remcos | d0dde0ce53f187ed39096c8f44d89ad1afabe101156e03ce4a92f0021e74007a

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
Size 613KB
Sample240809-3ly21aveln
SHA256 d0dde0ce53f187ed39096c8f44d89ad1afabe101156e03ce4a92f0021e74007a
MD5 8400ac59c05641bb26fd40e2236a20df
SHA1 8540cb6c0edd6f63d177e06e67f14a5e89cc8aba
SHA512 b0b7dbb7282ea12793293d5790c26ada1c0225df524fe7b7f168890f35f82cbef06126cb38f064ecb70f440cb7e2838a284bd3ec4817ba7baeb99aff2bdf47f6
SSDEEP 12288:Hv6GE26ZFEQgy6U4pslkXkkE+oApCJWX0iSxevT:P6GReF2yZssgXp8WX0FxK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

sandshoe.myfirewall.org:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
svchost.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-8T826N
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4280	svchost.exe
4304	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\svchost.exe\""	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\svchost.exe\""	svchost.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4280 set thread context of 4304	4280	svchost.exe	110
PID 4304 set thread context of 4488	4304	svchost.exe	111
PID 4304 set thread context of 4336	4304	svchost.exe	136
PID 4304 set thread context of 4424	4304	svchost.exe	145
PID 4304 set thread context of 3080	4304	svchost.exe	154
PID 4304 set thread context of 4416	4304	svchost.exe	163

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
2724	msedge.exe
2724	msedge.exe
3068	msedge.exe
3068	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4304	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 1184	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	94
PID 4336 wrote to memory of 1184	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	94
PID 4336 wrote to memory of 1184	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	94
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 4336 wrote to memory of 3584	4336	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	95
PID 3584 wrote to memory of 4920	3584	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	96
PID 3584 wrote to memory of 4920	3584	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	96
PID 3584 wrote to memory of 4920	3584	8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe	96
PID 4920 wrote to memory of 3832	4920	WScript.exe	98
PID 4920 wrote to memory of 3832	4920	WScript.exe	98
PID 4920 wrote to memory of 3832	4920	WScript.exe	98
PID 3832 wrote to memory of 4280	3832	cmd.exe	100
PID 3832 wrote to memory of 4280	3832	cmd.exe	100
PID 3832 wrote to memory of 4280	3832	cmd.exe	100
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4280 wrote to memory of 4304	4280	svchost.exe	110
PID 4304 wrote to memory of 4488	4304	svchost.exe	111
PID 4304 wrote to memory of 4488	4304	svchost.exe	111
PID 4304 wrote to memory of 4488	4304	svchost.exe	111
PID 4304 wrote to memory of 4488	4304	svchost.exe	111
PID 4304 wrote to memory of 4488	4304	svchost.exe	111
PID 4304 wrote to memory of 4488	4304	svchost.exe	111
PID 4304 wrote to memory of 4488	4304	svchost.exe	111
PID 4304 wrote to memory of 4488	4304	svchost.exe	111
PID 4488 wrote to memory of 3068	4488	svchost.exe	112
PID 4488 wrote to memory of 3068	4488	svchost.exe	112
PID 3068 wrote to memory of 1672	3068	msedge.exe	113
PID 3068 wrote to memory of 1672	3068	msedge.exe	113
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114
PID 3068 wrote to memory of 1216	3068	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
  "{path}"
  2⤵
  PID:1184
- C:\Users\Admin\AppData\Local\Temp\8400ac59c05641bb26fd40e2236a20df_JaffaCakes118.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3832
    - - C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4280
      - C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:1672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        9⤵
        
        PID:1216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
        9⤵
        
        PID:1260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        9⤵
        
        PID:1284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        9⤵
        
        PID:1788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
        9⤵
        
        PID:64
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
        9⤵
        
        PID:3296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
        9⤵
        
        PID:4464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
        9⤵
        
        PID:2052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
        9⤵
        
        PID:2996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
        9⤵
        
        PID:4000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
        9⤵
        
        PID:1620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
        9⤵
        
        PID:1744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        9⤵
        
        PID:2660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
        9⤵
        
        PID:4484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
        9⤵
        
        PID:4476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
        9⤵
        
        PID:2900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
        9⤵
        
        PID:2472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
        9⤵
        
        PID:3956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
        9⤵
        
        PID:1232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
        9⤵
        
        PID:4724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
        9⤵
        
        PID:3424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
        9⤵
        
        PID:4780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
        9⤵
        
        PID:3436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
        9⤵
        
        PID:2356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
        9⤵
        
        PID:4176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8462784734209636270,1517029762234347468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
        9⤵
        
        PID:3512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:2336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:452
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:3652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:4360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:2508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:4548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:2760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:2468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:3768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:3740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:3248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:4084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xc0,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:2488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:3520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8faa346f8,0x7ff8faa34708,0x7ff8faa34718
        9⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b2be14a1372115d7f53c2e179b50655e0d0b06b447a9d084b13629df7eec24ab
MD5 9eb20214ae533fa98dfbfdc8128e6393
SHA1 c6b5b44c9f4fff2662968c050af58957d4649b61
SHA512 58648305f6a38f477d98fcc1e525b82fc0d08fb1ab7f871d20bd2977650fa7dafa3a50d9f32e07d61bd462c294e7b651dc82b6a333752ca81682329a389ae8c6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c286da52a17e50b6ae4126e15ecb9ff580939c51bf51ae1dda8cec3de503d48b
MD5 d18f79790bd369cd4e40987ee28ebbe8
SHA1 01d68c57e72a6c7e512c56e9d45eb57cf439e6ba
SHA512 82376b4550c0de80d3bf0bb4fd742a2f7b48eb1eae0796e0e822cb9b1c6044a0062163de56c8afa71364a298a39c2627325c5c69e310ca94e1f1346e429ff6ab
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 620937ce58922bb06457eee134ed65925361ae9dfcc416a6f9a7efa5b03ea2c1
MD5 e790c0d1f89212a9a244ac6bd8784db1
SHA1 7d8b0aa2df2df86091650819b32d017a12bd4eb4
SHA512 0550fa3916523b8c79ee510db71c86300eecee09e7f5c44821a30d036f890f1990654d1cb50956ae0b08acfd218363f4b867e173e56638609cedc1470d3cd5b8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 930067d39c71908816f5ee19af07b17c6955a6dc53b719a8e57082a912c6aaef
MD5 19f854f133fbb12aeb856c07ccefb046
SHA1 f1fee68a0f601b70903f9d2c5dac353aca32a23d
SHA512 990f357a777d7886fadbc8e55dd161e3406a28ab6dbb0f01f6eef7894a9acad83de821728e85aa52a684a2f72ae172ededf9fdc09f7eaa5af6fb5e163aa2f898
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 973c52bc199c9fb89bdfd945f21186882956a63a4518d5bc77bdfd3be639c5aa
MD5 37609cf7af29ddbdd0d5f18b8fb53c61
SHA1 6b5a336d062b604b8bd51b63ee22c6fe9aa961be
SHA512 4f78ca4e39c7f20d23df83d57e9c59a8aa531a1b79aa7a139e21e9305803a2d56f909cc6f79e5b1b59855c6e6fc78c618f8ab7ea26b3710d3580282cdec4618d
SSDEEP 96:n6kIYgm/L6mqt1ytPwpvWMoiVmde1Kuh41jmxQCUWQyV+VD7AiEwb:n6kRNiEtPGWMouh4hWrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 48f4dde2c797da6860566b054ffedf28c668416426ead04fb4effbc8e9376de9
MD5 856faa1a114466ed187b4ee7f6cabbb4
SHA1 892a0c8fbbc31d5a7ab2d918e9d9aee0e45e5272
SHA512 c5ea883bb623500cc84c823671bdf762c5b31e08fd6c6bba1404126c05883427375b392a095ad6e51b4fb55a6054e7dddf9e83b8a1e1233c67500ebfc715dcba
SSDEEP 96:n6kIYgm/LQYmqt1yt/wpvWMoiVmdeHm9QCUWQyV+VDCziEwb:n6kRAiEt/GWMXcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e1c1fce143be2b2f297afd7f6cc58a0212546689d6c911a64eb232dc80ebd4ac
MD5 1923d56e7ba63fc70d218e21098cb08a
SHA1 1828bc6858eaa0328ae8664c5710b1a0becdaab7
SHA512 73e2f4b6814aa4949b50503027eabc1166bc029778acb0535ffe33549657464576e2a06e81ade8e7e912f6d8dd25022a253d41cd7c5dac44ffed0fce5b054fcf
SSDEEP 96:n6kIYgm/L6mqt1ylPwpvWMoiVmde1Kuh41jmxQJUWQyV+VD7AiEwb:n6kRNiElPGWMouh4h1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 754dca9404f119306b757d135efbab8856521366fe9a3961c5373dda2a57becd
MD5 6be217d826ff7c4aa81d39663a38dc10
SHA1 b32f46cf12fc4821f702880382f18ef3714eec66
SHA512 306a06b11f079ad10db885200c0bbe37b56bd9687024e18fa84cfb95663f8fb00debebb381e030d5e6c4daca8eddcf180a37668745ec4972ef732dcb0bd4296d
SSDEEP 768:nvgW1h8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/Llp8rUSl8Fh:nvgW1hu1jaKLrSlMh
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 62fdbb648b0bc750053f78a47a244f08ea69cd10b105547fe4fac63d56d76f23
MD5 8c24bb6f058d5cf645094a43895b3519
SHA1 ae088f45e2c0052a4f5479adacc553e5eefdbd31
SHA512 953e1f00ac1d65fde188e50730cb496a9ab8e1fd5ab142a475dbe5cc4992778654bd92dada9d30b69496661f10d4609562e801975f681ec3e68e9fb454502399
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 29fe334f85078acf35bb53afc3b061f82d4747f5df497f6c3fc5348bfb8fb048
MD5 905228f02a0774f6fb75dba4affe3710
SHA1 ce10efd157094508c3d751990b1eea7cee3a4e53
SHA512 2c28fde48d179de566721104ca9e5ef61a36bc00f188b0ffea7133cbb044797df480bd08c5c8e5e9fc9fc9f5b1232be2ee2627bfc5df6feba0932ab91bbf0c9b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 813b0d2021ad78a5d4c3f85a4de7416977de6c3cc63295badae00dfacc32c63c
MD5 d809b7265af5772f41edb59a33cff57f
SHA1 d4fcbcf865d6b68ccab5cdd951f5ad0543e85416
SHA512 22548158d2637ef7e6581589ea010ca23535f20a4eb5709242798bc7a6890898e2a01dc827bcea9a190db3b84c50a996dd3a242c93a9f75ee8716eb189091c7c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 9ee0286a593a2a66a7c7a703d1ca11feaa3edcb53da42681fbcde066f823fde9
MD5 da9e12c83d358accb38990cb038dd9e6
SHA1 a1c9c5a94b8c5e40d745ddaaf06a0dc6312ca297
SHA512 46789756d42542e157f939c9544d832d704f5e45456133ba5080b8c7603542f16567ced542be1168a7cf2baec29965e7f85ce7d5303bcd003e7a4eb54e66cc44
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58f047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f047.TMP
Size 371B
SHA256 69253569066858131503c2fc751b8fea402730f0cdd27895a28bfcffa12e6a94
MD5 e34e3715712b51b4f38ffb405ce18cff
SHA1 61cac5cbb1c63651594ece47d813ae3a314e9af9
SHA512 7fccb2cf4626c73046664423b76964cb6e283eaa26ba2359d46204f3d6806ea38cafa14452f7222c78427b1bc607426e9f4465e40d2a446d05830c16edc937ce
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 bef6990cd5f2e53f19ddbc14c94044f50b09e739951c8d398010d3c356159d2a
MD5 e1998a4e42c75aae1a693ac777071bd4
SHA1 5d622714ab9babe4b72b78a2fd334ad6ec187629
SHA512 4834733320ecdf6652128519cb6a1b32b62fdeee1478def2ccbdd6bd14853ea02a1ea6021fbc6ad85035ac595b384ad67012af66123afbcbe85f337128e60721
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupre2RUQlYO2Vru8z8ZJJ:A9iIxuERzA83h09RZxY7f2VPz8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 420B
SHA256 4f19248011c8de17ee236772e367532e2fc946c209e3a777da4925eb86fdeab7
MD5 19a866a859bf53960e0838991626b634
SHA1 068d247b78fcef6c5fdcd06a69479c1852d72b66
SHA512 9ff83f6ee2f8bba5effc9e596961a263c0397a0f286b2f54ad430486b607260f8e531e7e10617352fada3a4572a370e80522cdb136b56f480a95de42d4210520
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\Remcos\logs.dat
Size 111B
SHA256 01a1840a26f608edb854cd99d4178fe52d95c80e378e2ff5415b82a5155928fe
MD5 869ce3410162c751d8f67f0052a0a66c
SHA1 45c6e7247ed0edba3815ede39f12c42b87f8a6a3
SHA512 57121a4fde2167c8e455e098cc3e2b3467f046669de379248db7e54bbce519f0372896c50a0f3c9538f8261e38ae658c0aa3e43858f81b87f465622bc060f349
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe
Size 613KB
SHA256 d0dde0ce53f187ed39096c8f44d89ad1afabe101156e03ce4a92f0021e74007a
MD5 8400ac59c05641bb26fd40e2236a20df
SHA1 8540cb6c0edd6f63d177e06e67f14a5e89cc8aba
SHA512 b0b7dbb7282ea12793293d5790c26ada1c0225df524fe7b7f168890f35f82cbef06126cb38f064ecb70f440cb7e2838a284bd3ec4817ba7baeb99aff2bdf47f6
SSDEEP 12288:Hv6GE26ZFEQgy6U4pslkXkkE+oApCJWX0iSxevT:P6GReF2yZssgXp8WX0FxK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3584-21-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3584-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3584-14-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3584-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4304-33-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4304-30-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4336-0-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

Download

memory/4336-18-0x0000000074F20000-0x00000000756D0000-memory.dmp

Download

memory/4336-10-0x0000000005F10000-0x0000000005F5A000-memory.dmp

Download

memory/4336-9-0x0000000074F20000-0x00000000756D0000-memory.dmp

Download

memory/4336-8-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

Download

memory/4336-7-0x00000000050F0000-0x0000000005102000-memory.dmp

Download

memory/4336-6-0x0000000005E70000-0x0000000005F0C000-memory.dmp

Download

memory/4336-5-0x0000000074F20000-0x00000000756D0000-memory.dmp

Download

memory/4336-4-0x0000000004AF0000-0x0000000004AFA000-memory.dmp

Download

memory/4336-3-0x0000000004B70000-0x0000000004C02000-memory.dmp

Download

memory/4336-2-0x0000000005120000-0x00000000056C4000-memory.dmp

Download

memory/4336-1-0x00000000000B0000-0x0000000000150000-memory.dmp

Download