06417354f2effb5243f3cb149a5592031958d293b041986d6de93df58a9aaa63
SHA512 e2a75be559727059609688d1108e712a3e0ad0999c53669ef49402c1ce928dc732ae6404a14c3c10bf278b9711fd4af425471052d85333c9dbea0fc0bbffae0e

memory/5116-147-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/1752-148-0x0000000074A30000-0x00000000751E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3856-161-0x0000000005DD0000-0x0000000006124000-memory.dmp

memory/3156-168-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-165-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2740-179-0x00000000008E0000-0x00000000009C4000-memory.dmp

memory/3156-164-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3856-181-0x0000000006760000-0x00000000067AC000-memory.dmp

memory/3856-182-0x0000000070EE0000-0x0000000070F2C000-memory.dmp

memory/3856-192-0x0000000007450000-0x00000000074F3000-memory.dmp

memory/3504-193-0x0000000070EE0000-0x0000000070F2C000-memory.dmp

memory/3856-203-0x0000000007740000-0x0000000007751000-memory.dmp

memory/3856-204-0x0000000007790000-0x00000000077A4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2b16d0c7acab2b3b072b01f91ed63bb8
SHA1 342ebb512d12ce2f73d23c53fb5245c239d67e2a
SHA256 a9a9a26fee97c824787bad702b4741ef475610ae1d465ca91c57f75cf1062311
SHA512 f1397b5bd9fc7c7fa5afe32f8147b8f81c8b6204cea9abdc0590416c818f426c4189dc3b1f9e723a27007dd336bc1dbac206b562cdce2bdb242909fe16cfa5eb

memory/3156-208-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-209-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-210-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 27f3335bf37563e4537db3624ee378da
SHA1 57543abc3d97c2a2b251b446820894f4b0111aeb
SHA256 494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA512 2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

\??\pipe\LOCAL\crashpad_1268_KCASSOYBPYYRDEHC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6c86c838cf1dc704d2be375f04e1e6c6
SHA1 ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256 dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512 a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 00ae43f52c585887e279c95e02fadd54
SHA1 7a8877ae1952f00319070f5ec89022b2050129e5
SHA256 e32a14439a8d6724933552a857a27fa732da91f1756eedf7c935555ca4d397c9
SHA512 85f2b83bcb865db315cd5f1eeb7ca13a2b8f9981d0662f3143aadae3a29ec002a30ce6fa192b1fc5f49749b1d7aa8d29abbbe424ed3515625b1751948bffea62

memory/3156-233-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-259-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-260-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/3156-271-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-276-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a06f5ec6610a5efccafb211f3cd623ec
SHA1 a1861481c0ff6db8280554ffa89d1e8b28ca3c89
SHA256 c79690a00ee9d2474707844b044da68fa6676796252df1f649b7292238d8324b
SHA512 2fa1cf23c890195f8672b72510d51441247108ee894794c7516fdea242883e0df1110cdeb9384b54c39bb9c0aaad878dd4cde0415327144ae642fceed57bac8e

memory/3156-282-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ac76c4d1c67e5a5e7506acc0f9d1a14f
SHA1 742b9c8afcfcae6f71f404ad8c5cf69e17b5a8d1
SHA256 aafacea03b2c3512e5d65783af923a7283a6c2d6da825325d4996a0ff3524023
SHA512 ec648322dd117349cb2b4197d727d92aa0eecfab3cf35528d119ffd2231b46665822ea87b0420daf1e065f8eb22a3c84c883187b3b19a35af59c9ed3bd5dd04a

memory/3156-294-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-332-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-333-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-334-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-339-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 f57bd672fe614986d4123ee65ef4f1df
SHA1 2cc726dbf325b3a303602098110a3a0906c03ba1
SHA256 6b26decf834976a09886a7af692ab99d01936cb8e9367803053f29eddf13ab3d
SHA512 a1df656360c2f18b3043e48be62c3fbee2c55b66cbd8c2b29e42065071549a1a52ea6a26d55581d7088b075bed2aedaf2d3a0d7985ebf59f488394854c907495

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 e51f388b62281af5b4a9193cce419941
SHA1 364f3d737462b7fd063107fe2c580fdb9781a45a
SHA256 348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c
SHA512 1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

MD5 c74489f38af9c35da06e303efdd81bf8
SHA1 0b6fe1b83b0e67e9494854ed3340b9f2048ce868
SHA256 82de249fcefe94d3c9ef4ea1c7e79964db15c77da30f06fbdf838ede96d01342
SHA512 b187cdae13496a6a727ae9387f95dba488cd9e9a2c370913c5d58630c9c46e13483c4f943d13710288b02e5a27a4c81faf6014be77c36606f2c522f675551c94

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 4cb103381d01620a0903b2740424bef0
SHA1 b6a41624013746e5ae4cef7313b700620178ae78
SHA256 7c6eec193672c93259e2786b8f2bdf52095e94a3602976d3fc2cc525e96a2733
SHA512 a581d6869df7039db5f16ceda188f10e2c77f6d5b034b3c9738dc2ad2f82b0968be42c4c35edf2ef460daf2e6b7fad6b369446f0c888f0c4140b05e843514394

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 34504ed4414852e907ecc19528c2a9f0
SHA1 0694ca8841b146adcaf21c84dedc1b14e0a70646
SHA256 c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810
SHA512 173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 522037f008e03c9448ae0aaaf09e93cb
SHA1 8a32997eab79246beed5a37db0c92fbfb006bef2
SHA256 983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7
SHA512 643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 240c4cc15d9fd65405bb642ab81be615
SHA1 5a66783fe5dd932082f40811ae0769526874bfd3
SHA256 030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07
SHA512 267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

MD5 870b357c3bae1178740236d64790e444
SHA1 5fa06435d0ecf28cbd005773f8c335c44d7df522
SHA256 0227bd6a0408946e9b4df6f1a340e3713759a42a7677bdb8cb34698e4edf541e
SHA512 7fc902e787b1f51b86d967354c0f2987ea9fd582fef2959831ea6dbc5e7bf998a8f24ba906f0ee99ae8493aeb0c53af06bee106d60b448ac50b827c63b1ed169

memory/3156-367-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9183a92c6b2dfbc224f10a6225172577
SHA1 d4202ee1df225b9d331d7da01450145e3bd56aca
SHA256 abb043b43c76f430a88e31fdf41958a4931ff24a682331e1cf86bf95f7b492d1
SHA512 5746c84edd406df409d7c762f21b7caff4ccf79e786ae00bb8377d53e383b00b64eb3e3635613e06be4dece95fc28bf2f06ef26ba8a7d765ca98ecb08ad675ad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e07.TMP

MD5 f1f61b937799bbc14d067de96f232455
SHA1 6230f41e59ae81cc9c85197cb4622f36e41897e0
SHA256 f17a50f63bc23c3e16585f75794de144bed2584ef6cf8fa008c401d06a24f54b
SHA512 b24b8513021fb87cc3d77d9a9fedf817eed6687383f7f76a459eb20badba3fdaaf1a08747ea795546f2fbec0cd44c65b7928388e3a9e3e1a9d5ea04156836596

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1ffd74e673a4128f167a69ec0868f748
SHA1 f573c39dbb18dec6d6a5d80bd4c537585cf5376e
SHA256 2064e74fce3590e34960a36a243378099c4ae79861777b3a0b2eccaaf22621dd
SHA512 4a7630f3c42f99d60a6d38013b1bd7264275513b5bb975291f16ca1677f400354f12b31c1ea43610ce19135b1c8d272ab7afd1a94fa7bda3eec2b38587394ec8

memory/3156-395-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-396-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-397-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-398-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-399-0x0000000000400000-0x0000000000482000-memory.dmp

memory/6000-401-0x0000000000A00000-0x0000000000AE4000-memory.dmp

memory/3156-432-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-433-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-434-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-435-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-436-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-437-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 049b47474a58f041056697268f266e70
SHA1 c90a620e4bebe12517151de9f24eb3a993bfce4c
SHA256 f44d71e5c527d3aebda3f6cfeb50a4b6384b7e159faa557cbce1a0e2e67205b7
SHA512 875ce315213594cdd97008326bdd706acb67a8d9b7d7c4c5dadf66291f8e466e479c07dfcad353368e9e12b8673fb68e39273408349bf81bc0b890a3bf8b5922

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 7662a3049b5c8e39261b66c1eabf9a4b
SHA1 50406c57c5ee1071da810d96d249ed6d030e8ad1
SHA256 e753de6982d8043538f9052ca370591f0bcc36eab66ec32540125f1c131ad5b2
SHA512 0d1f39cb1a25a78eb3d92f91635fbb24fa033f88622634a12f047b109a9d224f6753c6c082f932d2e0660f34a0e22b21852bf6dd7e112e75c9212594277bae8b

memory/3156-465-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-497-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-498-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-499-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5296-500-0x0000000000820000-0x0000000000904000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90f652e5e8d4540c_0

MD5 fe39f20d5f60fa5dcb29ed70ac8932f5
SHA1 b4cf082be4d1622b3a469aa15b50d9c150a62450
SHA256 95f0b59fabf1d39b10f5d5b253e031940b8e7d0f627ac3edff1f91b69540d679
SHA512 6fb260f5cd584e26e0a6240194290b64a60ef7b1cc747dc32cf3520057177b70e0ba0f2c1011e180d86480ea8071074fc4cc723696ffbf2b7da8cb27dd090ce7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8da6153505e57f2d_0

MD5 00d43f1e008380d6897bd371d6e9a741
SHA1 22a85b637fe4655dc81b55d50144275ffcb45b26
SHA256 3813745fb20925241e7b47c5247be95f59f72918d311899a83ef039006d9e342
SHA512 40e784c58cc3b57fbd50982729dc192b4ddfaa4f9c12f2262305fd8c43ddb7285fbbe6ff400d061bb69c7c93f77f45cd0b50ac53f1845c16683c76ee967ccfe2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4eb4ba1f217e5309_0

MD5 3b0bc127eeacaef84917c3d33d5c4b1f
SHA1 1efd409b15151aee2add660066640703f6763e51
SHA256 9d05c31ceeec9c191043c6f2e3381e3d73d9c5535e7021c47b1fa7d70c7a5cd8
SHA512 cc5b77d28a110479776286d9f640a04cce425d3f6dcb6b16cd9c112bef7ed7297b52e654da510c8d1f35d39346b061d177e5e63e1c66553e14f4a4c3beaea053

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\36015954e9c7528c_0

MD5 d583cda94a0c420157f6983b13529a65
SHA1 ae31d3d727209dc3cfd6c2083f61d8533afc8936
SHA256 631cd80a838826ae069987e1abcd9987df70b7480901461252d4fc6c7d565444
SHA512 4dc584d6da4b12ff1e39bc1729a115bd5f55ce040f4649f00856260822e681a7287f4aa956f33bb654cff722e228d6d6d9f89ec1d2816da91363e5b9a9a9d2d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3b888a45be8d5ea6_0

MD5 7c6479a48ccf05bb593fbba0a56509cf
SHA1 3b0a4ea7959b5909526b6ca73046fcb14d83d284
SHA256 949940a92ec2cf35c0b5ba591c51a6afb42236ee73c197b91418e200e1c046f8
SHA512 2b9922f6bf1ce92eebf08bf32b7516a59b493570ad32372168f5c7895ba4903cbe73da16f4d4f38831486cbf7c5fde56e45634b96d20cfbbc4f715c91708f8c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

MD5 1cf3d71023297cc06d1512f2a37d2f10
SHA1 387bf4bf1d11725e02d69ec400b9cc462b56551b
SHA256 c0da2d47ce89b36f95386e34cddcf4d1fb00e76d38f902e57307dbfc9abc8c4d
SHA512 9fb0ea2112c3b6d358a9c21b43c8e02ffe5ad8569e18f1fe4ff00218ce861898f60f8be8757d2084362908a0709a3c77d54395012feade341ac11732f8976b87

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

MD5 525b87b038419273b650f8f0026b9434
SHA1 22d7391ae6df8a63821850bd150d554ded5015ca
SHA256 3da1c8690a198de9b1218bf13e85fde3a7cf51e2edc71fc4d59a2cb2a01a7954
SHA512 771b2b0e694ad39190df339d20598dd42caaf1c93fda571893e867215ef2e1dc8bc9972c031938b860d1bd2bd3714e5b68a9af3fc3136ceeba5de8f070ec8b2d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c1e7c7fafbf8ea54_0

MD5 13ab91e89fb0059d69eaa23d86f1499a
SHA1 f673e975195ba5028df2a0a07b05aec7c3bd8e5e
SHA256 a3154511d582a7e0e96a7e9ba51c8e326d2d2913a762e53a59e098a60319828a
SHA512 f6ea2fac782477a9a3f338cd3bb5d12205dad1e987d7e15d3ffbb12931db5cb51fd242f5f5d6f1d13020c91d61473b15eadcaa5b8295e776cc2cce90976d58ba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

MD5 3bc8b1b2e3aa55a31d19d88113e0b117
SHA1 b9dcaf47ec8508bd2c2316eea65ab904ec7f0de7
SHA256 284b07511fdffcc7ad40bf2059c6d51efa9d451d5bf77ee003d87fbfd42d25e5
SHA512 9f5bbcbf4867643a97238a5fd575bba1b72cb18c327f86554f00bb90d9111b8ffad641ccf97fcab8b3e7259aae10e1595be268f37753c4de229f0ebc41dee563

memory/3156-532-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-533-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 41beff7378ec7bb81b535d3a0671114b
SHA1 fd2142a728060090418cfbc78f91368d289e6c42
SHA256 695dc9ef2a763fc841a6013daa08c565783133e312771d7281bc331ff26c045f
SHA512 c6754026c4c9de69db306ad36dd3bb178bae4f8a5244c9df30703585279646213055b3dedfcad3357d6cb793160709b3644c95a5e799cdcaade0011a3e54f712

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6089c283ff731d86ad64df6812861528
SHA1 199c1d67bcb76ecd85d5623945b25ae97cba09ad
SHA256 90315a39ed70a7efbb2b799707d985fde97f6a5ff819f30a042fdaccaf8a4c75
SHA512 5ce31a5d252c9c1613c873b79dbb6f6a8e088e0f69712fc72b43522454dad78024644a4ec49bca405bdd2cb21009414fbd923ab2bc07fb85e54b0bfc44f576e0

memory/3156-561-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-562-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-563-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-564-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-573-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-605-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-606-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-607-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4904-609-0x0000000000C70000-0x0000000000D54000-memory.dmp

memory/3156-640-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-641-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 484840ff89584f400e77d16d7207c647
SHA1 1493edc8ef23e59efa725d8c7a4c1bd3258872b6
SHA256 771305e192ed0e8b15a58fd7262a3ec838864cdfcb654f57a8ea2c7336215a9d
SHA512 8a843cd13b8ff3ea3966b67354f405b96f1de8163573ac878368fbf6dc6f9a665e3febaccc88f4da1073bb15fd27e489363d7dde880195e48c3fc8cb1a0d5037

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 bc77448a9b305df2021f6b78d1967658
SHA1 89f4a2c457a3d46f10d6b0c5749ca87a0cbfdb30
SHA256 c53f7d575aec21ae322ac55708086b06196ec2461beb1c1b8846da28ca3a9de6
SHA512 1c9cb3214439d94a9b52c8573377d357900b739948ad418fd906797f1de77e6a712987ea677823466876a87951cf1872618690d6bf21ed65c880a5db9e6d1ee4

memory/3156-674-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-675-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-707-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-708-0x0000000000400000-0x0000000000482000-memory.dmp

memory/960-710-0x0000000001000000-0x00000000010E4000-memory.dmp

memory/3156-741-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-742-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9fa1201bfe7148406605bb019db2f676
SHA1 bb10c43bea4ad43138bac86d4ad313fe3500f1a0
SHA256 7eea3b51abe242e7aab2e0ea45490ddd5de83c4a732b7e264d75e7011f675e01
SHA512 b41dd3c6f0d28dab57a0416f4ddb70cd8ef61aadc7fcfb716c872e955924deee6589b33af1ba754d92151b35efa935f923ded73c256e13ddf4ec8d3fd8d8ae1b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3c15ead3cba9476e7d52dd249a80fb84
SHA1 8d2fb349aa233f4fe9a1269a4f527dea3101c2a7
SHA256 ae2e6d1cd81a4eec23cba6835d0f65f3ae2a5f1820a0d1b0057f5477b4e96d90
SHA512 0027309c1d1ebd054565d811a76ef0398b587990639f45150c1ffc967a6d3de96e9e53758dc8986b8ddcd9aa99e03ba35ded53ecc1e6a681e37f0f1cd71ad027

memory/3156-770-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3156-771-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 03294611c5f8abfd353ef0d918daaa43
SHA1 8c858cf061fcc4f851db12d2bc0f9321960d3f6f
SHA256 b0ef1de4a495296c6d4ce54ff1797844a1334618d3a5a811b3654cab268de046
SHA512 c1598fbfe4d3ff7bea5ef75511d86389ec56826f93f8cf110ff535f9f1ac47f6772d987843dd42161c9b04b6eaff1aaecc13e96aae68214a0a445c78ca5049aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 97216ba191f6c648adce73eb41fb5ad0
SHA1 5f5f9a758cf4bd5338cfae4f603f34ef7f3b7503
SHA256 608a6671a418881285e1d80298f8609af9eee65b0bf1f3a7e4216400462d20f6
SHA512 66da11df68d1eefd0558f2725ac2ca8cf659a6c13400f1735e23a0b157e1e36eda37d33ab3323b3e58e94dc624fcec2e84ad4fce42cdfe67dceb27a6e57f18ac