remcos | 9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2024, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
Size

942KB
MD5

ff7b8b27ec6f3cdef9dfbc0fcb57df56
SHA1

611888477ad5326b1c0cecbbac6a032bdcc575f7
SHA256

9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd
SHA512

ac39055c817f503b7b3b16877cd5ae233d2cc79b15aa9f69cb88805515a19956c0493f709bf00fc6cf69f721024d7766a458d6cced5a3bf32f9b4cf3ec8296fb
SSDEEP

24576:KYivTP1eho7U79mBsGJVxq0VqMsaYcUSTOimuZx0C:KYO1ooQkZT8baBeimye

Score

10^/10

remcos execute discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

execute

cjmancool.dynamic-dns.net:3764

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GP2WRC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1128	powershell.exe
2632	powershell.exe
3700	powershell.exe
332	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe

Executes dropped EXE 2 IoCs

pid	Process
3820	remcos.exe
772	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 3820 set thread context of 772	3820	remcos.exe	108
PID 772 set thread context of 1664	772	remcos.exe	109
PID 772 set thread context of 3184	772	remcos.exe	133
PID 772 set thread context of 668	772	remcos.exe	142
PID 772 set thread context of 5988	772	remcos.exe	151
PID 772 set thread context of 2012	772	remcos.exe	160
PID 772 set thread context of 1420	772	remcos.exe	169
PID 772 set thread context of 2528	772	remcos.exe	178

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1596	schtasks.exe
4476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
2632	powershell.exe
1128	powershell.exe
1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
2632	powershell.exe
1128	powershell.exe
3820	remcos.exe
3820	remcos.exe
3820	remcos.exe
3820	remcos.exe
3700	powershell.exe
332	powershell.exe
3820	remcos.exe
332	powershell.exe
3700	powershell.exe
4372	msedge.exe
4372	msedge.exe
396	msedge.exe
396	msedge.exe
5052	identity_helper.exe
5052	identity_helper.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
772	remcos.exe
772	remcos.exe
772	remcos.exe
772	remcos.exe
772	remcos.exe
772	remcos.exe
772	remcos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	3820	remcos.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeDebugPrivilege	332	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
772	remcos.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1128	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	87
PID 1644 wrote to memory of 1128	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	87
PID 1644 wrote to memory of 1128	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	87
PID 1644 wrote to memory of 2632	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	89
PID 1644 wrote to memory of 2632	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	89
PID 1644 wrote to memory of 2632	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	89
PID 1644 wrote to memory of 1596	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	91
PID 1644 wrote to memory of 1596	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	91
PID 1644 wrote to memory of 1596	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	91
PID 1644 wrote to memory of 1368	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	93
PID 1644 wrote to memory of 1368	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	93
PID 1644 wrote to memory of 1368	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	93
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1644 wrote to memory of 1636	1644	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	94
PID 1636 wrote to memory of 3576	1636	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	95
PID 1636 wrote to memory of 3576	1636	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	95
PID 1636 wrote to memory of 3576	1636	9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe	95
PID 3576 wrote to memory of 4824	3576	WScript.exe	98
PID 3576 wrote to memory of 4824	3576	WScript.exe	98
PID 3576 wrote to memory of 4824	3576	WScript.exe	98
PID 4824 wrote to memory of 3820	4824	cmd.exe	100
PID 4824 wrote to memory of 3820	4824	cmd.exe	100
PID 4824 wrote to memory of 3820	4824	cmd.exe	100
PID 3820 wrote to memory of 3700	3820	remcos.exe	102
PID 3820 wrote to memory of 3700	3820	remcos.exe	102
PID 3820 wrote to memory of 3700	3820	remcos.exe	102
PID 3820 wrote to memory of 332	3820	remcos.exe	104
PID 3820 wrote to memory of 332	3820	remcos.exe	104
PID 3820 wrote to memory of 332	3820	remcos.exe	104
PID 3820 wrote to memory of 4476	3820	remcos.exe	106
PID 3820 wrote to memory of 4476	3820	remcos.exe	106
PID 3820 wrote to memory of 4476	3820	remcos.exe	106
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 3820 wrote to memory of 772	3820	remcos.exe	108
PID 772 wrote to memory of 1664	772	remcos.exe	109
PID 772 wrote to memory of 1664	772	remcos.exe	109
PID 772 wrote to memory of 1664	772	remcos.exe	109
PID 772 wrote to memory of 1664	772	remcos.exe	109
PID 1664 wrote to memory of 396	1664	svchost.exe	111
PID 1664 wrote to memory of 396	1664	svchost.exe	111
PID 396 wrote to memory of 4144	396	msedge.exe	112
PID 396 wrote to memory of 4144	396	msedge.exe	112
PID 396 wrote to memory of 2520	396	msedge.exe	113
PID 396 wrote to memory of 2520	396	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
"C:\Users\Admin\AppData\Local\Temp\9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tkiYKFegXAQjl.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tkiYKFegXAQjl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB863.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
  "C:\Users\Admin\AppData\Local\Temp\9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe"
  2⤵
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe
  "C:\Users\Admin\AppData\Local\Temp\9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\ProgramData\Remcos\remcos.exe
        
        C:\ProgramData\Remcos\remcos.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3820
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tkiYKFegXAQjl.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tkiYKFegXAQjl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFCBF.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4476
      - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:4144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
        9⤵
        
        PID:2520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
        9⤵
        
        PID:2624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        9⤵
        
        PID:2352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        9⤵
        
        PID:2420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
        9⤵
        
        PID:2060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
        9⤵
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
        9⤵
        
        PID:4224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
        9⤵
        
        PID:2196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
        9⤵
        
        PID:3916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
        9⤵
        
        PID:2320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
        9⤵
        
        PID:4280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
        9⤵
        
        PID:2236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
        9⤵
        
        PID:1220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
        9⤵
        
        PID:2628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
        9⤵
        
        PID:4988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
        9⤵
        
        PID:5136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
        9⤵
        
        PID:5644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
        9⤵
        
        PID:5728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
        9⤵
        
        PID:6068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
        9⤵
        
        PID:3836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
        9⤵
        
        PID:220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
        9⤵
        
        PID:5584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
        9⤵
        
        PID:5964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
        9⤵
        
        PID:6000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
        9⤵
        
        PID:2712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
        9⤵
        
        PID:5736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
        9⤵
        
        PID:5204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
        9⤵
        
        PID:3364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
        9⤵
        
        PID:5432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
        9⤵
        
        PID:5884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
        9⤵
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10795201435011924192,1141667478797182510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:1
        9⤵
        
        PID:5936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:1776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:4604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:2840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:1352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:5588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:3820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:5500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0xd8,0x104,0xfc,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:3108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:1140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:1448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:5896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:2052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b8b46f8,0x7ff82b8b4708,0x7ff82b8b4718
        9⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\logs.dat

Filesize
218B

MD5
61f07e539fd65792359947b2ea578f0e

SHA1
3dc1496a4e36fa75ded31453d1718c2a47374aec

SHA256
0ae9a6a7404992390c98fee0b5724db3f859cfc2ad7f66ce79f2b7afdd6b94da

SHA512
e5895e31d40b13dbe5418187008a7384086f1fd342cc78a57d7bf56fb8823396ff69307076a96f9b891b6e16ddd15922a6f7a13cb8048e1b27f8064ec6261797

Download Submit
C:\ProgramData\Remcos\remcos.exe

Filesize
942KB

MD5
ff7b8b27ec6f3cdef9dfbc0fcb57df56

SHA1
611888477ad5326b1c0cecbbac6a032bdcc575f7

SHA256
9586ec674a0e4b7558bcb9df6a8bcde244d05658f818aec5eb86328fc9d14ffd

SHA512
ac39055c817f503b7b3b16877cd5ae233d2cc79b15aa9f69cb88805515a19956c0493f709bf00fc6cf69f721024d7766a458d6cced5a3bf32f9b4cf3ec8296fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
68KB

MD5
32fe5c41c8be4730533b24849eb992d4

SHA1
a7c6fb7380ab8ba18a92ce65709bb44373770d3d

SHA256
174e2b276c85066c277f923bcd1bfc085c0b3a836e1e4eab5fbafd5c9b804411

SHA512
ba15cb8c63de949ff41b2fa0cbe6a073ee3f446d820fa49364f449b342e0f8ae58868c141f155734855c7679f5d9038e6935b513f782d8e073df84a58be81436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
487KB

MD5
831a0aa25af2c60a7380ea75c321d930

SHA1
140ec306c24ab6f348c4dde5900b219d817e2026

SHA256
8cdde5daa52335c0a4e416f6fc22aa80744207a38fc276bd65341c2d2e903557

SHA512
0147937b2b2cf9bbf7e8dbee2d598e156c6ce4ddff224b3dc48caed96e89038ecdff1ace743b82fdf6155c40b674f4b1983693dbe45c39898487d3b7be258161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
89KB

MD5
6c66566329b8f1f2a69392a74e726d4c

SHA1
7609ceb7d28c601a8d7279c8b5921742a64d28ce

SHA256
f512f4fb0d4855fc4aa78e26516e9ec1cfabc423a353cd01bc68ee6098dc56d6

SHA512
aca511bfaf9b464aff7b14998f06a7e997e22fcbe7728401a1e4bd7e4eceb8c938bbd820a16d471d0b5a0589d8807b426b97292fc2a28578a62e4681185556c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
17KB

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
4d0bfea9ebda0657cee433600ed087b6

SHA1
f13c690b170d5ba6be45dedc576776ca79718d98

SHA256
67e7d8e61b9984289b6f3f476bbeb6ceb955bec823243263cf1ee57d7db7ae9a

SHA512
9136adec32f1d29a72a486b4604309aa8f9611663fa1e8d49079b67260b2b09cefdc3852cf5c08ca9f5d8ea718a16dbd8d8120ac3164b0d1519d8ef8a19e4ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
259KB

MD5
34504ed4414852e907ecc19528c2a9f0

SHA1
0694ca8841b146adcaf21c84dedc1b14e0a70646

SHA256
c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810

SHA512
173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
62KB

MD5
8ccb0248b7f2abeead74c057232df42a

SHA1
c02bd92fea2df7ed12c8013b161670b39e1ec52f

SHA256
0a9fd0c7f32eabbb2834854c655b958ec72a321f3c1cf50035dd87816591cdcc

SHA512
6d6e3c858886c9d6186ad13b94dbc2d67918aa477fb7d70a7140223fab435cf109537c51ca7f4b2a0db00eead806bbe8c6b29b947b0be7044358d2823f5057ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1cc46e0f62b5ce1f_0

Filesize
1.3MB

MD5
17f2f72365cdba3579e4bbd6ef611b65

SHA1
d775e3d763e8643a63f23ac8bbfc3de6a7a21aaa

SHA256
7181af87f611287a5cece997338029008cefd934fcd42bc7c13581f3020b236b

SHA512
1d843a47f01b310acfda57a16698dcf8a04720e5c47c0f67550f679289ad0a38445b3536769102afdaa971bea4b3851729e7ceb5d1d4addbb51204501043caaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3341fb376c51ec60_0

Filesize
295KB

MD5
676cf58248145d622c6f525dbe91b743

SHA1
c7170f6240c0e12975a48b1eaa35d454fcf0a26e

SHA256
f2c9a533a52a09d8f80081d44038ba1cfee7236244b9412b9d31197433ee3561

SHA512
b7331b848d7c1dd14b35e2aeecb5660e6e71421df79ca623321c677f799c91ee1acc0a98bdbe42e0dd6387706822d8d14672da889475230fcb74387efbf30040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

Filesize
272B

MD5
3a92244ef85d714c235e735243519de8

SHA1
7ecd434810386d9b31ea4aa4143ff389a739f72f

SHA256
006e338c693789d88cea9df72f0d1acf46bbc2916fbc1c8cb9f6956012d097fc

SHA512
aa3b6838c6344bcda04c2c0c4a30224febbd13a3dab18d913b0326709380ef0c9972986805fa42d689786ef410f4b8c590767a297f7e114421defc5162d45c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e41737fc9750a5c_0

Filesize
1.2MB

MD5
62edab24f581b3fec29057a3966de7ec

SHA1
fd0767951266a709439f49af4e19c4c25a282815

SHA256
b3802b3f52b7543f5cb7036ec5e98170aa8bd4c18d1362ba2e158056e40bba36

SHA512
b7a665ce0a5f822a72dea55f6fb4e72f8fb7c5757f759e5a1b93025d36e45a5567e56d636771581792dae5c9931ff955b4106c082905ed2f29006d50851c1e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

Filesize
291B

MD5
87aa6847eaa8523d81ac331182fff037

SHA1
8e7e514ca719d86472b942d4fc481e7545913988

SHA256
eb6fe0236fbb774126969079c9b41cc790a0d50b5d43f6953df5a5cff763c44e

SHA512
f505d17b68879534360c8d86b59a8d47b6e6fd882217b47796142bbc89edd1a866a8815cc2b43f42deee2378d7da1555d4bed6c3507ce3f420887ba2ad44acd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6af4a7a143d921d1_0

Filesize
188KB

MD5
f502d29258fe19cdd5a5a742316a3225

SHA1
faf39b4d02754c025b441e21bab19280db218cb2

SHA256
3c4d3f713a53b4253e5eea2b4efaa2f7457054bc2e18a74096422c2005eb2013

SHA512
40f75eb78c8767ef37c5c9a1ef13b8de0a9e9aa228d6cefb8008462bb5c7688e61602e2f1bda2e0a0e655914f3c2b699ee481655776c8cafc032dc189826631a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dd170a2f734f322f_0

Filesize
1KB

MD5
4fba7118fb442415d1312c4513694412

SHA1
02bccf8d15fa03807aec6ab591e4c26c1b476fae

SHA256
6aeb92b6724b779d4bad9394a00bd898699d01010a34a45680c35c107ff7a0df

SHA512
21665f100ca56d094a56720e576b0325ae5d0c321b096dc165e2c1463730106c0f7c2e9ce05f9893335fefdf8aeb51ad7ea5c7b4a626e3198f7192687e7952e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e20d92deda6cb352_0

Filesize
297B

MD5
a297763e3287891c8ea26dcb9ee398a2

SHA1
5b38dd3dcabad2e47ab80139148868f2c363375e

SHA256
36b58a7f933bbd79d2634dd64f544f7e88a6d58d2c19f84f6ad8706f915aa906

SHA512
d5278f86e0937f139231f94e29042a9dc77ea32a895890a264d3960b4abd46c5148a0cf9f6695d640d4e1bb54a2055aa48ba1b35dd8d497dd260557731da3b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

Filesize
269B

MD5
a4fb764d49094ce1e0ff66cfa1a5d526

SHA1
2f32788e49fbec6ad43c6d26aa17b70e1febd6ba

SHA256
9f0b13d80e1e5d5a836a801e5c3c6fd03c792b25b3b6a17e91bad47617711e0b

SHA512
70175caa50bd3ab52fcd3464693318fdf575443849c82cb359da412d7b2bc7d50dfd063e6376295d3ac60f1566becedf7def49277e8cb351649d95052db6b6b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
19581bbc3bf000e30377c0fc0f56520b

SHA1
0c6fb4b179229ec62462224cc753bea78cbd8ce8

SHA256
cabcf63c91f341c525a666921d3ca0e5c09556a6792d230d00356259dba1b677

SHA512
a3a9a1d12b8a275bddff25d90255358cc25d564a74e962b74f01bd335c979c3130c516fd8bb00b8b0492e7acc9037d4b97e03473c73bb8e12a9b0b3031a8f64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e660496c673b4779364d465013a9aad6

SHA1
b251adfdece0c168e0a5613e24b3dc43896b6c5c

SHA256
f582ea889fa9abf61087e425535784664a4d60e48853918b004f8903c78674f7

SHA512
c4e60b2ae7c356ac14e828ed7d9d5df97a71f639f6b0eb9eb681adabdf90fe51479ea737262b847c55e167f9de9c5457dc7c3cf9cd5dc5cc5de0b9024e1e85f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c1c6b1f2f9a57c10518025070d96f505

SHA1
d9ee249657887c43f1cbae3e29b573fcafb175b1

SHA256
dbe45a88bb5eb2606f5d0595289ccc67b02316f380d35abfe4a506b0dcb61b49

SHA512
72c3979c755a97d7cf17ddda8f821e0c905473632448a4bdd6c78cf508607c3652ea9f87ca8a2827f7eb45cdd583966f3c5e2f998de84a9a7ffe3d871378b4c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b480d107e08174d666fb9baf903f402c

SHA1
dc07e570d6889f21cd1ceed3a21f630c29831bcb

SHA256
37aaa19a710a542cac7f6fbdeafc4dc443912a53ce9c6f99969df95ff7eb2f96

SHA512
f38a2de23ef225d1c234f401b5970e516477f9539c8fb0ca57f82651604aa37e3267b7d5c46ffb1508387f294821f7e8f51e99450496c9bc90ca838b456eb405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
891ffadbcc15af2f093e5eff9d5549d6

SHA1
dbb7b511658864d17bacd844bbe73e5bfb6fc832

SHA256
b802e5d861907dd4bfd5cfb6c9de6c8790441d192012793e3fcde8b3fa855777

SHA512
d520ccceba49e6d0b12883230ac6b9a46b247a8919cca301dd9e2b0b318a4fea19870a9c1ca5a684bedbcae2e5ca88340294bc26e18a60d7c58acee5e699fc4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0a2b7f02ff724d250e84c980aa89d9d

SHA1
774b6e4455fb649d78dd8511b1fa77c8d966cef2

SHA256
00eae1f04b259cf47bd9dea96afeb4303115903710a8b85504624ff683538397

SHA512
b872d245b07a08eb2b8fde020485e9dcf47fc5b47308751447a171c0aee9961938ba1cd3af879125cd5a7d7479da0ca4d89065771558ac0cc1c3f07683d598dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a44bc067fdc90d23a2e16cbbf23b205

SHA1
a6a48da08f686265dfb34939132ebb731e32d244

SHA256
a36023fa850bd80ee537ef3fa491328284b65f96d916afdbe7a47adfb86bdf44

SHA512
7a94edb97157565f0b149baf223203082c1b77d6bf616fe8b3d69bbc20fcb1f76646f287e26355dc75352c5264ef12a42db25c07a3ef8cbc2d4f333c56c0bdff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c95e8199ef82aeb25b202172d0a34946

SHA1
526f0d4215302507bc5bd6eafbf555d291391dd6

SHA256
4927abad00884c265485977ab96ed431d777fd3c64d0ca485928f9488cc5c2af

SHA512
ad8f113ccc3001ee714937353ca08f55cece85b43b62f6089b3dbe04efe5a615c1ec5aef55db8628d038c6a55ea7f4b9c435619a823cd5363cf540d0c4e915ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4edda8d9864d7f033181bf9995d33974

SHA1
4164fc837d60b9845773e95fa09130674ba1941e

SHA256
6a3060cdaae358aa026a0e42206c391ef3a7d0652bd35a9a5c361b9ab0195bb0

SHA512
f6b2fd7c76cdf975c0d8707b218bf5cffeef5aad2715e0cd28300230a6bba556ac433a8022dd2c9385459fce8dbe1ab063a4fff438e46f4c19cdf89d0f19c6a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
cd22b6cb0b1dc171290b853b438f87aa

SHA1
43db70fcbc620e6cb6dceb8b86f7a5e43351ba4f

SHA256
71b1fc4814516425745f5b633fb3b131ed44cb5e2510625bb5ac21ef4b397af2

SHA512
fa8d1a36bd707e07ee435bd0bfbdc37890826a510a273dae98e3a12780b12da02021712187a6d7d04e2b225f0ddf6ba067aa3513f59ffa6d868a85181741da49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
106079560e915eba9e8912cdbbabda71

SHA1
3594423789787630659c575ef983cb1bc446c3e8

SHA256
08810741dfba3f9a3b730736b9334ee3cc8dda8129bfcd8a3d9c81238336c4a4

SHA512
ba13b9e93c814d1e90efc14c0cba7e704fce85e50f07bfbd238d9077a413dbdec8b85ce3393e2b52eeb732870521657032aa7a3cd9d128a37069d87678911936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0f8b288a22b391e4c78af4f7fcc6209e

SHA1
56536fa3189b069bbc802d8c5e60af2703ba45cb

SHA256
c823ec5386f9f3214f992d1a35cd94b322aae5fecc291acc42ff201b36efa5cf

SHA512
e27a7079d94d428a02c2519fe41a3e775ccbeee7ea01a530a66b63266a8e492741577f3e5e76fc08c0bb253b2649c1857aea421963aa9014830ca0dad818c452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8fc151a5ff1ef756767d53fe480bffe5

SHA1
498fa44446e5eb34978be1d6a98c87f8788b5057

SHA256
44d18fc8370bdbccb34f9854a0433acf50cbc479b5b5726509bff83fb6b3a0ef

SHA512
526014903c1366ddf7566b1f7f2f1032c8ae78d538fb2ee5eb8905f39eecdd51d35faf501661f86d7c33c458284d56b21342b4dd1b2b664a89309ed6114399da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1a6e411ab6eb8ed237221b288dddc911

SHA1
d1c5c97d5eba870febdbc405f76d84ed7ef381bd

SHA256
7de4694900c80b1bdc97e40fea9473c9ad53c7c5a964559733c7fb896f7ed0af

SHA512
06629b5257886c0c17f08fde342ce3159fac15ae6014b1171035f642fd76f7e61b7bd0e7e7d2e94cc24c90ce70b8563516d04e6bc88e4a6d25f29d7c182627d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586954.TMP

Filesize
371B

MD5
80fd42fafe25ff7c9f0129a25095a6fb

SHA1
02268a6486a33dca000612c0b3298daf6ec9c79d

SHA256
e4ccc90b0dd6d4c526898251ab44219b71e011aa92a450455f595d8be9f1ce3d

SHA512
c8a97bc77e56bbdd40803dd4e76bc9ad66939f2cd9c89e7cb42ab11f994773de7a136f9df610e95c026bbdb494a3782ecf4627cddb7f40925d23482434c945fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0d6a37d0a5c0ed32c400c31412fedfd6

SHA1
b5c1ba26fc8cf40ce74771b8db75ff6a1fc0ffa3

SHA256
36f9522fb012065b7b8cbbfdb2f43daf872e0342584f4d851771159620e69e4e

SHA512
a5d9a9980efe53cad4515356252b27cdc6b06d595ea7410485eb2afe6e6415325460817f52d2ef8fd81d033a8fff930a8cc0d9a4dcbee57027a39fac8d763f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
df1e76b902b55ba8add965d86cd903a2

SHA1
9ce8f6568e0c7dd74de6372f1b3916bee4f4abe4

SHA256
176314f4e7a90a704495c92241a5810aa6eb9eca79f5b6383ae3dcd0a260c5e3

SHA512
367b2dcd6549c7f940450ec8421df02b779a011d527e4fb8939df2f6374deea1f0060b9a7658ddec3698eb169afdbc13117ceba94a832491bceb3fa75cb6ddb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e709e72d96ec1a6287451e95c4426c44

SHA1
6b9fbe740c4cdc2b1406687efc8b84373774d0f0

SHA256
4120773ecb5679946fa2478546e1fb54a19ae63cece5e52c8fcbe77790138a11

SHA512
a963ffd309f72c0ca09eddbc1da800d754b158d214cc212bd555c434f0246fc1b5d1b24efc95f5a6dcf54a4cd30c972f238ecbbdd8f4aeda85be8367f9c37244

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1bb2sb23.vlz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
386B

MD5
1ec6289c6fd4c2ded6b2836ed28cbeb5

SHA1
c4e08195e6c640eb8860acc03fda1d649b4fe070

SHA256
6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2

SHA512
20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB863.tmp

Filesize
1KB

MD5
0440a78ff96470eb858470ecab3c9333

SHA1
7e4b8bc412e3fa5ccbb1137451fe3bf145c9bd45

SHA256
073c4eede60c7744f938560270cad54a51e34ddc6afa6240b2800d119795bbd6

SHA512
e8fb315b9174f7757f79a763a8765ac9ebae0130243a64a0bb176efb6666153e68f503f431356c6c78b64ec5a22df1cb6f9d0b1e992051f0a8791126291a8351

Download Submit
memory/332-155-0x00000000078D0000-0x00000000078E1000-memory.dmp

Filesize
68KB

Download
memory/332-110-0x0000000005D00000-0x0000000006054000-memory.dmp

Filesize
3.3MB

Download
memory/332-156-0x0000000007920000-0x0000000007934000-memory.dmp

Filesize
80KB

Download
memory/332-145-0x0000000071570000-0x00000000715BC000-memory.dmp

Filesize
304KB

Download
memory/772-792-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-657-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-114-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-410-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-132-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-511-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-780-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-113-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-117-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-656-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-409-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-283-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-282-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-519-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1128-53-0x0000000006890000-0x00000000068DC000-memory.dmp

Filesize
304KB

Download
memory/1128-18-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/1128-84-0x0000000007950000-0x0000000007961000-memory.dmp

Filesize
68KB

Download
memory/1128-49-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/1128-97-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/1128-57-0x00000000069E0000-0x0000000006A12000-memory.dmp

Filesize
200KB

Download
memory/1128-58-0x000000006FDB0000-0x000000006FDFC000-memory.dmp

Filesize
304KB

Download
memory/1128-83-0x00000000079D0000-0x0000000007A66000-memory.dmp

Filesize
600KB

Download
memory/1128-16-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/1128-17-0x0000000005630000-0x0000000005C58000-memory.dmp

Filesize
6.2MB

Download
memory/1128-15-0x0000000004E50000-0x0000000004E86000-memory.dmp

Filesize
216KB

Download
memory/1128-68-0x00000000069C0000-0x00000000069DE000-memory.dmp

Filesize
120KB

Download
memory/1128-69-0x00000000073F0000-0x0000000007493000-memory.dmp

Filesize
652KB

Download
memory/1420-659-0x0000000001020000-0x0000000001112000-memory.dmp

Filesize
968KB

Download
memory/1636-46-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1636-45-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1644-51-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/1644-9-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/1644-1-0x0000000000E80000-0x0000000000F72000-memory.dmp

Filesize
968KB

Download
memory/1644-2-0x0000000005EC0000-0x0000000006464000-memory.dmp

Filesize
5.6MB

Download
memory/1644-0-0x00000000752EE000-0x00000000752EF000-memory.dmp

Filesize
4KB

Download
memory/1644-3-0x0000000005810000-0x00000000058A2000-memory.dmp

Filesize
584KB

Download
memory/1644-4-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/1644-10-0x000000000B5B0000-0x000000000B66E000-memory.dmp

Filesize
760KB

Download
memory/1644-5-0x00000000058E0000-0x00000000058EA000-memory.dmp

Filesize
40KB

Download
memory/1644-6-0x0000000005B40000-0x0000000005BDC000-memory.dmp

Filesize
624KB

Download
memory/1644-7-0x00000000086E0000-0x00000000086FE000-memory.dmp

Filesize
120KB

Download
memory/1644-8-0x00000000752EE000-0x00000000752EF000-memory.dmp

Filesize
4KB

Download
memory/1664-131-0x0000000000AA0000-0x0000000000B92000-memory.dmp

Filesize
968KB

Download
memory/2012-555-0x0000000000600000-0x00000000006F2000-memory.dmp

Filesize
968KB

Download
memory/2528-756-0x0000000000500000-0x00000000005F2000-memory.dmp

Filesize
968KB

Download
memory/2632-89-0x0000000007DC0000-0x0000000007DD4000-memory.dmp

Filesize
80KB

Download
memory/2632-80-0x00000000081D0000-0x000000000884A000-memory.dmp

Filesize
6.5MB

Download
memory/2632-36-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/2632-25-0x0000000006250000-0x00000000065A4000-memory.dmp

Filesize
3.3MB

Download
memory/2632-24-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/2632-20-0x00000000058B0000-0x00000000058D2000-memory.dmp

Filesize
136KB

Download
memory/2632-21-0x0000000005950000-0x00000000059B6000-memory.dmp

Filesize
408KB

Download
memory/2632-70-0x000000006FDB0000-0x000000006FDFC000-memory.dmp

Filesize
304KB

Download
memory/2632-23-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/2632-22-0x00000000059C0000-0x0000000005A26000-memory.dmp

Filesize
408KB

Download
memory/2632-81-0x0000000007B80000-0x0000000007B9A000-memory.dmp

Filesize
104KB

Download
memory/2632-52-0x0000000006860000-0x000000000687E000-memory.dmp

Filesize
120KB

Download
memory/2632-82-0x0000000007BF0000-0x0000000007BFA000-memory.dmp

Filesize
40KB

Download
memory/2632-88-0x0000000007DB0000-0x0000000007DBE000-memory.dmp

Filesize
56KB

Download
memory/2632-98-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/2632-91-0x0000000007EA0000-0x0000000007EA8000-memory.dmp

Filesize
32KB

Download
memory/2632-90-0x0000000007EC0000-0x0000000007EDA000-memory.dmp

Filesize
104KB

Download
memory/3700-144-0x00000000074F0000-0x0000000007593000-memory.dmp

Filesize
652KB

Download
memory/3700-133-0x00000000063F0000-0x000000000643C000-memory.dmp

Filesize
304KB

Download
memory/3700-134-0x0000000071570000-0x00000000715BC000-memory.dmp

Filesize
304KB

Download
memory/5988-446-0x0000000000690000-0x0000000000782000-memory.dmp

Filesize
968KB

Download