remcos | hxxps://gofile[.]io/d/KRUCik

Analysis

max time kernel
161s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/KRUCik

Score

10^/10

remcos wavesourceleaked discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

WaveSourceLeaked

204.10.194.175:4444

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-46FS9Q
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WaveSourceInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
3216	WaveSourceInstaller.exe
5080	WaveSourceInstaller.exe
5304	WaveSourceInstaller.exe
2380	remcos.exe
5776	WaveSourceInstaller.exe
3584	WaveSourceInstaller.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	WaveSourceInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	WaveSourceInstaller.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 5620	2380	remcos.exe	167

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveSourceInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	WaveSourceInstaller.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 134591.crdownload:SmartScreen	msedge.exe
File created	C:\ProgramData\Remcos\remcos.exe\:SmartScreen:$DATA	WaveSourceInstaller.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2928	msedge.exe
2928	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe
1172	msedge.exe
1172	msedge.exe
5268	msedge.exe
5268	msedge.exe
2472	msedge.exe
2472	msedge.exe
2380	remcos.exe
2380	remcos.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe
3408	taskmgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2380	remcos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	taskmgr.exe
Token: SeSystemProfilePrivilege	3264	taskmgr.exe
Token: SeCreateGlobalPrivilege	3264	taskmgr.exe
Token: 33	3264	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3264	taskmgr.exe
Token: SeDebugPrivilege	3408	taskmgr.exe
Token: SeSystemProfilePrivilege	3408	taskmgr.exe
Token: SeCreateGlobalPrivilege	3408	taskmgr.exe
Token: 33	3408	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3408	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe
3264	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3420	2928	msedge.exe	83
PID 2928 wrote to memory of 3420	2928	msedge.exe	83
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 624	2928	msedge.exe	84
PID 2928 wrote to memory of 2880	2928	msedge.exe	85
PID 2928 wrote to memory of 2880	2928	msedge.exe	85
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86
PID 2928 wrote to memory of 1580	2928	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/KRUCik
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82df446f8,0x7ff82df44708,0x7ff82df44718
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Users\Admin\Downloads\WaveSourceInstaller.exe
  "C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - NTFS ADS
  PID:3216
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    PID:1432
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5328
    - - C:\ProgramData\Remcos\remcos.exe
        
        C:\ProgramData\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2380
      - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
- C:\Users\Admin\Downloads\WaveSourceInstaller.exe
  "C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Users\Admin\Downloads\WaveSourceInstaller.exe
  "C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Users\Admin\Downloads\WaveSourceInstaller.exe
  "C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6072106857177966235,5952049884350809055,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8a421abah8347h441bha54dh2e117ecbade9
1⤵
PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff82df446f8,0x7ff82df44708,0x7ff82df44718
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10189534242726053136,7432898463366688571,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10189534242726053136,7432898463366688571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault44712ed2he781h4646h89bfhf588e0c5ef3c
1⤵
PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff82df446f8,0x7ff82df44708,0x7ff82df44718
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6975179571409342641,15128753432956790496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6975179571409342641,15128753432956790496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault86864b3eh2aech4af3h837fh55750334c3cc
1⤵
PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff82df446f8,0x7ff82df44708,0x7ff82df44718
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17263790872026182348,12741355988837684909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17263790872026182348,12741355988837684909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault834affd8hf469h41d0haa8bh294380ee056e
1⤵
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff82df446f8,0x7ff82df44708,0x7ff82df44718
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,16592627913006494474,13502458599167845559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  PID:6068

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4792

C:\Users\Admin\Downloads\WaveSourceInstaller.exe
"C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
1⤵
- Executes dropped EXE
PID:3584

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
74d75945aed1c6f3a3ecf9ef23a30acc

SHA1
7d49a615f48589f735b7dc003e83adabe7331fa2

SHA256
91ff472b5efa0b6dea52621534a58a90e7f6de9234c81658f939da89263c1da6

SHA512
98ec24fef768c385fdeb518beb0430510553de5d4e41dda8c7f737e44f9cb072caff867a2f6f4ac0b11303145e2de77e86891ef89ce40544e57c1d8f44b3aee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcbbf4e2fef25fee65008a76505d3087

SHA1
812c0f76f881ece87084ba8089d2af7932a6c119

SHA256
5f89e2800bd39c0b0f7d5472c194c8498beb6021231b94cf26a4bb46ac6e9074

SHA512
f228845a5670f4802fb405a6e0897664027c19ed7d7abac247ab6eccd8d53a91a23d5effe035fc093e497b2aee61f76152025c74343725f7af30ffe9971c403b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
959b67dfa04aec7b5ac4b964f887ef99

SHA1
528632a98013a4dcd58bb28ef7fd552346dd93f8

SHA256
836c9775d3ad18b09cbea8c168e52da6bd6b1cbe0590f6c6c600230838d58df4

SHA512
403236076a68ccc4bb59105296f87bc522abcfbb01d755803b2c45789d5b25c5ed194f89469a886b1cffc2b2315fcfcfc93a88f4bf8eb6532ded5b53f56bb114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7336dc4113e44ff87391ffdec3339c8e

SHA1
77972790b6870d5cfa4f50cadc7d09a0f5fb1909

SHA256
5b709beb2911497024f2d5bdcff476adc5b8bfc91a99590e1c8ce8093a266fba

SHA512
716890b20c03ca17d1c72161cad48ce307dececebce9278b4f7bae0540738201d71436926453f40a46bb7289e66b1482ba6877bd71099e9bc0ca453391e4c7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
930B

MD5
49886329361314461897d37480310d56

SHA1
6fea778fd6b91fbc5ec75e0c8237ac816f33e042

SHA256
256c615afb8719e4a01578665b2378fbdd288986d0529fbb14b8066977aa863b

SHA512
9f75ab5780cfa87c870ba6133e8ec1a2850ca08721919c2883b7a076a9d4635b04d7c9067e114eadee6165fbc2b584f8a74e7bd42874af07b1e29ce45a97f1ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f17145f79c11b0d602b72eb6ac7ff2b4

SHA1
9883408ac63c5fbd237a6fa8798f829f6769d68e

SHA256
732383ded669aed56fab1694451b9df0c5e056ce59540c73f79ae4679024deb6

SHA512
44944dd8dbe9b11af0e45612025f3513848ac72e9e22035d9589d911d94e159ea1338b27f22306ecac97aa0f9afdc9bd1fc0ab98c181ed1cf99ca76fe13b15c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f9cfea2d31a4b1f818feaf7bc4eb5fb

SHA1
b23ac27a3dd2f8cc78cc7a5603395f33520797fa

SHA256
fd3d3f4b7e4440f9578b6337900c080f9a64b5974e1477de828eedfaa408bdc6

SHA512
cb4b3fd07f0b37a9dcf1133cd82cc5289a6359770d5be76880e261350e892b9513f93866ba2a52dacc81c5ce87bb236e6ba649a2898831244ff95d70c2ffbea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5f13a32a6bb358dce9cad6ece97b07ce

SHA1
f60894426a39e64016d39fb3e7ad3ba2b7a697c0

SHA256
4b98e10f90928b8c340f8e3eeb9d4734857d4823d4704cd5ab351a7fe101ae3f

SHA512
303474ab9f8efb839489dd6d8261d9a7ffa67150b5aa2cade7256e8b42091b912dcb6783a81c8c492d37fa3e89dd1ab444ec62924600eb01baee70832e0568b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76a3d413ad0ba8d04f8be84a034ab39c

SHA1
b250bc3788ce2835d21c44f4da286a15734d354c

SHA256
de0121de6b32a5a121eaae4c3377c95879ad528f501a81e0e78f8059732682e7

SHA512
4f25443694af101217651cb5d3b160b69c9f6ff9abc365efa60c2e0a7903d1de559618cb64825c248123b7cabe502bb5200405903dd7c944a2972455218855f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
63d8ed39e41b8f0330cb3336abb3806e

SHA1
5ba30a2722aa8a914cf43a643106629db1693222

SHA256
f8c755d7d9efbfdd7dc70b83437650b088e000660f9f3244438d777f0fcc7ded

SHA512
aa4d96da36637adf437b069d653da9df8def476a54f78aa06a6f0cc8447f41cce02bb99da55bdfaa97fb1b6c1071c564a115bec1451b1b78555d02259cb97667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0cdf3f9556f3b5b9683e69c5c8067b3f

SHA1
c4af00f12b4689c486b4f52632a477991cfdc0f0

SHA256
342e18a83180dcb7cef04faa4989187672c5b0757599f0715334138a6c54a2a2

SHA512
9930cdc060db30984d858f8b9b1b67ded3b407a844960284685fce795d0d72a5fff6291df8181182d79a874763baf74fc829cc038c27ddbde259c5bb1841dae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd02c8eb5eff8779acfb7ef3519a893a

SHA1
c322f42759553592ec36a70bbb45228384c2e064

SHA256
6659c21340a98b9181a13ca4595482388a237db81e14dc3bbf06b1bc0363ee9e

SHA512
53d70fa1f1fc1f37376a6cdd8bcbd923ab40fd30c9cc2f188df6ed4ec2b5a2b0aef243fabb6042c1951992a40b000d31839f1540f18a122d98e4d53a9f55afb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
765f21208f957816db4a10d989c93e66

SHA1
97d0965d8e06997732f78ed0837b9c6127bae879

SHA256
d97ec64edddf453aa46078485495078fadbdeabb1579b236c5c26b76619b27a6

SHA512
cae0fa8fc610b7eb987e05f24a2a68039c3f5a0aa0f6b312c1c49099dfe6b46faa71e102b9cead1bb9b351335e95fdfd2489bee7ca90774b4abd3f69d4bd7c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
69fb410c058486378189bf89d17c2b45

SHA1
18329b9598e7b2abe8fa573b71182464a51ae4c9

SHA256
9b476ebe39098d45aea4e9e7941ab282aed59d4382d3afbbf7bf27c7a2d2af54

SHA512
5eb683e1e57046160ce45ae8bb6f220c80202a0e3be99772ea7117f53377b45aa8954e2a3f2d6830db8fd7037248ed3633fa65897efc84345da6d7a5c92a37c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9970ccca6526896675a698446f2a2af5

SHA1
e02905b4f854016a5ec96b24b4050007c2ded043

SHA256
45dfb69e1b2533f8f9c0f5c7bf6e76bdb08c3e3ccc67532fe4075e22f3e7b4b0

SHA512
d8920c7d3816f21fac54634a3d0f7cfa16928f6aaef31516271eefc38aa6ee45007a0ac09dab3c1406d4cc7454a985ebecd2ecbdb014b2519e4babf58e78ca25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d22f017095194f601c58da8784a004e5

SHA1
1f597d0ec8b8cb15d3004efa339a01196274d569

SHA256
5e03f269de14c151a0d7ea7885c124d298ea63c42c565d51e2d740030cd80722

SHA512
67c8194ee556ad0173486f459a6195e9393389c636c08465f48167f43dc8080c109a5f77785695b42007a3bd53cf7f3ea79727189dfbb4fa7e41ee5bc36c4073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
447b6119f8cb9546f332cb9f3a7a5fae

SHA1
4ec8cd43b8dd38b10b1598bb9d5a62390fe065fd

SHA256
eb7f1b0b49235ad20c58ff8be4de56e8707440e4062dcc9d49094cc761c278a3

SHA512
655ec482297ccc05691a9a87019a99a1c3e25a6a92f628a9b44e0321dbbdd4af6c1c957ea8f5ff5cf05a883d76a8b916dd60f2a769711e766be20ea29b33dfcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
386B

MD5
1ec6289c6fd4c2ded6b2836ed28cbeb5

SHA1
c4e08195e6c640eb8860acc03fda1d649b4fe070

SHA256
6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2

SHA512
20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 134591.crdownload

Filesize
469KB

MD5
e468b718e67495ea73c85d8258059adf

SHA1
dcad70f5c39ab85f900ef1288067dbf51eaeb503

SHA256
fa9f629254a8bbe915bbd587c0c060de580a18992103858a1d16686de8bd717e

SHA512
b4eb6cc848b5ebfc6bab7e1cc033ec468bc8cf2fed72ea912f9fc60d6eaab75664f4627646960dccab2aceefeab9c5acbd2fe1b57d992c62358929b4d840dedb

Download Submit
memory/3264-329-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-325-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-319-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-320-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-321-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-331-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-330-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-326-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-328-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/3264-327-0x000002377F480000-0x000002377F481000-memory.dmp

Filesize
4KB

Download
memory/5620-313-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-314-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-312-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-310-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-350-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-351-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-357-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-358-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-309-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-308-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download
memory/5620-307-0x0000000001370000-0x00000000013EF000-memory.dmp

Filesize
508KB

Download