remcos | hxxps://breakingsecurity[.]net/remcos/

Analysis

max time kernel
551s
max time network
543s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28-11-2024 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://breakingsecurity.net/remcos/

Score

10^/10

remcos discovery rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	Remcos v5.3.0 Light.exe

Executes dropped EXE 14 IoCs

pid	Process
996	Remcos v5.3.0 Light.exe
3776	Remcos v5.3.0 Light.exe
1972	Remcos v5.3.0 Light.exe
416	Remcos v5.3.0 Light.exe
1856	remcos_a.exe
1640	remcos_a.exe
4352	remcos_e.exe
2108	remcos_e.exe
4316	remcos_e.exe
2064	remcos_e.exe
3444	remcos_e.exe
1852	remcos_a.exe
1588	remcos_e.exe
5044	remcos_e.exe

Loads dropped DLL 2 IoCs

pid	Process
416	Remcos v5.3.0 Light.exe
416	Remcos v5.3.0 Light.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
996	Remcos v5.3.0 Light.exe
996	Remcos v5.3.0 Light.exe
3776	Remcos v5.3.0 Light.exe
3776	Remcos v5.3.0 Light.exe
1972	Remcos v5.3.0 Light.exe
1972	Remcos v5.3.0 Light.exe
416	Remcos v5.3.0 Light.exe
416	Remcos v5.3.0 Light.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c1e90a15-58d1-4f55-820d-cf9c4ec69113.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241128042112.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
1672	1856	WerFault.exe	151
2768	1640	WerFault.exe	157
1548	4352	WerFault.exe	161
1372	2108	WerFault.exe	164
4944	4316	WerFault.exe	167
4468	2064	WerFault.exe	170
4852	3444	WerFault.exe	173
696	1852	WerFault.exe	188
4680	1588	WerFault.exe	191
3548	5044	WerFault.exe	194

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remcos v5.3.0 Light.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remcos v5.3.0 Light.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos_e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos_a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remcos v5.3.0 Light.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remcos v5.3.0 Light.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
324	ipconfig.exe
1748	ipconfig.exe
2488	ipconfig.exe
4380	ipconfig.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Remcos v5.3.0 Light.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Remcos v5.3.0 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Remcos v5.3.0 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Remcos v5.3.0 Light.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Remcos v5.3.0 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "5"	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Remcos v5.3.0 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Remcos v5.3.0 Light.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Remcos v5.3.0 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Remcos v5.3.0 Light.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	Remcos v5.3.0 Light.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Remcos v5.3.0 Light.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3516	msedge.exe
3516	msedge.exe
2756	identity_helper.exe
2756	identity_helper.exe
1300	msedge.exe
1300	msedge.exe
4932	msedge.exe
4932	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
996	Remcos v5.3.0 Light.exe
996	Remcos v5.3.0 Light.exe
3776	Remcos v5.3.0 Light.exe
3776	Remcos v5.3.0 Light.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
1972	Remcos v5.3.0 Light.exe
1972	Remcos v5.3.0 Light.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
416	Remcos v5.3.0 Light.exe
416	Remcos v5.3.0 Light.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
416	Remcos v5.3.0 Light.exe
3012	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3724	7zG.exe
Token: 35	3724	7zG.exe
Token: SeSecurityPrivilege	3724	7zG.exe
Token: SeSecurityPrivilege	3724	7zG.exe
Token: SeDebugPrivilege	3012	taskmgr.exe
Token: SeSystemProfilePrivilege	3012	taskmgr.exe
Token: SeCreateGlobalPrivilege	3012	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3724	7zG.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe
3012	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
996	Remcos v5.3.0 Light.exe
3776	Remcos v5.3.0 Light.exe
1972	Remcos v5.3.0 Light.exe
416	Remcos v5.3.0 Light.exe
416	Remcos v5.3.0 Light.exe
416	Remcos v5.3.0 Light.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 5060	3516	msedge.exe	80
PID 3516 wrote to memory of 5060	3516	msedge.exe	80
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3080	3516	msedge.exe	81
PID 3516 wrote to memory of 3836	3516	msedge.exe	82
PID 3516 wrote to memory of 3836	3516	msedge.exe	82
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83
PID 3516 wrote to memory of 952	3516	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://breakingsecurity.net/remcos/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8ffd246f8,0x7ff8ffd24708,0x7ff8ffd24718
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff67b625460,0x7ff67b625470,0x7ff67b625480
    3⤵
    PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2392 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1220 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1200 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2838768519581325199,10196942564135904231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3804

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24777:96:7zEvent31829
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3724

C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe
"C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:996

C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe
"C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3776

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3012

C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe
"C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1972

C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe
"C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /K ipconfig
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4408
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /K ipconfig
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4976
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /K ipconfig
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3372
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /K ipconfig
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:324

C:\Users\Admin\Desktop\remcos_a.exe
"C:\Users\Admin\Desktop\remcos_a.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 576
  2⤵
  - Program crash
  PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1856 -ip 1856
1⤵
PID:2000

C:\Users\Admin\Desktop\remcos_a.exe
"C:\Users\Admin\Desktop\remcos_a.exe"
1⤵
- Executes dropped EXE
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 552
  2⤵
  - Program crash
  PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1640 -ip 1640
1⤵
PID:3540

C:\Users\Admin\Desktop\remcos_e.exe
"C:\Users\Admin\Desktop\remcos_e.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 572
  2⤵
  - Program crash
  PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4352 -ip 4352
1⤵
PID:4780

C:\Users\Admin\Desktop\remcos_e.exe
"C:\Users\Admin\Desktop\remcos_e.exe"
1⤵
- Executes dropped EXE
PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 540
  2⤵
  - Program crash
  PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2108 -ip 2108
1⤵
PID:1124

C:\Users\Admin\Desktop\remcos_e.exe
"C:\Users\Admin\Desktop\remcos_e.exe"
1⤵
- Executes dropped EXE
PID:4316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 540
  2⤵
  - Program crash
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4316 -ip 4316
1⤵
PID:2872

C:\Users\Admin\Desktop\remcos_e.exe
"C:\Users\Admin\Desktop\remcos_e.exe"
1⤵
- Executes dropped EXE
PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 548
  2⤵
  - Program crash
  PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2064 -ip 2064
1⤵
PID:2416

C:\Users\Admin\Desktop\remcos_e.exe
"C:\Users\Admin\Desktop\remcos_e.exe"
1⤵
- Executes dropped EXE
PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 540
  2⤵
  - Program crash
  PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3444 -ip 3444
1⤵
PID:3768

C:\Users\Admin\Desktop\remcos_a.exe
"C:\Users\Admin\Desktop\remcos_a.exe"
1⤵
- Executes dropped EXE
PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 540
  2⤵
  - Program crash
  PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1852 -ip 1852
1⤵
PID:892

C:\Users\Admin\Desktop\remcos_e.exe
"C:\Users\Admin\Desktop\remcos_e.exe"
1⤵
- Executes dropped EXE
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 540
  2⤵
  - Program crash
  PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1588 -ip 1588
1⤵
PID:4468

C:\Users\Admin\Desktop\remcos_e.exe
"C:\Users\Admin\Desktop\remcos_e.exe"
1⤵
- Executes dropped EXE
PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 540
  2⤵
  - Program crash
  PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5044 -ip 5044
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a134f1844e0964bb17172c44ded4030f

SHA1
853de9d2c79d58138933a0b8cf76738e4b951d7e

SHA256
50f5a3aaba6fcbddddec498e157e3341f432998c698b96a4181f1c0239176589

SHA512
c124952f29503922dce11cf04c863966ac31f4445304c1412d584761f90f7964f3a150e32d95c1927442d4fa73549c67757a26d50a9995e14b96787df28f18b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78bc0ec5146f28b496567487b9233baf

SHA1
4b1794d6cbe18501a7745d9559aa91d0cb2a19c1

SHA256
f5e3afb09ca12cd22dd69c753ea12e85e9bf369df29e2b23e0149e16f946f109

SHA512
0561cbabde95e6b949f46deda7389fbe52c87bedeb520b88764f1020d42aa2c06adee63a7d416aad2b85dc332e6b6d2d045185c65ec8c2c60beac1f072ca184a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
28KB

MD5
f4f8f939cd19b7d3fa19b4bbcc21a1f6

SHA1
278ecfa3e2aa4caef632c5f61e524902d62c1ac1

SHA256
c187f8135bba78f31cc83ccdad95bf03ed96a8d0d6331db2ef3a72c59718e21a

SHA512
95646c067a7ee0dc5fb2c00f3a21a987aa69ba27aef8afa2e135180d39a86d5f1780c76b8c41e1dc0259bedcd3e21e87e56a89774f8be2470308c1c0b369858d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
133KB

MD5
dbf1fc91f1beec2915123257ea4d58ef

SHA1
d2a6d5d31334f6d0831f1c17d26e23fe0aa6a8db

SHA256
8d4d29042c23b5fcbed3af690421776de0f8ad3d308d66e24a9d80bcc8ccb522

SHA512
72e9ccb5ce2d88aac739b513b95dfb7667cf80b617510aafeb2c72345c7cdc3459b7002c4a46afd967afc1e3cab091e078ea9cb6437550b4c7990009799128a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
164KB

MD5
a3d7d331957546ae10ad69bb44b83a04

SHA1
d1a227a182628c48649912e8bcd9251113e9c783

SHA256
3bbb0df89b8dbe8001e8c24de4e2d1693f94997b29f007a7bda22a9802832768

SHA512
614c9697605efd52116765e6f53792304c536aa9953fd9309ba4912476d016be360dad69dacf8d14e5de19f73c8619a37f3a380e3ac84fa0d17058d89246f0e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
74KB

MD5
f4120760fb40152d1bdb109103063c13

SHA1
5947214a429024e9dd14bb5c3a1bf007f35ea81d

SHA256
39c658ef377f9ec31442c5343a15bdfc4c4653bcca74bc7d6fe4b3e736a60aa4

SHA512
bfde57a0a863b9ec68119d43f8c16a43ea6d4187effc80609c5f357f9ade3f88845b97d4dc390b9e6281d49cbdfa7881bae30f863051cdac224e036d2f53e5cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
23KB

MD5
6a859947244b93da9d1930fea2d1c471

SHA1
199bc89e4ac837eda291f4351d32cbbf71405932

SHA256
7a93a90d0199f18234f51273942586d0c08e044d7d68b5426dd811f77d212e5d

SHA512
a8209d76fd5ba3cc107d647d00257fa8c879761f0b9d1a0f7b4cee983b8b828754b1b44725d3aef8e4628a0bb318d3d88bf79b08e4b97e2ba18a4ea2ff6ca260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
22KB

MD5
aeba76eb6b4b9ac8c3de1179cfca1ca9

SHA1
f7d76b334edad418bf9c3c6eed5655deae42b060

SHA256
37e8121f7b085a12040d636efc80eb190e373be9f109028dfcda02aa521d787e

SHA512
3968f058571947ed987b8a410b0844a0cc680fe4acef4b1b040ab3f70229ddacbb707022958aab3a79be7af413c6a7e5ce7a105870be0a2e1d6cf7d6f3a63f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
4.3MB

MD5
ff02ab8371d64f4cb2ae3a81aec4ed0b

SHA1
58690986791322e89180363dcfd3fbee460a18a5

SHA256
e1297a0a28ebdae6dc76b39bb440402be3ae236be9b7948ead8a1e30a149a62f

SHA512
f50a3034f56dec2efa36e6722de73ec73bf23899e6015293cfa5a1774aeabee43c6cc694dbf16269c36aff11c3f338cb4c52cec16bf99f4e80c72c87337f6d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
25KB

MD5
e29b448723134a2db688bf1a3bf70b37

SHA1
3c8eba27ac947808101fa09bfe83723f2ab8d6b0

SHA256
349cc041df29f65fd7ffe2944a8872f66b62653bbfbd1f38ce8e6b7947f99a69

SHA512
4ce801111cb1144cfd903a94fb9630354bf91a5d46bbbe46e820c98949f57d96ec243b655f2edeb252a4ec6a80167be106d71a4b56b402be264c13cc208f3e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5775a8fb149727e97e63bf26cefdfb99

SHA1
a1d1ced51b550bba3c2e22eaad741407d5aaf013

SHA256
6088d3568ce2f8ad47d41a17c9310bfe1059bae1c163ce93eaef57f961f6bb3f

SHA512
7d033d03bce3f5f5ef96f31de58712a988ad926aead160bea95c1986cef4c7b835451b2ea46d3eb9498af18d56291f37ed6da536c2c87f8765870932c139570f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
404d1e107a3d624b8a2d682174d26314

SHA1
76bcf351f06712bd27987f1818d1f29ff5d2bd17

SHA256
556f5698cebc76d88d114d2f93c365720872f4cf8e9e79883b65f571397bd871

SHA512
582c3aabdf64b2178fb6091d675396dd566e5242dc9ff874f80c53e0f4727b8ad00fa4042378e244c615333c014ddbfccf1e22da304a3094ec0918db5574fddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
850cc4f0f63fa892d37b8056c25e4cb7

SHA1
478688da69355d6e9dc3607e0ec5fc59ba331b9b

SHA256
1302036c416395884788372519f7db48007dd028f232a0ca941b2dad9809a75d

SHA512
397db8f368cf0f01fae57dac25d3a9da22431d273bf8c281245d827789406bd9d17b89f34cd0e4cc6ec82e0417e8ec499ee947ec98d605c8aca8e7ccd4168035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
1c8739eee2fdd77f9480af5490d43602

SHA1
e2ecf84b277662cbbc8026222e98fe66fe251f90

SHA256
7ee5bbcb0e2ec38652aa9a931ceb7de00db279c706074fdab038e82fb21c5c94

SHA512
ebe34fed8eb518556a60a3174c38f95f11cc3b44f197e3ccce232aa2f0c0e5fb0e60f61359669a02a8196c3133c81b3a269f24bc781b08d7eda226f82852a0b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
14d7dbc998db20d82bd302730d8c9e2c

SHA1
92438b0b3f92ea8ea7135a629e6e9d2705b4cda8

SHA256
0b1e3a8da50a8ed6d363c7a3192f004985d6aa957d3783a9da457c6a8da27129

SHA512
f896a9826e455884bc7af8be0586dbfb064ce8e2ec89c6b2f8f23abfa9b5361e0b07192ea3c6dcf32e0fb4900d6608d954f040cc0eca5324dcb03fa47ccacc53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f07523cde402d76ed32901f102a7cd92

SHA1
34198cdb3e7f31b4d05a84dcabfb9f24aca2e821

SHA256
8c6f1d32e40ac927fc3e2a4e9ddd41f2eb7e87049ad7d55f3b9fc5e92e4b4ec3

SHA512
f116cc0b417bca5f0ce01736a3a90707748170ce73abdbd24c6865563ef284e6c4695bc56c1da6cbe4c5431ac139e7505ed0eb027e9ce8bb4d891d5677acb7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3b42883f3af80173cd39ea23f743f91d

SHA1
0b2868015ac88e788f417b763537ea44ce779f72

SHA256
daa6b0336d5263c68eecffd73ff55fb99eee654749d6425e0681c022ca758525

SHA512
6a87e9c73e02494660df5a16e67ce9157116962893d1bab7289056bd97c9338ae7f664f56d51a1db48b6fa993130e2753b93e6d6ca3ee1b0b95c682f4e89b505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
45eccde36e95a10e506b4e37c9510584

SHA1
a52f5debfca7df8d712c4d0a6f5215e575e5cf27

SHA256
8d5adf739af4789eec5cffa94e0286f85b6a2ecc73a6861166af659492a3eb7d

SHA512
fca459cbc99aede2f38a0bcc8636751b32c85315cded8f445e33f3a5ef8243b1b01086fc0df547c94d7349fb1d8e45ab8846da6eb337ef19a4935cc813b468a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a6727f665b86878f30588dc5cd6d6e00

SHA1
fba8725cd0f445df0a12f01ff6ba5efa8f1b5ebb

SHA256
411c5b3085a427a14ced043a1fe547563761d0f8317fec678dc698bf19158b41

SHA512
9963d1fde7a0ae5e6459d849a1fb6edc75844e92b144572cb42edf679c6da8dd553191da0376cc4b0c30770b9bfbba9a5a125d34528e5301ec0a07de23412b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8ec78d7a41c28ddfd2b5a69ea6becadf

SHA1
9a43d0591a64bc96c6c0926006c5e53d3c61771b

SHA256
02bbb8e047075c7ce05cbe82dad4c5bf5c02ae7002b9cdf003c340604233d4b4

SHA512
aaf0d4831dbe144e7a296308e00ecb53fbc183ef6e57cfcf62b6b95d797d04266d82067ea2375c06970c12d29b4384ac9914d54ebd45174e41c167ddd0e7f2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
db61f04513f0f2deab182486dbd5441b

SHA1
9735289f9109b81b777170a4bccc012cf8152e14

SHA256
bc6460f1676ddb7333045fb78430624ebc6e0e3cf6e848c0785af76ad9acff4d

SHA512
f1166a0f2539faaa3102e8f37385d822c59114d94676f07460e593f9119454d622055bd9fbfb87fc9999058566d05cf59fae5b8f2bb4411c6bb9bb7afe7bebea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a832c76c82b9057b76bc02e745d2267

SHA1
754503f3aa4202f52b449dde4914a35f6a2bbf4f

SHA256
82cea3b89b6eadc2e4a71d7c1741dffe90df021fd7b410ab9f664f313f58be12

SHA512
f409d0df51dbdf5ea997ebf95e055346ed8b5f722e8c1e0449cbbd12ce5ccce0ca7616d445d19fa49a891f57775f49ff4f6fcc50af95130e26aeeac6bffce511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f9e4fdc127cd4818036f039c6c3d9b07

SHA1
51a9c04c16ffaf55715a7c8cfdab0b8e62465454

SHA256
d154aeaacbeefb058ac49dedc1c6ef2726940dbdabff359259ef90b1e20e1482

SHA512
149bafcdeaa47463018013c32885ed79677fdd18e8a8936e83c7e0e14f2ccd99284f35c3bd220ce2dc48cd0cc70f747e1fefa6e1174ef1613204db6dfb83f255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcca6651c32a2fea83d1e367fe0a9e60

SHA1
795fe641fac3030ee68f573a57ddf2102f6371a9

SHA256
0fda0030c756217532f7d7ceaef543f4d85d53a52ec85a85af4ad3145037a875

SHA512
a7b46c24fe9cedf87d9bf167f782205a3e54655ff8ab3e5757c3521300d37be7f644c2bd05e2aa678b7ed1cf274567f164145ae9244b260eb16411fe7d92e629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6439bd6987cbb9160e26994f93afca3b

SHA1
cca51487156899afe6e693576e8af36db9401b6f

SHA256
5c060f8b400df31df666b752aa39a7efa0df87fc1f84bb6466949fff20bb4f3e

SHA512
2aa37372b950ff8368b1a335e4056ad69ea3e0bdcee2fba9c3acdbc1293c3c01d5d6c20f0c1d4f840d32a5f1a9bd88bd754de86735bac010aaf9b8716fa4cac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b71e0c66feed0f0445ee587b5d5eac1c

SHA1
e4b3d5c161942a9e73e4521fdba93863df1a9a3e

SHA256
c2c65ab8d512c7f03c7c363e5fc534d5e7ce7f32c1a583af87c955f6b72bdb07

SHA512
42d3d27ca3891f4540ad40021e7a6eb307638f8db3ed9b7ba5235c3f04106d4886993d0e46ddcc8b4a764c7875319947fd080dccaf4861ffc00c0919352e1d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27db838e4f6cb70c3d08b1e0c7554758

SHA1
33ff43388f3c91d202a1be078a3acfdf256a0c8e

SHA256
1d99e8690715e6dcae1191f90f530b1bd785933ebd4168e9a565f55ed0881b1f

SHA512
950b182be32de02d1e1c01a292491c96425e923cf5e88574c7e751d186e909719763b57048918a386cba2478e807d740339106525f2a3cc0ac96cdf2048afd53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f8e31403a1ee64c63e16fc998170c94

SHA1
8888902dfe15a2e2a9052e64fc41664631180b8d

SHA256
53bf95fb0735d9e4bf341e1ba8c599d66d4c5e2981257c0e67b849073d157de3

SHA512
193423e3a5984e9a342e215727fef6371a58a2b4c5e87a031462fca810fd612ae5357574a7cbf3b74a2b554b62dc69c5e3bf090aa7631bdf250cfdd2fc554b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed7fd8d65d2b5d5ca8b5ef28b5283349

SHA1
f8e2f21cd55b28338aa4761a1a63fd35ef7fb282

SHA256
76057ae288fa3699c3e9de2838c389e21fad3c2f0ddda11339ccff172160f557

SHA512
c4ceb99d06d3909f13119e8f4e6bfec609e9026ed4e779ca509d0b6bd223fcb5c4267e594c475ed04ebea189e3406c4115940a8c6e4df0abc0d5c478a8e2be73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d43ab8f7c8c87b6ee3b68943667ed505

SHA1
172809de0d3abb3feb13be1bda8f8bea9638a6f5

SHA256
b58f37b90a92332d0f9f856f918d8904952c4283eb1f52b95d20cb10af1f58dd

SHA512
5e71be92eacecbf3fe6aac3abfb7099927ea402260f7ed68b53c2ef05f838da047ed45e0f1915ba70b92808fd10f5839a656d2902904d7b03c65fe7e8f9aa18c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
921018106c8ad66f7a2957111bf1b056

SHA1
59bdcebe616b468c3b5c650a9e355a450f6c28bb

SHA256
3cdfa54d1fcc8470adbd00d436d36d49ec02fbe35c497f8aafd4fcdd4660c5d2

SHA512
a8a46880b7ed4bdc4b1afd7bea1014edced2c24c2ced754918b08db4c867b1b395a00c28326dde3a8e047a6ff5080ccf2f78d57c4ce44818430b70cbcd4214e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
847256032a8632149181da46559c193c

SHA1
d44d99e66e165aa800de96f4682a24ddf77f4b77

SHA256
c055983253a2f81e0ff7ff2686fe38414bd96a4377bbb5c9e9770a1f00c03ece

SHA512
19a2926adbdfb295b46f637f0c20b0e3ed0a137c0d51d85bfbf8929f530a53f20bfbbb1aa184e90486ed309e0df8c23614999d1d94c1b2eee23d4723aa2cad10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23fe94027aafb6f2bdd6438d85235fa8

SHA1
2cd4f18a7da376bd12b1f03b604e0bb5dc7d7fdb

SHA256
8630eb39b264468e5abd2953ba4598f9adaf362b429ac2032409372757299adf

SHA512
b654584eeef1d6b58d6edbea46fa1d442ace2f29728b0271edf54f5351c0d9b244af67a88367c738a242303b680229b4cf935927b703b22236353e71bcd7e47d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c69e1719b534db0661b33a11c747deab

SHA1
8e9f4dde0dd7471fb0c0ab97250efbfe3dcaaaab

SHA256
7f06e886c07a7f68f199061f443a9820882879fa0b38ae80f990a17c63783b3b

SHA512
ab64d514777b49bf1e5b5fdd6b09230ad49534a26695eca5e7492abec9270e07590e6f5f7c674ab95085efd520d94a0557ccabd6b76b698cf55d68b1a4efee79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9010fe212d7da97a4e9cf63a903ee7a4

SHA1
8f124a736d045eea3c50a9597d18c9af8b128e28

SHA256
c2956b77f9af9f4d79e0198d8a7e0a5b6f880b4d597dfeee25a3f56c05d11834

SHA512
f763ab3261592107fb19b7d6134c7f4d02e921258b1c72f1e0c69a95ee8ed9cc20498259a279cca9648bbd213a5234b965a9196865d465e1f975ee9242e36326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
21320325bdfc20c6f4e4d136228fc9c5

SHA1
7e96950811d7ddbc1daeb7341ddb9768980bf2b5

SHA256
5e7ac2b978206a07d8b1841a2bd89eae4b466bcd8a0df3a62ae2ca0439b8bd5e

SHA512
ee78316d5b8edffdc83e3431bdbd28ae05a481d2a445ddf3b7c58bf0f01c6c42aead46a4d91e7fc75519a5ca8a7e2bab78749d88476c7a2fa0a25e8b3592bd43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
5aa31602c561bfc1f19fc31d636af502

SHA1
103659ecf6c3ed436aff461113c27de01837c1cd

SHA256
0a4081c60e2220efbedb389083b4ec533e11da80c33462ecb16372575831abda

SHA512
0cde15101f4b592b19d0e78fab15a58561e6a6bf5dcdd76c786316d1c4df0abe1cf9714dd002f331f45d44b617864696de6507ad8608b808993d6d266d461999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a216308827bd8022023723978c99d00d

SHA1
e144300076284e4b2f9992bf68cc188114569810

SHA256
928008b0048e62fd9a5e42a0f96e5909cbb669f42ac2c500a69c3be20923c7e8

SHA512
3dbd3a0d6b22122bf806a7139fdec2489fa12ee92473f4dec7c0f9a2cd26537a10a0a3bacfc551511705dd67c1a51056ab89fa00cbec6746703bf2ff6b3260cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
255b485b4d4b21c956f67714f6a889bb

SHA1
858918550ab9d2757520fbabb3683de3412d59ef

SHA256
5a2b13f237a08540d846fd3d08a185d9f6f934a6e11eee981888ba8751576470

SHA512
2c6cd01001d2bb7461c146eb3c4c76dd2d1889b51792dbfc2c72ed17bfb07e8a6920981ea8705cd78a4ee3c8c5ddffa273da4ba16a6f985ea6a39728c6b0ed16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
b33a423e54c33b996c65e03d49ab5096

SHA1
2bc598d313f4f2cc376e419eeaf38a80ab29b8c4

SHA256
71d9e3859eb196b2a65051abc570b5962a037309d52fb620e479900a1881d163

SHA512
dee0b678c5a077f4b9f5525aff7e0dfc8b093734b3be53f36366f7cebabeaf2db7daab9b68a5af705d52bf922edb5962a7ce05d036df64845f5d956b84bdec88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e4bf5736cbdf9fc7a4dccba456006234

SHA1
fb3f9b497ab49335bf2a54296fd07ac47de172cd

SHA256
ae1cbd696905f74d3cd562356c99b09fbd006950b3781fd53c6c581eff9a4ea7

SHA512
a68cd1006f8525631632baf40df79cef0a1b0c12699f8df94bb5f731f5b05865649f4643fe39632be1e7faea6ecb3d20e1b9aa0df668f2359306d03f07992905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
7e184d989e6d61091ece87f7fdc7759e

SHA1
8dae802b56316e90a6e94a41f75972ef800560b6

SHA256
6ca81c684f1bffa014a77bec4f53904bd1379f5cfb950f178df5f939e6b1a7b0

SHA512
04327ae645f146f4df1cf68a5c28368dbf1ef0dbb364dfd01bb5cabd891bd60c4d983778548809c37b59f28ba6d3f99d7dfff58c3560ccce51c19bb8cbf0f9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
920b1e8316aa88038ad6a490808f14ff

SHA1
61ce0a3be02dfaa9003bae1ef884681deac32929

SHA256
f9313c76c6d84ff000abdd468c360a19b72c189e8831650fd9372db2a05637d4

SHA512
81022595e7e46f05da7b13007db80d6c057e99975a155117fdf73cf82e069490b52ddb92b4d896831bffa16f16df2277b5ecbfba69e55791baf1de7b48b3b779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
885f71cba324037e78e14c9b09efcb9d

SHA1
1fab81128ad5485b2a39b3efdc6065b2ab127030

SHA256
a5ca236bdc533a0e541df6d680aebf6bfa9fee315fd2bd212be2b908847fcfce

SHA512
57b899ebfdc8e1d1c89bd2f59eed628c749bdbd164166838cde3527ff3cdc063f6d28bff768f9a6e846c64e868363fc3ffbc78e312e4faffba046af52cc20562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
78ad08df568714f6dd1e2653ef7499ac

SHA1
b7ccada25c2c68d404e655aa09cf0a38116722da

SHA256
cc3229dad28a18cdf63e04b7731a5c61c3bc68be420b7a67d61e1ab44c5fc978

SHA512
fcf866a3178fde42d88f28b9d1379df9a213cbcd893460387dec5509325c88c53642463cfc9121a423949978b2922bfd0cfb68dc67f30faf80d991f71e74799c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
b29cd41ffbec46ab5d5751c14cf340a1

SHA1
1ee8bae4ddf1d8d8d5287506455c1855acc29c61

SHA256
5bc43fa226334b45cce3bad096a5b940828d0d61687a32d65171c67bffa8e232

SHA512
95de7b5a43bc0aa1bab4cd49d98759d273e6ec7bbddb76135176571436401296ba5ba038ecda86f8e9b19e36c28af8e65ff7e1f6af52b1f147b1ea2112e3818a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
93b2f4a3b165a3fd719f8fdfaf8f12b2

SHA1
008cc605c2c5831affa9878efd988ff79df0b23a

SHA256
5b7cd1f4f6e6818db717e01afaafdd08f6298acf386e6f434f0c202f7a705338

SHA512
2f6199d1d8a75c2918cf8acce9851c6a8526bb5b076149678e756eb51eb7c3dfe7dac1b4b67145b1f689932d0753fc2b4d4b1848814708922e3697434b26cb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
a3139cdc55470a7e5fd5656f73e182a5

SHA1
3951ae2f1d5cde37d40de785b9d5d8b7efb75490

SHA256
cea88d1ca862499ffbeca9e38aad402636dbdea60861467e8f615e634d9a5a01

SHA512
8cb26ef264d579470f40a66fbad151ca458b68b297d9e5048e80c26c052805fbc20ca9c2f6b3501eae4a696c2e8f1eef5b2f8ee3bf27d75e0e1921e33b497f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
fa90732051afba23ceabab53394db32a

SHA1
c42775533470a4bc9b8f44121b337c53bf5c50e7

SHA256
dcaf560108013d7a041ec62ec4fc552557d3caf8dcfa0a18169dc39c579d96eb

SHA512
eb277a845a0b9ce3923c73591bfaec14b364e10c05e9722c0fd250c4bad7f5cde48833edbf0d20ea8f1b0677f827245ceead9abac19f082237a092462ee0137b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
c1cbdf7ca54c8f0c892f391cbec0e792

SHA1
ef270a6a3bb44f9ff0cc97b4583f21f62dde10a9

SHA256
064667e7801be1ad760e98505e347fd68e7dbdc46670af7ba1e51914ac3d5f2d

SHA512
5b4d2afcf5b34fd20223ba5fdc25456a2ef94a67d0d407322c88d5dc6777f9320dc68b7e6f33aa31d298a9d89bdce3acbabbbb3785a14b008164b41c869a5a99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c94b.TMP

Filesize
203B

MD5
53146a7405d622fee14acdf22fec7914

SHA1
c9cd1189ceb83855355c50d7f1acbcfa0cfb0104

SHA256
a3e2344b43e9a8e9ba02b542f169bde69bb69f3cec6181d9d39a2fb97f504cd8

SHA512
d429664a84571f68266092f6b6a5e44bbd3c8acb1d3f0d9437fad152a04804f48446f7bd502a8e9eb5eea9a163d630c17022bcd518bb3d37bf50ecaeb2c9dd33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d4eb69a95c8c224806e601848f72c67

SHA1
d3ed1960fdfca2ebde4eb9420e41bca847f1f3bc

SHA256
9ccd43c107b8fdad543cb1f2bbb1926b4c4fbec144059729b564ccb25a42c2e9

SHA512
eb2e2ec3c2f67120c60d690c74417146b42414c65511d609baf601e1fafea487a37b53e7826bfcbe1ae72185e3a520ad097c994f650206ca6b3475bb78283c73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2dc7ae9bc673d28d198506287cc0e7df

SHA1
d7f2442700499d6eecbaada86b6bb6822b83b2b8

SHA256
c64dc543668e708d10dd3677af38fafe5ae19f6c51a41fafd6f9ea51c9404ff8

SHA512
0eb454d88bb18eaca33a45d8415714027a599c60ec61d46482270aa9063768afcdfc54b637c8e14a3694955bd501c249fca4788438082544d644e2597c5a06b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6240d39ffcd28f763acc1d783f761c0f

SHA1
e6d64d716843d442be88ade126e5d4d7f7a8c337

SHA256
7f5084e102f77aeb2c9c66d5bfe33e671c7ac989016c3aa41f4816f0a0b575c6

SHA512
374ecfcf953ad95938d9518ace3debdc56174020675457e060370f6c06303828051c9c7b381db169f4194a4b2ec6e2cb5ca2fcb7c1fcdf9111249d63bcf8710c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e6c6277235784278f9412cd48d4c9bbf

SHA1
8058f1cd5cdee739623d61fd56e1cae0febe76b6

SHA256
269205caa72d2017610b600a3dd7f6de727707202eaf1f3b8cbe3851a019d9e2

SHA512
b2aaeb98aa5317294004a3ef40e1b22efb790adebcdbf718f4c2f86f05cf210c899e79a26651326c0232134d8621c455ba713da7b080fec391fd2d54327997da

Download Submit
C:\Users\Admin\Desktop\BuilderProfiles\DefaultProfile.ini

Filesize
398B

MD5
87b2d9f287e386304071ab0367b2f162

SHA1
e1cc7002d96913fa2d9bda2fe23a136fbf6dba43

SHA256
d50671403045ef77352966fdc83b71505b42a89efb791a0e9a27b3fc1033da86

SHA512
f154757d2cf08a9321fa00b7a6eb8728d20e12d3370d9b647e58757bf7d797950ac453da712718e181e4628b38adfb91bd3544c671f11c02bfce344196a9f4ce

Download Submit
C:\Users\Admin\Desktop\BuilderProfiles\DefaultProfile.ini

Filesize
398B

MD5
eacdefca6b3ee65993128d170b18c4b6

SHA1
7e7327736887224a220b23c3c1caaffe3279e15e

SHA256
995af1fdab0e14063cb8f33b0e5f5bc2be672cbcac2d415fc0a767093474b671

SHA512
22bdc2aa77891537ab3e6fcb07464333ea78def8c656af4cd1fa15c2b3c52c7c5de57f59c4126d39d007a0526a8de40f94a5a4e83b2fb03544941b7c9ad67782

Download Submit
C:\Users\Admin\Desktop\Remcos v5.3.0 Light.exe

Filesize
38.5MB

MD5
be1aa2a7600e0845d73cd004cd385135

SHA1
b49bfa8ada17ce0f4497a2f2e589824e700360ba

SHA256
20fefa38a50cd99ab81181ab99bee40c3639dbdd465ce2e277eebf1bd6308433

SHA512
adea6c19d96435f853cfa4685f836d20970d944d8155b0ec9d30b7ba3499bb46d9b3125a5a3baf5c244247de3ccd79de0835a3bbc0416b36083e78a1fc865e10

Download Submit
C:\Users\Admin\Desktop\Remcos_Settings.ini

Filesize
29B

MD5
5ef6edd2053ba7dae1c9b137deddff92

SHA1
3f8a68838109ca0fa42e451aded13c1dcb5496e3

SHA256
4ef0b5f5085ee7b911b8f64a66c40c45cc3049b74e1e8154acc8338337ab717f

SHA512
f1a3a705e9d49ad6f1f4408a2cd2f7b1803c15ea0c2d7d1326e52e27689add38a5a718f87015697cfd4af043a64718f369e9a1e9276940c0304efcee3098572e

Download Submit
C:\Users\Admin\Desktop\Remcos_Settings.ini

Filesize
63B

MD5
4570d3a7dfd7f24d6185ec87d2bc5626

SHA1
8ba80e608f1ca729a42df668be505816a38faf3a

SHA256
2d181dc1597e200d60085f99baa3cc8273ba8b6ec1c1d48d9e0279f9a18ec972

SHA512
5bda5b6e59f029c308b84877fdeb17deaf8bbb8f95bbd88daa29727d1dcdc51451f76a39eba3714c6dab7ee3703b649552094353b3bb55508d09400c98db9aec

Download Submit
C:\Users\Admin\Desktop\Remcos_Settings.ini

Filesize
104B

MD5
152ae5a2a09dc24e81464ffc4233d8f3

SHA1
43f87df5b97be65352158813326329b805192ac0

SHA256
3222c7cbfe3bbbd265b81d42217f289fd2674b13b72d635a90287982770e3773

SHA512
7da51b69506856e819fd7dc1097c7ed7000db9112a0a3f59f63fbc68543e964188001d328db94d2526ef1e45577f3fe184ba54623d8190212d07a8c8cb42bebc

Download Submit
C:\Users\Admin\Desktop\Remcos_Settings.ini

Filesize
121B

MD5
87b2c0b272264aed64c83d8f18e6a76a

SHA1
efa68a53e1be3cdf0891e2516f5d029ccfcbf8d1

SHA256
db82eb330777cebbdd69cfc084d98386a76f98a5aa320d0954cab387bb8133d1

SHA512
945d3efcddb3f23e80e1b8d5d195c40e00a2f61ff53f30ee750413b949364cecca948572ac102d72807533e07980b8879438ebc0aa97b1e56ea720f78a5afff3

Download Submit
C:\Users\Admin\Desktop\Remcos_Settings.ini

Filesize
139B

MD5
b48056f0594a908b3cad39556788db3e

SHA1
58bf6503de9564c9ad41e1d48640f784852c8da8

SHA256
bfca8b4a2026e580e642f60170775d3d0b0ada0ce46d3509f9cf59054abe99bd

SHA512
bd4e5c811dc22e0ae235ff202d55017fdd77bcd0f14172ad983c1cd5db8e01ae0ac47ca88a57fc83651ac3825756ddb9b58af037a87f5a68278a62ef343dcd2e

Download Submit
C:\Users\Admin\Desktop\TLS\libeay32.dll

Filesize
1.3MB

MD5
fa5def992198121d4bb5ff3bde39fdc9

SHA1
f684152c245cc708fbaf4d1c0472d783b26c5b18

SHA256
5264a4a478383f501961f2bd9beb1f77a43a487b76090561bba2cbfe951e5305

SHA512
4589382a71cd3a577b83bab4a0209e72e02f603e7da6ef3175b6a74bd958e70a891091dbdff4be0725baca2d665470594b03f074983b3ed3242e5cd04783fdba

Download Submit
C:\Users\Admin\Desktop\TLS\remcos_client.key

Filesize
633B

MD5
455202a8f0a78e84919556a4f31f8eca

SHA1
2c0578b13ee09cfc203f246cbdcf28429486532b

SHA256
8548191e26d4adc20b3a9dd09eef3e44a2acf0060f373f35b789a6a6c4635dd7

SHA512
ae848d22991816b0616757b26cc90f889612cf20accb559234c08fe1d8a95a87bbe110d55ee6337433d8afc56b01d247e4a554b76d2c47ce1db1306b852d1899

Download Submit
C:\Users\Admin\Desktop\TLS\remcos_server.key

Filesize
633B

MD5
c18055f9cd574d28d2d08d64a9c9c750

SHA1
f6979dbd9d3a65b5cafb4393fd363ba2704b6354

SHA256
e03a2afb34fc54d65443c56b1056209ceeab089a513daf3717ad364ee7c84c9e

SHA512
0ed56bb2fa235e8008422a7a72a309c69cd1d0748a83a4aa39446d45738a017e099c4fce449ee642b8ef61863fdac5a8b4fe63b6ff38e481808eec7b9a38c35a

Download Submit
C:\Users\Admin\Desktop\TLS\ssleay32.dll

Filesize
330KB

MD5
2117e31688aef8ecf267978265bfcdcd

SHA1
e8c3cfd65ed7947f23b1bb0b66185e1e73913cfc

SHA256
0a4031ab00664cc5e202c8731798800f0475ef76800122cebd71d249655d725f

SHA512
dd03899429c2d542558e30c84a076d7e5dbde5128495954093a7031854c1df68f8ff8eca4c791144937288b084dd261fbe090c4ff9a3e0768e26f0616b474eca

Download Submit
C:\Users\Admin\Desktop\remcos_a.exe

Filesize
428KB

MD5
c5f09b7719c8b0fff49750c4207b06b2

SHA1
a4e05827087c2db01d12677bde55079d549271a3

SHA256
254062f88f40324329b91a934ecd2b38355225a18f90e0d6f6588f8e181163b8

SHA512
d69a070d0ef9e937be6c5aba18ae21ba37f6a2c502a1b8d48ae9d088d338f3134b52ec1b920ceec9d2450b59bd90ac37b90b966ac3cabdc4304d83cb2b4742c0

Download Submit
C:\Users\Admin\Downloads\Remcos-v5.3.0-Light.zip

Filesize
38.2MB

MD5
3ed3761b82c6d002b910a438ad502bda

SHA1
ae74e9c23e3abcef1d9f26e7407c794b63a8f1a3

SHA256
7cd0aecf362869ea49a4e67f3a45b1468778e9bde2a1ca9fdebc99d768a51c95

SHA512
0443f15b13fbdd22949d18f0ec0ddc47533256dae4832dcb28da018fe8cf5c4d6a655421b5d6740a7a10d4ad59ecb05412476f953a2fe4ec0e5e1cdb18773c9d

Download Submit
memory/416-1148-0x0000000006760000-0x0000000006761000-memory.dmp

Filesize
4KB

Download
memory/416-1147-0x0000000006750000-0x0000000006751000-memory.dmp

Filesize
4KB

Download
memory/416-1149-0x0000000006880000-0x0000000006881000-memory.dmp

Filesize
4KB

Download
memory/416-1150-0x00000000068B0000-0x00000000068B1000-memory.dmp

Filesize
4KB

Download
memory/416-1155-0x0000000000400000-0x00000000065DB000-memory.dmp

Filesize
97.9MB

Download
memory/996-686-0x0000000006C00000-0x0000000006C01000-memory.dmp

Filesize
4KB

Download
memory/996-685-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

Filesize
4KB

Download
memory/996-684-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

Filesize
4KB

Download
memory/996-687-0x0000000006C10000-0x0000000006C11000-memory.dmp

Filesize
4KB

Download
memory/996-688-0x0000000006C20000-0x0000000006C21000-memory.dmp

Filesize
4KB

Download
memory/996-689-0x0000000000400000-0x00000000065DB000-memory.dmp

Filesize
97.9MB

Download
memory/996-683-0x0000000006620000-0x0000000006621000-memory.dmp

Filesize
4KB

Download
memory/996-682-0x0000000006600000-0x0000000006601000-memory.dmp

Filesize
4KB

Download
memory/996-681-0x00000000065E0000-0x00000000065E1000-memory.dmp

Filesize
4KB

Download
memory/1972-1121-0x00000000067A0000-0x00000000067A1000-memory.dmp

Filesize
4KB

Download
memory/1972-1120-0x0000000006770000-0x0000000006771000-memory.dmp

Filesize
4KB

Download
memory/1972-1127-0x0000000000400000-0x00000000065DB000-memory.dmp

Filesize
97.9MB

Download
memory/1972-1119-0x0000000006750000-0x0000000006751000-memory.dmp

Filesize
4KB

Download
memory/1972-1118-0x00000000066F0000-0x00000000066F1000-memory.dmp

Filesize
4KB

Download
memory/1972-1123-0x00000000068D0000-0x00000000068D1000-memory.dmp

Filesize
4KB

Download
memory/1972-1125-0x00000000068F0000-0x00000000068F1000-memory.dmp

Filesize
4KB

Download
memory/1972-1124-0x00000000068E0000-0x00000000068E1000-memory.dmp

Filesize
4KB

Download
memory/1972-1122-0x00000000068C0000-0x00000000068C1000-memory.dmp

Filesize
4KB

Download
memory/3012-1104-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1111-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1116-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1115-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1110-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1114-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1113-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1112-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1105-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3012-1106-0x0000016FBEE50000-0x0000016FBEE51000-memory.dmp

Filesize
4KB

Download
memory/3776-1081-0x0000000008370000-0x0000000008371000-memory.dmp

Filesize
4KB

Download
memory/3776-1076-0x0000000006630000-0x0000000006631000-memory.dmp

Filesize
4KB

Download
memory/3776-1077-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/3776-1078-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Filesize
4KB

Download
memory/3776-1079-0x0000000008350000-0x0000000008351000-memory.dmp

Filesize
4KB

Download
memory/3776-1080-0x0000000008360000-0x0000000008361000-memory.dmp

Filesize
4KB

Download
memory/3776-1082-0x0000000008380000-0x0000000008381000-memory.dmp

Filesize
4KB

Download
memory/3776-1083-0x0000000008390000-0x0000000008391000-memory.dmp

Filesize
4KB

Download
memory/3776-1084-0x0000000000400000-0x00000000065DB000-memory.dmp

Filesize
97.9MB

Download