Analysis

  • max time kernel
    784s
  • max time network
    754s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2024 12:54

General

  • Target

    virus.exe

  • Size

    483KB

  • MD5

    cbab80f7f17d6c3830a17d7fee29cd30

  • SHA1

    701eb7c9e2b662728f23dfaa34e634f11847aad7

  • SHA256

    eea9c58429ef1465aa760fada958b5d580e3ea0c2a40a7c11de9f5518f661706

  • SHA512

    e5b0acbeadadb3e75e2b8aa4794ab5fabe41de92dabc46120c84c6e0000da55900eecd7d12f1bb1a392b0dc9dbcb1e97fa7bf54a8281e6ebb2ca100d2c91fb90

  • SSDEEP

    6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccrRT4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZBKT4

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

mode-clusters.gl.at.ply.gg:36304

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    $77-Update of anti root

  • copy_folder

    WinDMRmanager

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-W4O1LZ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • UAC bypass 3 TTPs 2 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\virus.exe
    "C:\Users\Admin\AppData\Local\Temp\virus.exe"
    1⤵
    • Adds policy Run key to start application
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:3672
    • \??\c:\program files (x86)\internet explorer\iexplore.exe
      "c:\program files (x86)\internet explorer\iexplore.exe"
      2⤵
      • Adds policy Run key to start application
      • Deletes itself
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\SysWOW64\cmd.exe
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1808
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          4⤵
          • UAC bypass
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:3236
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:3780
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qvausfwbkeriznlfqhznxzk.vbs"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3024
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1624
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:368
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
        1⤵
        • Enumerates system info in registry
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe01dc46f8,0x7ffe01dc4708,0x7ffe01dc4718
          2⤵
            PID:4328
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
            2⤵
              PID:652
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2900
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
              2⤵
                PID:1672
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                2⤵
                  PID:3776
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                  2⤵
                    PID:760
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                    2⤵
                      PID:2400
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                      2⤵
                        PID:1752
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
                        2⤵
                          PID:4324
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5080
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
                          2⤵
                            PID:1356
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
                            2⤵
                              PID:1788
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4028 /prefetch:8
                              2⤵
                                PID:984
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3704 /prefetch:8
                                2⤵
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3024
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
                                2⤵
                                  PID:3300
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
                                  2⤵
                                    PID:1212
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                                    2⤵
                                      PID:760
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5896 /prefetch:8
                                      2⤵
                                        PID:5224
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                                        2⤵
                                          PID:5232
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6316 /prefetch:8
                                          2⤵
                                            PID:5280
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
                                            2⤵
                                              PID:5496
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
                                              2⤵
                                                PID:5632
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
                                                2⤵
                                                  PID:5640
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
                                                  2⤵
                                                    PID:5796
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
                                                    2⤵
                                                      PID:5804
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,3129973944271123311,6556830436289214599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4628
                                                    • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                      "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:5072
                                                    • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                      "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:368
                                                    • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                      "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:5952
                                                    • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                      "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:5664
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:2804
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:3260
                                                      • C:\Windows\system32\werfault.exe
                                                        werfault.exe /h /shared Global\bf46b2604e544ce1ab585397cb5b86eb /t 1484 /p 5072
                                                        1⤵
                                                          PID:4700
                                                        • C:\Windows\system32\werfault.exe
                                                          werfault.exe /h /shared Global\8c9c6855da9d4b6f88edec415c33c59b /t 5020 /p 368
                                                          1⤵
                                                            PID:5568
                                                          • C:\Windows\system32\werfault.exe
                                                            werfault.exe /h /shared Global\924519ecac5f417794db5f1a441f3d14 /t 5772 /p 5664
                                                            1⤵
                                                              PID:5412
                                                            • C:\Windows\system32\werfault.exe
                                                              werfault.exe /h /shared Global\86eeb5e8f0604915b8a54c814ea2f38c /t 5692 /p 5952
                                                              1⤵
                                                                PID:6064

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                719923124ee00fb57378e0ebcbe894f7

                                                                SHA1

                                                                cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

                                                                SHA256

                                                                aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

                                                                SHA512

                                                                a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                d7114a6cd851f9bf56cf771c37d664a2

                                                                SHA1

                                                                769c5d04fd83e583f15ab1ef659de8f883ecab8a

                                                                SHA256

                                                                d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

                                                                SHA512

                                                                33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                a0739f749afed095cf609766c8874d42

                                                                SHA1

                                                                3f1329314b91f08eb46006f57c851fe115261a4f

                                                                SHA256

                                                                77aa642f868d84522df9bd07d3ccb98a4a997d4bfa137c8ffb597e1dbd26c0c0

                                                                SHA512

                                                                1413bdad2a9d3f5ef7b44adae6523403dd3744f12bc000c6265de5e6bc9a3a7b7d5ae644a47213e44bc9a79999bfae1a32afba7fe0229cec8cbe8f32f5f0e28d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                Filesize

                                                                111B

                                                                MD5

                                                                285252a2f6327d41eab203dc2f402c67

                                                                SHA1

                                                                acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                SHA256

                                                                5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                SHA512

                                                                11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                Filesize

                                                                552B

                                                                MD5

                                                                911965790b083419cdd1fff2cfefbcce

                                                                SHA1

                                                                f669bb17ee530c5268b87af96ef71d2015b4719c

                                                                SHA256

                                                                5ed8fa6521514ecdf94ad1bb6bf7cd93837134a276f3f07ba3a26c23387db7e6

                                                                SHA512

                                                                6dbdbf31a97e6996d4362a8779d50687cd68891b8e2da6687c3ca71004b41ae5befb7f6ae10bb359be9c9fa80e48c5c4591e3c6f4d667f713833921c8c4f74ee

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                9171786386c57a1b58ed6dadbcd3757d

                                                                SHA1

                                                                596db8f510705d4978224ca8554580189a432283

                                                                SHA256

                                                                cc1caf38f99c4c88ccb8d5a68ad40c3a5574170645a36eda7e85e5a88b41bd72

                                                                SHA512

                                                                72cc48a04d0c18aa8932c44b583f5c29ba48cec5303fb9d5e84776c70a83b5a547055349277e2318586656c7bb75a73bbe0db978263847f7fda230641a172027

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                f7ed34b45b3f5d55e1d08465a83dc4c5

                                                                SHA1

                                                                d61b9ce3eecd7020de875439a7dccff62c0203b6

                                                                SHA256

                                                                274364474b3fb8d03d3d61ed1124bf7e2008c6dbf9bb965dc3bcb62375096824

                                                                SHA512

                                                                f127eb5e1857bf6b3a95355c1e33010264a6ef68e07abdaba83d91e8e605667ea964bc32b57e57519429a86b4da1b68cf8c0e71db234c7945f0bcc60195de572

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                f4e58eb37cb7b43e2075331b9c96df10

                                                                SHA1

                                                                90c1ff287b637d8094191984a9057eb3d2ea4a97

                                                                SHA256

                                                                e8a933de4370099826bcdd3bec038e2dc7864eddae231c6944c9125e14e3ebd4

                                                                SHA512

                                                                2025f164664fe5aba6f5daba5145cf61ccd63e9d70e05457149a2ed1723b352e4c4f0a2cf9f5cf503ea8ca2134b6b81924efd368e97fe22b6df87c3624c6ed26

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                7KB

                                                                MD5

                                                                11680724be44932def8c139758a539a0

                                                                SHA1

                                                                23e80c7d7421f7a492664f77f5bc03e83f97c07a

                                                                SHA256

                                                                c5371f8791d424db7f2e1dcef11619c1ecb1dd5403a232aa694d33afdeab8741

                                                                SHA512

                                                                b1da38b245592347fcb3911047d5893de8043f360d9d5cc29c94fe2b4c3cf43e112e9c41109e9170d4e1093b5b287366a63bdc194dda9b9011b37dbb7cefc5a6

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                Filesize

                                                                705B

                                                                MD5

                                                                3e46aa1b1be9873a64bc29e9100892e6

                                                                SHA1

                                                                b8b42de9b25f086240289a7e06064e8dc9585bd7

                                                                SHA256

                                                                c69bf45f6a454fd5e853d022e5734b0d1704f9655f8bc6492297471db2ccf2ac

                                                                SHA512

                                                                7f795d110a20528ef3f2ba11a06a6b30de52155652048cc7b7f40826619eb3845350f9472d362a4efa4944d6819a2186828e9c4afb436b400a013a8d311def5a

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b05f8.TMP

                                                                Filesize

                                                                705B

                                                                MD5

                                                                d1919e09bcd6de1b6493639b782e5530

                                                                SHA1

                                                                5222ade6ea8d0d0b4caf410d0b607bd1d18396a9

                                                                SHA256

                                                                12c2308f305a4b1defc9c1d03b5a7c6cacb981601f7a0de572629a8733aaa846

                                                                SHA512

                                                                712cdf43476d69bda35f0d51c90ac407286ef691d2be7d0329ab13314982db1837aa5b2ec9dbf07971cf8a57fbf8bc081374fd97cf7f583a27493b9cf86d61c1

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                Filesize

                                                                16B

                                                                MD5

                                                                6752a1d65b201c13b62ea44016eb221f

                                                                SHA1

                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                SHA256

                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                SHA512

                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                11KB

                                                                MD5

                                                                6acffa1bd8c22dacf927c1fcf6e5d4eb

                                                                SHA1

                                                                6e76264f3d2a18701f6f51459b1b5d3abd35b581

                                                                SHA256

                                                                c6b3c2ce9112eebb8cc454754a58bf6b894d0dcd23e66c8a9c42434f1d3a9b85

                                                                SHA512

                                                                490b4344a78cbdf91b72e1ed6c252ef2fdaeb7db5e5a09cfdcc166b77aad0f3a35d838b654710e0653e1d4ab931bb3fe857bc8dd0a0c35d36524932a4a5ec777

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                11KB

                                                                MD5

                                                                b08beb67321d41bdeb0f1e005cd87e26

                                                                SHA1

                                                                c751b323f4f774deb473f733f2394ee81ae9da0f

                                                                SHA256

                                                                4142292a33c55c9da40016c0a1354218bd808ded10e60bffe2abb043d9884f25

                                                                SHA512

                                                                a0af60981a72e7e01868c04dde1a904b5a4f7a02401de3bdacca3f1fb9a01b7c0fa4b69b9c28e94b15e34ec6d118edc31b09c1885c80da232a50588c68942a29

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                12KB

                                                                MD5

                                                                afefcb4bb24c9aea3e2c79d86e34b9b4

                                                                SHA1

                                                                4634c92472383c6d0c3279d98de9370d9e36b004

                                                                SHA256

                                                                581b688d72a8afd109c5b3aae3f66c7cb7dbe778819a242f1eb3eb0b6619fba5

                                                                SHA512

                                                                e63b0bee46b60392ddeca29a3a4547c627db6184be0c50ebef4de4cab364b1052e1eef48748b68424c17e50880557ed3d9fffabc63944fcce82cdff2a5307238

                                                              • C:\Users\Admin\AppData\Local\Temp\qvausfwbkeriznlfqhznxzk.vbs

                                                                Filesize

                                                                654B

                                                                MD5

                                                                f9903a94c05461ef865cd21d06b63a2f

                                                                SHA1

                                                                731f5328eb5461d1d6582f84ea1d7a3800e8758f

                                                                SHA256

                                                                d7ae25d8fe5a9c3bc85077dd2f22c017df803084978cf4a4c48a1aad37898ec5

                                                                SHA512

                                                                f1d8f1f63a6561119e7f1809e061ca8af05255da51e7f5ce6e08c3d8c91b3de117dc636d8c438add9895ed802ea105475d87f949a42d4598cea3305b56d415fe

                                                              • C:\Users\Admin\Downloads\Unconfirmed 711328.crdownload

                                                                Filesize

                                                                3.8MB

                                                                MD5

                                                                46c17c999744470b689331f41eab7df1

                                                                SHA1

                                                                b8a63127df6a87d333061c622220d6d70ed80f7c

                                                                SHA256

                                                                c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

                                                                SHA512

                                                                4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

                                                              • C:\Windows\SysWOW64\WinDMRmanager\$77-Update of anti root

                                                                Filesize

                                                                483KB

                                                                MD5

                                                                cbab80f7f17d6c3830a17d7fee29cd30

                                                                SHA1

                                                                701eb7c9e2b662728f23dfaa34e634f11847aad7

                                                                SHA256

                                                                eea9c58429ef1465aa760fada958b5d580e3ea0c2a40a7c11de9f5518f661706

                                                                SHA512

                                                                e5b0acbeadadb3e75e2b8aa4794ab5fabe41de92dabc46120c84c6e0000da55900eecd7d12f1bb1a392b0dc9dbcb1e97fa7bf54a8281e6ebb2ca100d2c91fb90

                                                              • memory/1648-37-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-34-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-39-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-40-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-41-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-42-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-43-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-44-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-45-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-46-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-47-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-49-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-50-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-51-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-52-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-53-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-54-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-55-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-56-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-57-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-58-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-59-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-62-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-63-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-64-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-36-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-66-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-67-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-35-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-38-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-33-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-32-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-30-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-29-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-28-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-27-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-304-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-305-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-17-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-18-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-15-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-594-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-558-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-557-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-424-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-19-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-16-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-548-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-549-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-550-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-551-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-552-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-553-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-554-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-555-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/1648-556-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/3780-23-0x0000000000F00000-0x0000000000F82000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/3780-25-0x0000000000F00000-0x0000000000F82000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/3780-26-0x0000000000F00000-0x0000000000F82000-memory.dmp

                                                                Filesize

                                                                520KB

                                                              • memory/3780-24-0x0000000000F00000-0x0000000000F82000-memory.dmp

                                                                Filesize

                                                                520KB