remcos | hxxps://docs[.]google[.]com/uc?export=download&id=162EQPlutnZ1zKvzpMxfzZncvQ91-s7vY

Analysis

max time kernel
122s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/uc?export=download&id=162EQPlutnZ1zKvzpMxfzZncvQ91-s7vY

Score

10^/10

remcos full rat

Malware Config

Extracted

Family

remcos

Botnet

FULL

apples.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-PWMM17
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
4080	Ofx CITAFALLO RAD 002-2023-0420-0036-00.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4080 set thread context of 2108	4080	Ofx CITAFALLO RAD 002-2023-0420-0036-00.exe	121

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3140	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
1440	msedge.exe
1440	msedge.exe
4916	identity_helper.exe
4916	identity_helper.exe
444	msedge.exe
444	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2352	7zG.exe
Token: 35	2352	7zG.exe
Token: SeSecurityPrivilege	2352	7zG.exe
Token: SeSecurityPrivilege	2352	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
2352	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2108	csc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4144	4728	msedge.exe	68
PID 4728 wrote to memory of 4144	4728	msedge.exe	68
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 3620	4728	msedge.exe	87
PID 4728 wrote to memory of 1440	4728	msedge.exe	86
PID 4728 wrote to memory of 1440	4728	msedge.exe	86
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85
PID 4728 wrote to memory of 3940	4728	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.google.com/uc?export=download&id=162EQPlutnZ1zKvzpMxfzZncvQ91-s7vY
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d9746f8,0x7ffb9d974708,0x7ffb9d974718
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13824497607954795111,9791919954914440709,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1236

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap15623:140:7zEvent3723
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2352

C:\Users\Admin\Downloads\Ofx CITAFALLO RAD 002-2023-0420-0036-00.exe
"C:\Users\Admin\Downloads\Ofx CITAFALLO RAD 002-2023-0420-0036-00.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:764
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\Downloads\Ofx CITAFALLO RAD 002-2023-0420-0036-00.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  PID:3360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
519B

MD5
ff2186fd66fab2bc32ee6077f9dd0b7e

SHA1
40b9f023f4983999b80774df2e9ed1c460e3b91f

SHA256
f2cbe71398ab6e314bb0240e6c329ce820a14c0f9460bb37899f4f11b9612b7c

SHA512
c3cb3d184ad50087c07a6db1d480843bf403ed0cf2806a281d203bfb187644af5a8f38d25a87d7fc5cd56e7a71ea80c5e6c9013ee7e59ea2572b19d5dc7b23f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
192308af16957baa749e694c72291d14

SHA1
222f371aa96f37ba6891fe43a34dd1928eec4532

SHA256
3cbff1d4b6dc0535d47cc4c89b7a36e3011b303e519de4db7cc9840fd25a9bc2

SHA512
be90bcb108ff79c613acabdb781aca45f16dbcf73394ccf754cef0abc7a43f1733e6491803f0b1b396bbf0faf10075560e104931d8fee6e3d3a691bc48f90168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
364b0a4fbd5cfc135b72404e1b48c219

SHA1
e7fa112dab11b553fef5c189baf40662ec938317

SHA256
3b1e468971343082c99edee3d993f80883557ab3a973f28fda5d648b5fb244cb

SHA512
f9234dae5b552306f16a0401f1a0bb1cd373e9eaab98f7c3b58d85a453c0537e21aba0109d8d4fe7d24b1490db1e4e8ac562c3303c2a30b2b1a2d87defc33b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
03ac736fb31c267ba665fff8dfd0db22

SHA1
88e1d2e870fe992bea63950c9c6ca35d70a89722

SHA256
8f0affb7eca381ca74f470aa4d884d32bdd3cfd51a8026e7ba854f3dd4646bb0

SHA512
37f8baca7d8af5f3f8f3ddc77f04aa8d78965a75c422e2b7d778cc14e0110a93eaf4d2b9b8f4542c343a8fcf58fcf6392024d9756352ba9d8ec55e51da1b6ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
42fdfedda82a27908055e990b6d0a5dd

SHA1
e5105f0192d2554e13c3108a8f5cf7aa668a5c81

SHA256
6a1dbb8ca8f8e0dfd42ec1f136dc684a91930342dd91858b0458741fbf909c65

SHA512
7647df30dfe507f2695884fbed33a8f8103a9d7654c0a9a181b6edfd04d2731d15434875a7e5670abe091dd27cd61c1c7a159d69c1f7458b08891385a9791b36

Download Submit
C:\Users\Admin\Downloads\Ofx CITAFALLO RAD 002-2023-0420-0036-00.exe

Filesize
122.1MB

MD5
d663d95b4c77c6a6dd9db9098eed9aa5

SHA1
feaf1414e96f249fd2bd7c32cf38ac4928aa8b60

SHA256
8e643775f948e70b0cf5e93a00aa2f77da30585b89281075d0f4ad296a2060f1

SHA512
3052952295feed79687655cc4eceedf4d01b5a4cf4ead5151a73c69dabe48551a297262a9acbeeb3d53141ada943f4fd28dd4f655951b4ad58d45e02cb6346b6

Download Submit
C:\Users\Admin\Downloads\Ofx CITAFALLO RAD 002-2023-0420-0036-00.exe

Filesize
121.1MB

MD5
5f7f9133d5864441e23e504a5762d1a7

SHA1
f6e6eba39ca753e0c26b103089725fe200c98f68

SHA256
4aa004c868c5636a1f135366c5cfd8fa76297081cc6e712185a6ecb75ea89cc9

SHA512
4dc28388d4d91fe14acd27c9b938284963336c067cba1c2a2e19f50e70d5b3e225c9a68042954d68fc410ef0e79d7911e6c18e2e006111b47d36333eece60b62

Download Submit
C:\Users\Admin\Downloads\Ofx CITAFALLO RAD 002-2023-0420-0036-00.tar

Filesize
1.6MB

MD5
41fb760c5dbc9d18dde2884e53ede542

SHA1
17c943aba6a2992820004d3b559eebc280bf3c07

SHA256
0548861f8b55bdc852c1f7e1d2634b5f28fc72996622b7fa7e1e3f4ca0c66785

SHA512
69c9062865198958bf4bc47104bdd5538c37ee2bd5c0b3542ff4c37c8f2ef87bc314eb64fbdc3017b3cc30f05256928644fde77e28ee99c787e32efa54d7648f

Download Submit
C:\Users\Admin\Downloads\Ofx CITAFALLO RAD 002-2023-0420-0036-00.tar

Filesize
1.6MB

MD5
41fb760c5dbc9d18dde2884e53ede542

SHA1
17c943aba6a2992820004d3b559eebc280bf3c07

SHA256
0548861f8b55bdc852c1f7e1d2634b5f28fc72996622b7fa7e1e3f4ca0c66785

SHA512
69c9062865198958bf4bc47104bdd5538c37ee2bd5c0b3542ff4c37c8f2ef87bc314eb64fbdc3017b3cc30f05256928644fde77e28ee99c787e32efa54d7648f

Download Submit
memory/2108-146-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-150-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-161-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-159-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-142-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-143-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-144-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-157-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-147-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-149-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2108-152-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4080-138-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4080-151-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4080-139-0x0000000000250000-0x0000000000302000-memory.dmp

Filesize
712KB

Download
memory/4080-141-0x0000000004CB0000-0x0000000004D2E000-memory.dmp

Filesize
504KB

Download
memory/4080-140-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download