Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 19:18

General

  • Target

    9463baf89c0816593479fce4912fdbf9_JaffaCakes118.exe

  • Size

    636KB

  • MD5

    9463baf89c0816593479fce4912fdbf9

  • SHA1

    c09e70e1ee8f38e3ac3d795d1cf2b1a6adbe84fb

  • SHA256

    08c85e93e63fba43e25a3e7bf4e3d9b47783a8acf74a75be9eceffdc68d46cf4

  • SHA512

    9a0feb8ce55812fff31d4f8409205ea7cf5fa70933cb9610c906771f4a64a5ebf64d9002096781cd336dbd6a79131d8b574550edd40598a266a3a2134884e782

  • SSDEEP

    12288:RYa7QD5C5RnFtCG5ru8wAkyCxwHEbnut0GjHv53Hyhkm+1S6F:Rl7QlCznFx5y8w4Cxw90GzBXyh56

Malware Config

Extracted

Family

remcos

Version

3.0.2 Pro

Botnet

RemoteHost

C2

fgtrert.duckdns.org:8494

fgtrert.duckdns.orgqweerreww.duckdns.org:8494

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-JH7045

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9463baf89c0816593479fce4912fdbf9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9463baf89c0816593479fce4912fdbf9_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Users\Admin\AppData\Local\Temp\9463baf89c0816593479fce4912fdbf9_JaffaCakes118.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5040
          • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
            C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2864
            • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
              "{path}"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4180
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\SysWOW64\svchost.exe
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4724
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                  8⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:4996
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fb0746f8,0x7ff9fb074708,0x7ff9fb074718
                    9⤵
                      PID:2640
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                      9⤵
                        PID:4520
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                        9⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3452
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
                        9⤵
                          PID:3288
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
                          9⤵
                            PID:3648
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
                            9⤵
                              PID:4384
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                              9⤵
                                PID:1084
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
                                9⤵
                                  PID:4956
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
                                  9⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3936
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                                  9⤵
                                    PID:3960
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
                                    9⤵
                                      PID:2864
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                      9⤵
                                        PID:2452
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                        9⤵
                                          PID:3328
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                                          9⤵
                                            PID:3688
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                                            9⤵
                                              PID:452
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                                              9⤵
                                                PID:640
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                                                9⤵
                                                  PID:5288
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
                                                  9⤵
                                                    PID:5968
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
                                                    9⤵
                                                      PID:6056
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
                                                      9⤵
                                                        PID:5668
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
                                                        9⤵
                                                          PID:5536
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
                                                          9⤵
                                                            PID:5352
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
                                                            9⤵
                                                              PID:5388
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
                                                              9⤵
                                                                PID:5776
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
                                                                9⤵
                                                                  PID:5316
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
                                                                  9⤵
                                                                    PID:3924
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2269954697595730164,11953048632555566466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
                                                                    9⤵
                                                                      PID:3372
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                    8⤵
                                                                      PID:3800
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fb0746f8,0x7ff9fb074708,0x7ff9fb074718
                                                                        9⤵
                                                                          PID:4988
                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                      C:\Windows\SysWOW64\svchost.exe
                                                                      7⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4220
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                        8⤵
                                                                          PID:4984
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fb0746f8,0x7ff9fb074708,0x7ff9fb074718
                                                                            9⤵
                                                                              PID:4752
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                            8⤵
                                                                              PID:5872
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fb0746f8,0x7ff9fb074708,0x7ff9fb074718
                                                                                9⤵
                                                                                  PID:5888
                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                              C:\Windows\SysWOW64\svchost.exe
                                                                              7⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5900
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                8⤵
                                                                                  PID:5268
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fb0746f8,0x7ff9fb074708,0x7ff9fb074718
                                                                                    9⤵
                                                                                      PID:5608
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                    8⤵
                                                                                      PID:3680
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9fb0746f8,0x7ff9fb074708,0x7ff9fb074718
                                                                                        9⤵
                                                                                          PID:6088
                                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                                      C:\Windows\SysWOW64\svchost.exe
                                                                                      7⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:6076
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                        8⤵
                                                                                          PID:3828
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x40,0x7ff9fb0746f8,0x7ff9fb074708,0x7ff9fb074718
                                                                                            9⤵
                                                                                              PID:5724
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                            8⤵
                                                                                              PID:5812
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fb0746f8,0x7ff9fb074708,0x7ff9fb074718
                                                                                                9⤵
                                                                                                  PID:3392
                                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                                              C:\Windows\SysWOW64\svchost.exe
                                                                                              7⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5536
                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                  1⤵
                                                                                    PID:2884
                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                    1⤵
                                                                                      PID:3824

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                      Filesize

                                                                                      152B

                                                                                      MD5

                                                                                      e765f3d75e6b0e4a7119c8b14d47d8da

                                                                                      SHA1

                                                                                      cc9f7c7826c2e1a129e7d98884926076c3714fc0

                                                                                      SHA256

                                                                                      986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

                                                                                      SHA512

                                                                                      a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                      Filesize

                                                                                      152B

                                                                                      MD5

                                                                                      53bc70ecb115bdbabe67620c416fe9b3

                                                                                      SHA1

                                                                                      af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

                                                                                      SHA256

                                                                                      b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

                                                                                      SHA512

                                                                                      cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                                                                      Filesize

                                                                                      65KB

                                                                                      MD5

                                                                                      349e7e7f77a1d0f93abadd21b35c6617

                                                                                      SHA1

                                                                                      66843cb3a2d094c772e30e78a5170cc0210614ea

                                                                                      SHA256

                                                                                      56c19f26ecf68d2f2738a02a58596d221d3f569742c004e3b134181aed0d8f48

                                                                                      SHA512

                                                                                      0d493bdf92ca34be530ede767c8a0fdb872f479b0744036609f52912e02e2042df51ee0211e055f3a70965add0cef72442edc3e85fd4002cf5c95a1f478700ca

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                      Filesize

                                                                                      88KB

                                                                                      MD5

                                                                                      f57bd672fe614986d4123ee65ef4f1df

                                                                                      SHA1

                                                                                      2cc726dbf325b3a303602098110a3a0906c03ba1

                                                                                      SHA256

                                                                                      6b26decf834976a09886a7af692ab99d01936cb8e9367803053f29eddf13ab3d

                                                                                      SHA512

                                                                                      a1df656360c2f18b3043e48be62c3fbee2c55b66cbd8c2b29e42065071549a1a52ea6a26d55581d7088b075bed2aedaf2d3a0d7985ebf59f488394854c907495

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                      Filesize

                                                                                      79KB

                                                                                      MD5

                                                                                      e51f388b62281af5b4a9193cce419941

                                                                                      SHA1

                                                                                      364f3d737462b7fd063107fe2c580fdb9781a45a

                                                                                      SHA256

                                                                                      348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

                                                                                      SHA512

                                                                                      1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                      Filesize

                                                                                      259KB

                                                                                      MD5

                                                                                      34504ed4414852e907ecc19528c2a9f0

                                                                                      SHA1

                                                                                      0694ca8841b146adcaf21c84dedc1b14e0a70646

                                                                                      SHA256

                                                                                      c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810

                                                                                      SHA512

                                                                                      173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                                      Filesize

                                                                                      34KB

                                                                                      MD5

                                                                                      522037f008e03c9448ae0aaaf09e93cb

                                                                                      SHA1

                                                                                      8a32997eab79246beed5a37db0c92fbfb006bef2

                                                                                      SHA256

                                                                                      983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

                                                                                      SHA512

                                                                                      643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                                      Filesize

                                                                                      17KB

                                                                                      MD5

                                                                                      240c4cc15d9fd65405bb642ab81be615

                                                                                      SHA1

                                                                                      5a66783fe5dd932082f40811ae0769526874bfd3

                                                                                      SHA256

                                                                                      030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

                                                                                      SHA512

                                                                                      267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                                                      Filesize

                                                                                      464KB

                                                                                      MD5

                                                                                      8381178c451aa675d4a06ab5708367cd

                                                                                      SHA1

                                                                                      cde5214c5b61493850d6edeb0e18a4c4a1fbc0d4

                                                                                      SHA256

                                                                                      37fc5b4fa4e4da9825e2ca712d2ad650110031cc8f895dbc5edc9879d49770c1

                                                                                      SHA512

                                                                                      353770cfaadc3738c0d47103710ab2bcacfe30cef081ea761a421f967f2710d38b45660c0b4196eba05d9d49d0d828725889df12f1398491a70f38bd46ad4aba

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                                                      Filesize

                                                                                      18KB

                                                                                      MD5

                                                                                      870b357c3bae1178740236d64790e444

                                                                                      SHA1

                                                                                      5fa06435d0ecf28cbd005773f8c335c44d7df522

                                                                                      SHA256

                                                                                      0227bd6a0408946e9b4df6f1a340e3713759a42a7677bdb8cb34698e4edf541e

                                                                                      SHA512

                                                                                      7fc902e787b1f51b86d967354c0f2987ea9fd582fef2959831ea6dbc5e7bf998a8f24ba906f0ee99ae8493aeb0c53af06bee106d60b448ac50b827c63b1ed169

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\19a0b1e76a0cf0ac_0

                                                                                      Filesize

                                                                                      297B

                                                                                      MD5

                                                                                      fd18ae2dc21e19307e8b061f58b83f39

                                                                                      SHA1

                                                                                      04c045b03ca30c8d8fa85500b261358da77b87f7

                                                                                      SHA256

                                                                                      9e6497a486bb41a275fa2b040e6922c8588a71cf2c0fdfcb1e01d55902e49858

                                                                                      SHA512

                                                                                      66a0cf983e06a108bef4c978ad3ed07ed4af624d58bef0bfc9747bb897073d0d76e3c50b66523321479d4aed75ff8a0532528f75a0f6409677da9eba60d5063b

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

                                                                                      Filesize

                                                                                      272B

                                                                                      MD5

                                                                                      2f946477581aa19198c5bbe50324bd4d

                                                                                      SHA1

                                                                                      c412977ee2e8f1d8f2662287e2bf3a3f2bf96f68

                                                                                      SHA256

                                                                                      82b1bfc234e84d1c221e5fb187091b58cad37de6c3938dac6635606c6fd8494f

                                                                                      SHA512

                                                                                      ef43b1a984941180b8fccef46696bb7689da5d10013fb929df3303374a1f8666a89ea41a9b7e118c2e4f07eb713b1962ead22e4a93f5f09127988cff994e72be

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e5217b2b9f9bb58_0

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      dac26fff01e339f0ba7ac76d9ee88641

                                                                                      SHA1

                                                                                      fa712847f4564fbae3e6ea56e3b2e7fdf27e052a

                                                                                      SHA256

                                                                                      b77a9b7c569fd7ec1ecc7d746c2ea9ccd9e1d310070e93c3302ef8fd2a3f041d

                                                                                      SHA512

                                                                                      3175e45708fc0d688e4053a76b8ac4b824a78a08c2c8b980ff09772f34c55677fc72d61e9aa53b9d57a807d3b43b2d218de251d2776be51179f9021d4c9091e2

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\55ccf1a7cc22206b_0

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      d1f6121141d43565725a96f672933618

                                                                                      SHA1

                                                                                      28f65fc315052496e323fb477433bd5c4e2468f9

                                                                                      SHA256

                                                                                      92c67095c461ddbc5e35fdb1794c4f58d5c78398baa3a3a9d19fcb3816c3892f

                                                                                      SHA512

                                                                                      4d9bd4c4cc400eea7f725c6b5abae1e981f7bee0c36c8d0e6c7a45daffe847d1358fde768359f55b539581e9bfccab5b4f64227c92bafaa14240a9ad151a5b89

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61fb9f051a7ee3c0_0

                                                                                      Filesize

                                                                                      187KB

                                                                                      MD5

                                                                                      c58571abfe6fa878bd7e05bb554e80dc

                                                                                      SHA1

                                                                                      66ab0de5f75c52e56b7b68f1e95295c8dba81d07

                                                                                      SHA256

                                                                                      5973766b0f1bf2b6bfb2e8cf44d4a38ec1906a8f496b2167b51154906e9f93f0

                                                                                      SHA512

                                                                                      50bf1b5f202b1325b24ddef0f88098a870066eac896d8bf12d1226377017ff2000671c93c83a2a99581841bd0c2a80b98ce8c0b13b8c8cb50d85a789dce89b67

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

                                                                                      Filesize

                                                                                      291B

                                                                                      MD5

                                                                                      c9f26d7c980a7c34021af336d1666fb4

                                                                                      SHA1

                                                                                      d7e3442c268d58751156faf59166570bc4c05c16

                                                                                      SHA256

                                                                                      eddba943548485ec7a49858026ee8f00150b27a23d003d846db0f71e64ba3956

                                                                                      SHA512

                                                                                      26fc8cc7f8edb3b73ad088f2c8d98a1b4ed2a5151ca6352c491231d81e3624eb665c6fc183bff8de84657b8b29b2b8924608889459c7c378ada719e0864c1f63

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d421de81907d98c1_0

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      MD5

                                                                                      403124025e6bb87983ced37838ff304d

                                                                                      SHA1

                                                                                      c4e48aa60bda2e34295b06e0c4cc3eb4c97d9d11

                                                                                      SHA256

                                                                                      48598ae0dc8671f67a4d84dd942986d8bfe5a37016828a147a59deb5ccbc8190

                                                                                      SHA512

                                                                                      9a21cc6a8538a87ce30e39bff20474f97dae31fcc40786e2e273b80e2d3607f9ac57e44cac31b84f76e2861ce053d6e9cbf94bb20e16466005d8dfffda2134f6

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

                                                                                      Filesize

                                                                                      269B

                                                                                      MD5

                                                                                      ccb1eb935c7f2c7b105346ab958445da

                                                                                      SHA1

                                                                                      01e6d354b815126fa976acdfb77050ee6667c4f7

                                                                                      SHA256

                                                                                      b3e75ec95fd16b249d1424bc979918e30f8b4a3a008ac225d335566ce5fc73e3

                                                                                      SHA512

                                                                                      d045dd314729a7cbafd5ea8fff3b019917900b74e81c0cc871232221db178215e1651a55ad5d92e4b64c230e8de6ef009dbb63878a9c3f819cd6c8ff759cffea

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fc0bc688f67a8042_0

                                                                                      Filesize

                                                                                      295KB

                                                                                      MD5

                                                                                      d6eb156c3ec06564e9641993152320aa

                                                                                      SHA1

                                                                                      14ddd01347791dfcb4ab8b94104cc62cdf650584

                                                                                      SHA256

                                                                                      5d954df81a93e247cf83deab2b3637078567f26f3b306bfb88e1db2d28593c86

                                                                                      SHA512

                                                                                      5fa9f460d2b43050c8058765ae47e32d4d11263270e6eeb624e10a4078e89a921a2510300b7ac1ef8f124de2b901f6cbed7edf3274b6e24a0e26edf6f795a1b9

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                      Filesize

                                                                                      437B

                                                                                      MD5

                                                                                      05592d6b429a6209d372dba7629ce97c

                                                                                      SHA1

                                                                                      b4d45e956e3ec9651d4e1e045b887c7ccbdde326

                                                                                      SHA256

                                                                                      3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

                                                                                      SHA512

                                                                                      caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      7f4b128d2359dc7590fb1ebfcf2bca04

                                                                                      SHA1

                                                                                      18408eac6596c48666d23a8a88d380b026e07095

                                                                                      SHA256

                                                                                      6c02a9a95a311b6d79a6318a283ec447b3395277e9930696d8ab9d207fb1cb0a

                                                                                      SHA512

                                                                                      98c0852277b360ed15e93ba3998d2092ea8c0b0191f94ab9e225456bbeb0b3795cdfa34f4195bcdde699856075eb4cd1f491a16a9fcb6a723292b65ac638f711

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      9d519da210fa8cacd858373de0904740

                                                                                      SHA1

                                                                                      a4639aa5b97cebf549d38f096eafc5f03ec11335

                                                                                      SHA256

                                                                                      6c53bdafb41f214bb1c54de0a1ad5a958282b9e7e65032a70a1b8a0a94b3ef3d

                                                                                      SHA512

                                                                                      5f6c82611f71211ec163b94bc17fb478ffec8a8f2f3fc7ad7664a80d53704aacd0f6c9a8b55a225f9c9ff8612aa0fe9609b5ef61ef74738484185b5a4a9bb358

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      c5fceb4af0979c14cd38fc5876dab88d

                                                                                      SHA1

                                                                                      8cb552254586c591fc4d7684f6d2edb305c61209

                                                                                      SHA256

                                                                                      fe610e214d09bcba1a40e9464b5151eee504532a9b8e72b4f4277f4e87c0bba6

                                                                                      SHA512

                                                                                      2927bd7e0e391e375103105fd0f506635729c1258c6ae0ad74b4bce0206a6b6a0f90b18fffc75659bd31a3862c9d44b01148922373164c47b2c4ab33d65ddc27

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      24d1f538664e4fae09d741e5408c61a1

                                                                                      SHA1

                                                                                      d0564a3f78d7154279ff9d1bc565bb7fed43bc3b

                                                                                      SHA256

                                                                                      e5a249be317f1c18cd841a57361f962e13d9285ebe320ad72ac97910b2401d8d

                                                                                      SHA512

                                                                                      f77aec81d5b0af17c645cb2e15738c614c4efdafaa05ca63c372b7beb87965b5c01200fc77c5c474d8c86b6d9b3fed588d27c81bbd29ff6d41a41c541f412f09

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      1bf15f360ebffbf34e21c3d6ad0b03a0

                                                                                      SHA1

                                                                                      79f4dd362594b09c9cce6468c6c2562f274f7090

                                                                                      SHA256

                                                                                      e1ef15726c3073c3718082cad0de7e92c8cff1d0acb7df24c38a29b516f4ce07

                                                                                      SHA512

                                                                                      8cbc8c6c37a83583cd97ab54611ff0390122a180efe64368b55303de57e3bd2ba89bf102f7a9b70997dfcec9ccd3356a1e28949065982fc1faa4bd38117ae54d

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      5e72391dfb012786774337646a261b77

                                                                                      SHA1

                                                                                      c07a7bbe182791da0dbd244eb4b0538c9c3701a7

                                                                                      SHA256

                                                                                      5fa5ed4268c3aa1205bc0daf0b6d3e590b65330fd95ea1984c35c44f3425f0b5

                                                                                      SHA512

                                                                                      66dcdc49374a3bd2d136ac7323a3986ada92521a66e02a48c95a4d8a5695f0d1a4baf0fc5bdd6c313efcaab9f094d4d89a3745ff6e17886d421aa3c7f199472f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      371B

                                                                                      MD5

                                                                                      f1f4eaede6da2b6f64a96f9435ed5b09

                                                                                      SHA1

                                                                                      5fe4b7aa91f7da36898164144a0e3e429163c3ac

                                                                                      SHA256

                                                                                      7af2c06d5c3e012db453b4b3b18180b2882769cec4a59d594a1b1464ea070f25

                                                                                      SHA512

                                                                                      855b15631d2bafb9c6ac8f6d2fa50e3dc0d082e5e1d371d7b0f4a3000f54270d59d3eff52e97a640b54afdc22691b0e27d5bbdb9c2d4ae90ee7a02bc29fc6c60

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      371B

                                                                                      MD5

                                                                                      c0395ee1b394e61621d1b2e0c6ea989f

                                                                                      SHA1

                                                                                      ac65650b78f0aa909f812b4fb9b469a125669724

                                                                                      SHA256

                                                                                      0678a9f96f47ec72275afe10a6bf0b9cd5af9dc4e3bbe73e27535514fed19897

                                                                                      SHA512

                                                                                      2d3f432c9d89a0b507b6ddb6a47c54de2dbe8fce70ba806fd28a02465007ea799c7f8eab98d79b31f5d6b94de2e5499f2cb5e946caf43fd14a9dca611faeff15

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      371B

                                                                                      MD5

                                                                                      8fde047913b242eaa876599701351bc4

                                                                                      SHA1

                                                                                      f0bc3896f20d9eb07eeb8c94917c80c917c7d300

                                                                                      SHA256

                                                                                      1724846ff20409b03e22f2019ed5a6ddebcce1ed9a15df8232d1bac03d3b92f8

                                                                                      SHA512

                                                                                      ef44b056557149199c679e48dd5d90099106227360255028cb19a5d2719634356bd544e3bc4ac0b10b2318fed54169edea5225337a29fd26e2f8dd7795c22324

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      371B

                                                                                      MD5

                                                                                      c8c5d9d6ccb3494be583217f9184136b

                                                                                      SHA1

                                                                                      9b3a4f878d4b56b570fe209c9fa68a7bf90b38d6

                                                                                      SHA256

                                                                                      429a35d065c8cd9c20f899a5455d07acf1ef2651c07b916f06b4a4da3f5f70f4

                                                                                      SHA512

                                                                                      e71b232c086a4cce8eb8a03ab46c7d8081d8e2f91be7e830d675f096421855eb3283553f1c30f1a9d9d1764e2c2b06ddfcaca25c3ce8f998ec736f81cc9857fb

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593ca2.TMP

                                                                                      Filesize

                                                                                      371B

                                                                                      MD5

                                                                                      e77e74a896f34de8ae4088d5e42edfb7

                                                                                      SHA1

                                                                                      fc6ed7e4c3fc41d6bcaeb679698585cd5cf773b9

                                                                                      SHA256

                                                                                      4184b26c80e739b5c78980fd3d099a6d2b5c243837be013023cfc4cc8d7defeb

                                                                                      SHA512

                                                                                      a9fe95c56c7aed380442e67e58ea819d66bf24f9c3ca1b19c60aa0f837f17f966a7c3f637f35e0c256a7b695e98ccd9186ed19d7ecf70d86b9157cc124173958

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                      Filesize

                                                                                      16B

                                                                                      MD5

                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                      SHA1

                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                      SHA256

                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                      SHA512

                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      12d885234c5ec1a20a6bf30bc6b81f4f

                                                                                      SHA1

                                                                                      3670e7b8ac39ac267ec2e45f6d1f9dc08bd1f101

                                                                                      SHA256

                                                                                      1275e48c91f57ed0ff5db37827123ffe15d1ba2e8f8f1aedea7af636a923c0df

                                                                                      SHA512

                                                                                      e449817bd581976cbbd0c9f04126e01cf145519aeb0990ec21e2f5f623d88f63350be83dfd2e25d189518060f0e3a0df5784aa7e3b7244da4b95f77a1df9f134

                                                                                    • C:\Users\Admin\AppData\Local\Temp\install.vbs

                                                                                      Filesize

                                                                                      418B

                                                                                      MD5

                                                                                      b92d64fe5b1d1f59df4b738262aea8df

                                                                                      SHA1

                                                                                      c8fb1981759c2d9bb2ec91b705985fba5fc7af63

                                                                                      SHA256

                                                                                      fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a

                                                                                      SHA512

                                                                                      2566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2

                                                                                    • C:\Users\Admin\AppData\Roaming\Remcos\logs.dat

                                                                                      Filesize

                                                                                      111B

                                                                                      MD5

                                                                                      0569a0f59c4ae31ce33710bd8b1e6fdd

                                                                                      SHA1

                                                                                      98bdd45eec83cc27c1e5c079f8eb8fae65d2d9af

                                                                                      SHA256

                                                                                      5f8bd1ec3022ed2be2359ca181b89dd009f2c04e590efef74fff20bf8a9410d9

                                                                                      SHA512

                                                                                      b6cb7754113ab8f4ef4d707fe7ee5778f5b2c6689572e25759f98d5b1c353f55824bd16d676722cebc82ff9a75404e458a68b2f4bde8664897731725664bcfa5

                                                                                    • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

                                                                                      Filesize

                                                                                      636KB

                                                                                      MD5

                                                                                      9463baf89c0816593479fce4912fdbf9

                                                                                      SHA1

                                                                                      c09e70e1ee8f38e3ac3d795d1cf2b1a6adbe84fb

                                                                                      SHA256

                                                                                      08c85e93e63fba43e25a3e7bf4e3d9b47783a8acf74a75be9eceffdc68d46cf4

                                                                                      SHA512

                                                                                      9a0feb8ce55812fff31d4f8409205ea7cf5fa70933cb9610c906771f4a64a5ebf64d9002096781cd336dbd6a79131d8b574550edd40598a266a3a2134884e782

                                                                                    • \??\pipe\LOCAL\crashpad_4996_XTHLRWWCYIOOWEAF

                                                                                      MD5

                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                      SHA1

                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                      SHA256

                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                      SHA512

                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                    • memory/972-11-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                      Filesize

                                                                                      480KB

                                                                                    • memory/972-12-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                      Filesize

                                                                                      480KB

                                                                                    • memory/972-21-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                      Filesize

                                                                                      480KB

                                                                                    • memory/972-18-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                      Filesize

                                                                                      480KB

                                                                                    • memory/972-14-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                      Filesize

                                                                                      480KB

                                                                                    • memory/2292-6-0x0000000005B60000-0x0000000005B68000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/2292-5-0x0000000075370000-0x0000000075B20000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/2292-0-0x000000007537E000-0x000000007537F000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/2292-1-0x0000000000DF0000-0x0000000000E96000-memory.dmp

                                                                                      Filesize

                                                                                      664KB

                                                                                    • memory/2292-2-0x0000000005F70000-0x0000000006514000-memory.dmp

                                                                                      Filesize

                                                                                      5.6MB

                                                                                    • memory/2292-10-0x0000000008110000-0x00000000081AC000-memory.dmp

                                                                                      Filesize

                                                                                      624KB

                                                                                    • memory/2292-9-0x0000000075370000-0x0000000075B20000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/2292-8-0x000000007537E000-0x000000007537F000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/2292-3-0x00000000058B0000-0x0000000005942000-memory.dmp

                                                                                      Filesize

                                                                                      584KB

                                                                                    • memory/2292-7-0x00000000081B0000-0x000000000824C000-memory.dmp

                                                                                      Filesize

                                                                                      624KB

                                                                                    • memory/2292-17-0x0000000075370000-0x0000000075B20000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/2292-4-0x0000000005840000-0x000000000584A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/4180-33-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                      Filesize

                                                                                      480KB

                                                                                    • memory/4180-30-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                      Filesize

                                                                                      480KB

                                                                                    • memory/4180-29-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                      Filesize

                                                                                      480KB