File name:

SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426

Full analysis: https://app.any.run/tasks/4e6c2c4d-2326-4611-8b3a-3e87769e4002
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: August 14, 2024, 04:31:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
remote
stealer
evasion
keylogger
mpress
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

27C848CC8C3E2FA769E418FFC2BB5DFC

SHA1:

CFBC5F79E7C6D3A1A5CDDE28D3E3200A87C2F7E6

SHA256:

0371D6E1E7638E52AF5CDEF7265500EBD3426A0E3754AFCF0B4F431D30F2025C

SSDEEP:

98304:yJ2eu17eOn/qbN/jFTVFPSEMe4GuzfckftbMF9pgduSeCysYgIOq1ynxUtM:i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS has been detected

      • RegAsm.exe (PID: 6432)
      • RegAsm.exe (PID: 6432)
      • RegAsm.exe (PID: 6432)
    • Changes the autorun value in the registry

      • SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe (PID: 6308)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 6656)
      • RegAsm.exe (PID: 6664)
      • RegAsm.exe (PID: 6648)
    • Scans artifacts that could help determine the target

      • RegAsm.exe (PID: 6656)
    • Uses NirSoft utilities to collect credentials

      • RegAsm.exe (PID: 6648)
    • REMCOS has been detected (SURICATA)

      • RegAsm.exe (PID: 6432)
    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 6648)
    • REMCOS has been detected (YARA)

      • RegAsm.exe (PID: 6432)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe (PID: 6308)
    • Reads security settings of Internet Explorer

      • RegAsm.exe (PID: 6432)
    • Drops the executable file immediately after the start

      • SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe (PID: 6308)
    • Application launched itself

      • RegAsm.exe (PID: 6432)
    • Contacting a server suspected of hosting an CnC

      • RegAsm.exe (PID: 6432)
    • Checks for external IP

      • RegAsm.exe (PID: 6432)
    • There is functionality for taking screenshot (YARA)

      • RegAsm.exe (PID: 6432)
    • Connects to unusual port

      • RegAsm.exe (PID: 6432)
    • Writes files like Keylogger logs

      • RegAsm.exe (PID: 6432)
  • INFO

    • Checks supported languages

      • RegAsm.exe (PID: 6432)
      • SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe (PID: 6308)
      • RegAsm.exe (PID: 6648)
      • RegAsm.exe (PID: 6656)
      • RegAsm.exe (PID: 6664)
    • Creates files or folders in the user directory

      • RegAsm.exe (PID: 6432)
    • Reads the computer name

      • RegAsm.exe (PID: 6432)
      • SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe (PID: 6308)
      • RegAsm.exe (PID: 6664)
      • RegAsm.exe (PID: 6656)
      • RegAsm.exe (PID: 6648)
    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 6432)
      • RegAsm.exe (PID: 6664)
      • RegAsm.exe (PID: 6648)
    • Reads Environment values

      • RegAsm.exe (PID: 6432)
    • Checks proxy server information

      • RegAsm.exe (PID: 6432)
    • Create files in a temporary directory

      • RegAsm.exe (PID: 6664)
      • RegAsm.exe (PID: 6648)
      • RegAsm.exe (PID: 6656)
    • Reads Microsoft Office registry keys

      • RegAsm.exe (PID: 6656)
    • Mpress packer has been detected

      • RegAsm.exe (PID: 6432)
    • Creates files in the program directory

      • RegAsm.exe (PID: 6432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(6432) RegAsm.exe
C2 (1)107.173.4.16:2560
Botnet2560
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-L6F79W
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:13 21:53:44+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 1338880
InitializedDataSize: 1415168
UninitializedDataSize: 373248
EntryPoint: 0x6b668
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.3.389.34
ProductVersionNumber: 4.3.389.34
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Iso3166CountryName2TryPush
FileDescription: Iso3166CountryName2TryPush
FileVersion: 4.3.389.34
InternalName: Iso3166CountryName2TryPush.dll
LegalCopyright:
OriginalFileName: Iso3166CountryName2TryPush.dll
ProductName: Iso3166CountryName2TryPush
ProductVersion: 4.3.389.34
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.w64.genkryptik.magc.tr.15181.21426.exe conhost.exe no specs #REMCOS regasm.exe regasm.exe regasm.exe regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
6308"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe
explorer.exe
User:
admin
Company:
Iso3166CountryName2TryPush
Integrity Level:
MEDIUM
Description:
Iso3166CountryName2TryPush
Exit code:
0
Version:
4.3.389.34
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.w64.genkryptik.magc.tr.15181.21426.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeSecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6432"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Remcos
(PID) Process(6432) RegAsm.exe
C2 (1)107.173.4.16:2560
Botnet2560
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-L6F79W
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
6648C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /stext "C:\Users\admin\AppData\Local\Temp\uwjrtnyyhtesmv"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6656C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /stext "C:\Users\admin\AppData\Local\Temp\fqokufjzdbwfojgsir"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6664C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /stext "C:\Users\admin\AppData\Local\Temp\psucuxutrjokypuwrcdfl"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
1 308
Read events
1 293
Write events
15
Delete events
0

Modification events

(PID) Process:(6308) SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426
Value:
C:\Users\admin\SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-L6F79W
Operation:writeName:exepath
Value:
2EB54A6F7F6B701883CDAFCCD001BBE9DD68E7777AE94BC4E1D7AE2C67F0401082D730845433F9B329E56BCAF5FAFE9A1F13940C41A50F2661B0FF7F929990E2866E7B8CE5EA361C2305D14CDC1FD9E94C2B5A56EF358A9364595313EDE16DFF3EEE79A5293485076FE64CB5439A07479B03
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-L6F79W
Operation:writeName:licence
Value:
1F611B3E6C81BFDFFC9C054835043B6B
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-L6F79W
Operation:writeName:time
Value:
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6432) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
1
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6648RegAsm.exeC:\Users\admin\AppData\Local\Temp\bhv5CF0.tmp
MD5:
SHA256:
6308SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exeC:\Users\admin\SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exeexecutable
MD5:27C848CC8C3E2FA769E418FFC2BB5DFC
SHA256:0371D6E1E7638E52AF5CDEF7265500EBD3426A0E3754AFCF0B4F431D30F2025C
6432RegAsm.exeC:\ProgramData\remcos\logs.datbinary
MD5:5363784C1FD232E8975E48CD4D9F0BCB
SHA256:BA577D1AA67B6FEAD834CF0CF690D064B38E6CD7A334E97B410D155E85CB9036
6648RegAsm.exeC:\Users\admin\AppData\Local\Temp\uwjrtnyyhtesmvtext
MD5:73AFEF57A57FF8285682E59AEBA8FE4A
SHA256:9081F636845E9A6B7D781F2F35A28B33B7FDF5373075B435C5B373119D0934A3
6432RegAsm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\json[1].jsonbinary
MD5:16C93431FAF024A02448095CA90C27B3
SHA256:47549520231BE8476CD1CBCD831C466C8C77F521BF5A69AE7D4626ED68869215
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
47
DNS requests
21
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6432
RegAsm.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
whitelisted
1948
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
1948
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6988
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
whitelisted
7044
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4664
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
3888
svchost.exe
239.255.255.250:1900
whitelisted
1164
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6432
RegAsm.exe
107.173.4.16:2560
AS-COLOCROSSING
US
malicious
6432
RegAsm.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
unknown
4664
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.174
whitelisted
geoplugin.net
  • 178.237.33.50
malicious
www.bing.com
  • 104.126.37.153
  • 104.126.37.160
  • 104.126.37.171
  • 104.126.37.162
  • 104.126.37.155
  • 104.126.37.184
  • 104.126.37.163
  • 104.126.37.177
  • 104.126.37.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.23
  • 40.126.31.71
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.75
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.103.199
whitelisted
th.bing.com
  • 104.126.37.163
  • 104.126.37.171
  • 104.126.37.128
  • 104.126.37.161
  • 104.126.37.162
  • 104.126.37.160
  • 104.126.37.177
  • 104.126.37.155
  • 104.126.37.184
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
  • 20.223.35.26
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
6432
RegAsm.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6432
RegAsm.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6432
RegAsm.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6432
RegAsm.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
1 ETPRO signatures available at the full report
No debug info