remcos | 4cc032e33eb281b2fcac95d224c0f8cb37217cb7da66163963af032de1e3f91a

Analysis

max time kernel
75s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
25/09/2025, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr
Size 1.1MB
Sample250925-qml3lsal3x
SHA256 242418928ee50cd9d4c70bddf5b9434ee65244aa46376f123f1c59359c281eaa
MD5 0755252c826a1427e4599d22c5fee3f8
SHA1 bc9295b5c7575678508822e38dbae2306775d2ae
SHA512 013cc54559a7c172519a28916bc7dc828dd4de84f50f605daf7665164fb9a0f771b9a6fd44a6c1235e0cff100534534453d631855a4692532edf95d7f6f59203
SSDEEP 24576:N+tTZr1FlRx+DOq+2Bq4LhiLIKhpfRgaUaawteiEOhwWZ:Ed1FlRIDOqPJFKzR7ZbteEh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection credential_access discovery execution remcos persistence rat stealer

Malware Config

Extracted

Family

remcos

Version

7.0.4 Pro

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral4/memory/3160-96-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral4/memory/2448-98-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral4/memory/3708-100-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral4/memory/2448-98-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral4/memory/3708-100-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
928	powershell.exe
1144	powershell.exe
3592	powershell.exe

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
40636	msedge.exe
49768	msedge.exe
49816	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
4440	remcos.exe
2272	remcos.exe
5144	remcos.exe
4888	remcos.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rmclient.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-35YKBG = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-35YKBG = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org
7	api.ipify.org
8	api.ipify.org

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2192 set thread context of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2272 set thread context of 5144	2272	remcos.exe	87
PID 5144 set thread context of 3420	5144	remcos.exe	88
PID 4440 set thread context of 4888	4440	remcos.exe	90
PID 5144 set thread context of 3708	5144	remcos.exe	92
PID 5144 set thread context of 2448	5144	remcos.exe	93
PID 5144 set thread context of 3160	5144	remcos.exe	94
PID 5144 set thread context of 4956	5144	remcos.exe	95

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\vi\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2180_338575287\_locales\lo\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134032802459626775"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-330179853-1108322181-418488014-1000\{955F622A-D0F3-4D9B-8248-C50C543F05BB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
928	powershell.exe
928	powershell.exe
1144	powershell.exe
3592	powershell.exe
1144	powershell.exe
3592	powershell.exe
3708	rmclient.exe
3708	rmclient.exe
3160	rmclient.exe
3160	rmclient.exe
3708	rmclient.exe
3708	rmclient.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3160	rmclient.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5144	remcos.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 928	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	78
PID 2192 wrote to memory of 928	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	78
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 2192 wrote to memory of 1180	2192	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	80
PID 1180 wrote to memory of 4440	1180	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	83
PID 1180 wrote to memory of 4440	1180	SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr	83
PID 3364 wrote to memory of 2272	3364	cmd.exe	84
PID 3364 wrote to memory of 2272	3364	cmd.exe	84
PID 2272 wrote to memory of 1144	2272	remcos.exe	85
PID 2272 wrote to memory of 1144	2272	remcos.exe	85
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 2272 wrote to memory of 5144	2272	remcos.exe	87
PID 5144 wrote to memory of 3420	5144	remcos.exe	88
PID 5144 wrote to memory of 3420	5144	remcos.exe	88
PID 5144 wrote to memory of 3420	5144	remcos.exe	88
PID 4440 wrote to memory of 3592	4440	remcos.exe	89
PID 4440 wrote to memory of 3592	4440	remcos.exe	89
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 4440 wrote to memory of 4888	4440	remcos.exe	90
PID 5144 wrote to memory of 3708	5144	remcos.exe	92
PID 5144 wrote to memory of 3708	5144	remcos.exe	92
PID 5144 wrote to memory of 3708	5144	remcos.exe	92
PID 5144 wrote to memory of 3708	5144	remcos.exe	92
PID 5144 wrote to memory of 2448	5144	remcos.exe	93
PID 5144 wrote to memory of 2448	5144	remcos.exe	93
PID 5144 wrote to memory of 2448	5144	remcos.exe	93
PID 5144 wrote to memory of 2448	5144	remcos.exe	93
PID 5144 wrote to memory of 3160	5144	remcos.exe	94
PID 5144 wrote to memory of 3160	5144	remcos.exe	94
PID 5144 wrote to memory of 3160	5144	remcos.exe	94
PID 5144 wrote to memory of 3160	5144	remcos.exe	94
PID 5144 wrote to memory of 4956	5144	remcos.exe	95
PID 5144 wrote to memory of 4956	5144	remcos.exe	95
PID 5144 wrote to memory of 4956	5144	remcos.exe	95
PID 3420 wrote to memory of 2180	3420	svchost.exe	96
PID 3420 wrote to memory of 2180	3420	svchost.exe	96
PID 2180 wrote to memory of 124	2180	msedge.exe	97
PID 2180 wrote to memory of 124	2180	msedge.exe	97
PID 2180 wrote to memory of 1608	2180	msedge.exe	98
PID 2180 wrote to memory of 1608	2180	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr
"C:\Users\Admin\AppData\Local\Temp\SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Users\Admin\AppData\Local\Temp\SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr
  "C:\Users\Admin\AppData\Local\Temp\SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3592
  - - C:\ProgramData\Remcos\remcos.exe
      C:\ProgramData\Remcos\remcos.exe
      4⤵
      Executes dropped EXE
      PID:4888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Remcos\remcos.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\ProgramData\Remcos\remcos.exe
  C:\ProgramData\Remcos\remcos.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- - C:\ProgramData\Remcos\remcos.exe
    C:\ProgramData\Remcos\remcos.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x324,0x7fff7cb1f208,0x7fff7cb1f214,0x7fff7cb1f220
        6⤵
        
        PID:124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1860,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
        6⤵
        
        PID:1608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2320,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
        6⤵
        
        PID:5176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2348,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
        6⤵
        
        PID:948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3404,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
        6⤵
        
        PID:4996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2604,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        6⤵
        
        PID:1888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4792,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:1
        6⤵
        
        PID:4156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
        6⤵
        
        PID:884
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4672,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
        6⤵
        
        PID:5400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
        6⤵
        
        PID:4656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5768,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
        6⤵
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1120
        7⤵
        
        PID:5332
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
        6⤵
        
        PID:5492
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
        6⤵
        
        PID:4652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6296,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
        6⤵
        
        PID:2504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
        6⤵
        
        PID:3164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6324,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
        6⤵
        
        PID:1384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5512,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
        6⤵
        
        PID:1396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6624,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
        6⤵
        
        PID:12900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6752,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
        6⤵
        
        PID:15864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6060,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
        6⤵
        
        PID:38068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7028,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
        6⤵
        
        PID:30336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
        6⤵
        
        PID:38184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6328,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
        6⤵
        
        PID:38224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6556,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
        6⤵
        
        PID:35680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5084,i,1102794647198438192,9226332444238502078,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
        6⤵
        
        PID:85292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        5⤵
        
        PID:4040
  - - C:\Windows\SysWOW64\rmclient.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\klcslqidtmbdfkgrezyqfxffal"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3708
  - - C:\Windows\SysWOW64\rmclient.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\ufqkmjtfhvtipqcvnklribsoasdyi"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:2448
  - - C:\Windows\SysWOW64\rmclient.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\xhvdnbezddlurwqzevfttonfjyvhbswb"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3160
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe"
      4⤵
      PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Chrome.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        5⤵
        
        PID:10816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Chrome.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        5⤵
        
        PID:39160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --profile-directory="Default" --remote-debugging-port=9222 --headless
      4⤵
      Uses browser remote debugging
      PID:40636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fff7cb1f208,0x7fff7cb1f214,0x7fff7cb1f220
        5⤵
        
        PID:42768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=2516,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
        5⤵
        
        PID:51496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2452,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
        5⤵
        
        PID:53768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=2532,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
        5⤵
        
        PID:53780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3316,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:49816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3340,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:49768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=4720,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
        5⤵
        
        PID:61060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=4788,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
        5⤵
        
        PID:61068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=5372,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
        5⤵
        
        PID:65692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=3968,i,775681500953728422,6766210682915911739,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
        5⤵
        
        PID:65836

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:48560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\Remcos\logs.dat
Size 218B
SHA256 5459eab210c8f04797c21688c9584b2732dac5e13180738672c255b3b863bb4b
MD5 dd9619a160ddd08081412e0f524af028
SHA1 04660a913c74734f7199ba02384d003946f839e6
SHA512 55ec7764ac464e0ebbf7e30dab431fb13efbd2370cdae5fc5779284271e2a88adfe0398db28a3ee22812f8b655950ab30ef65b43eb5d749111c9d236662a9389
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 1.1MB
SHA256 242418928ee50cd9d4c70bddf5b9434ee65244aa46376f123f1c59359c281eaa
MD5 0755252c826a1427e4599d22c5fee3f8
SHA1 bc9295b5c7575678508822e38dbae2306775d2ae
SHA512 013cc54559a7c172519a28916bc7dc828dd4de84f50f605daf7665164fb9a0f771b9a6fd44a6c1235e0cff100534534453d631855a4692532edf95d7f6f59203
SSDEEP 24576:N+tTZr1FlRx+DOq+2Bq4LhiLIKhpfRgaUaawteiEOhwWZ:Ed1FlRIDOqPJFKzR7ZbteEh
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

remcos.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\remcos.exe.log
Size 1KB
SHA256 a93125d2b7a8fb502088fa34f77b077970b56e5b707015159612647bc627f4f0
MD5 8d1497750ec8f03d34d9a58826ce010c
SHA1 aee5285ac133a2ea9d6cd8fa5b96e0dff6864552
SHA512 31d3a8ffcf5e7ba998f52e9718cd89e3008dabb0c8a5097963e7a5eed4887143a50aea8ec0d9563a59163f9fce0990a1064864b6a88b8c6585e6a09827c8f878
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1db9209bc374a2f86cd95b7346b358838349df213bbf2e5a06533baaa399d8b
MD5 abed9e3e2618edc08b0b4a9bf347482b
SHA1 4b8e21f266a1b3861e89185599ab6b265e0c308b
SHA512 11ac46f03cb60b91cc665ca07d95cef83b62e58ef3e2c0e57aad330a2f44ddffcc94b6bc031f690502171ae756869ec4b1c8cfd689529ed13915f42ea2cc1bc5
MD5 SHA1 SHA512

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 33KB
SHA256 81cf44a40792ce2cc46ea896bbf06a91687ca4c25faee4e67e470a7d61a77914
MD5 1478de9c94a368d7ed03d50bb6005cdf
SHA1 afdcefbe26aa59c0e4ae668cf422adcf589461a8
SHA512 dc980bc3355ddd8096f8751c9bb51f1e296322eaa5d4a9f20588690c3e799eb9aaec823fdccb098c53f4be978614e7980c419bb9ce7cf6b66c3db9515d9bf80c
SSDEEP 768:UnEMjgN9YY5xsGFKiNtmOcdkd7nAsqcheKmMZiTNbBsKxO:UnEzgYbdnmjdY7ASmMITRBsKxO
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 34KB
SHA256 983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7
MD5 522037f008e03c9448ae0aaaf09e93cb
SHA1 8a32997eab79246beed5a37db0c92fbfb006bef2
SHA512 643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8
SSDEEP 768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 70KB
SHA256 c631b5b11be03b9c73f6300b660f15476b5f680218824baca37486b5349d5080
MD5 eb91dbb3a94ba679e16e2b50bb733a4f
SHA1 4d53d806082f55b471c390e392fede5a9be76fea
SHA512 73427ab4e2b863264ec625e087304fffba1e61a990fb3ad097a305943e9190d1f67fa17d70cc1de374e5365783f45bddf4247626527c04b2fedfcf18ee2ffda2
SSDEEP 1536:ncCI/LKH8OrM9TzM13ZJtM5CBnaLWI0vbV3uei2EgJUbeoOy1T1MYY0:nMzKcVG3nnrxuR2EwUbeJyfFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 31KB
SHA256 fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa
MD5 3141fc21987caa861582466db947b39b
SHA1 c364a3bad69e08efa650215c124780281a6fae4e
SHA512 8be3a64bdceeb11ba06830de4359b0570f85ca04a4f3712841cd889a9542e76fbadd5899ff840b3782ddce0cdca5143a70541d9cad57b7569020c0edabdcbf31
SSDEEP 768:SA6rnpz0H6nZn01OZAaTKO6XCzpHOMTIsfec4H:SA6rnh5iOVTgUHTIJtH
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 515KB
SHA256 0a119b8bbbc45664c8bf8727cf553f9d1f2e4947f969f855976d0831cd510294
MD5 031bc490137b3796020452da4cae897c
SHA1 13e8afa4e4e4be85a99b0ee76d378b04046777e5
SHA512 a4c48d3b2d7072043fe82bd0232b4e2edbbddbd1b7fe227dffa9ccc20f89f03c75a69f8b18df5551e13d2363a5b686bf57125946d07258c23d09a5fc8abe63f2
SSDEEP 12288:QAU2UonsZUnfz+ZyjKneRfmcQOmghtfsVlJP6Gqux2z+gYeLDcJ:Q7csZUnL+ZsKeRvvsnJP6G6ztzL4J
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 17KB
SHA256 030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07
MD5 240c4cc15d9fd65405bb642ab81be615
SHA1 5a66783fe5dd932082f40811ae0769526874bfd3
SHA512 267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0
SSDEEP 384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 90KB
SHA256 10931a1cd107b8bc2df159c8ba10a7ddb82eb999e3b4bfb243747755ba2fd521
MD5 824dc2da2c8302e7e7a14e5dab9b93db
SHA1 7552f806f12ad18d189a938969704a6e0e560a01
SHA512 75880b177050f8681cb5cb0b1b6c0c1b5595a92a8da29816171b23543ceedd242db4c5c5ef8f027dc30458a6c5ac2afc077eec0c15e26372b1b15df1507b0a6a
SSDEEP 1536:AzE93nelX+8o5PFUkPp+sAEQc6L284cHM4mrUa6GnDDPjR6j8uEcx9nl8019hWi9:nWXHIUeiEKL2851RaRDDPgj8uR9O00i9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 272KB
SHA256 c688d3f2135b6b51617a306a0b1a665324402a00a6bceba475881af281503ad9
MD5 5f524e20ce61f542125454baf867c47b
SHA1 7e9834fd30dcfd27532ce79165344a438c31d78b
SHA512 224a6e2961c75be0236140fed3606507bca49eb10cb13f7df2bcfbb3b12ebeced7107de7aa8b2b2bb3fc2aa07cd4f057739735c040ef908381be5bc86e0479b2
SSDEEP 6144:dIcsZZWWI0BDqL9W4sC6Hdo7NjIZjIZP0hZRWLF9LmSF/EI:dIcsZtI0BGoHdo7NjIZjIZP0vC75F/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 21KB
SHA256 91ae2a8904e3557b6096c8f30baed14a2fcb79144b75b10cf442ba4baada761b
MD5 4c4f4e5cb90e30be9614234bc08449b3
SHA1 906fc7f35303d7f99e94c24dab4d3bf4431d7bec
SHA512 0bd729d088615d799ba9996c5982d8df79b2faf704d4a60fbf64af12354c1748228123434f737fb87171f721dc352b87e63e74766b213d499caabd8601225032
SSDEEP 384:n5WYX9l4EHpVVhIzBg+tXVg1l2HoKu/1oLpB5TROg4VH5KDEKAHq+j+xJXva/:5WYt1PVuuFD2HoP9oP5VOgCYoKAH+Za/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 259KB
SHA256 c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810
MD5 34504ed4414852e907ecc19528c2a9f0
SHA1 0694ca8841b146adcaf21c84dedc1b14e0a70646
SHA512 173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f
SSDEEP 6144:XMQ0jH5KUFLVe1lgn4B7FD4XxKXN6D3hJ0OnYMsowDg2rLjG0:XUtKUUl40UXxyN6RYMsv84La0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 207KB
SHA256 129734e8ff192f3482c4a572ef40457af560761ac68bf3851d259063e3beb183
MD5 818bc256c203dba2a417e1a309e9d1a4
SHA1 b1e54aaaa5b075e30d933dbf355480e5d8a10108
SHA512 0f2b11a74e55cc7b68a9b274824be3a4d34ac70d344b995084451a1857aa6b232a37239f3ea8e64bf426c8b1ed765e6c2850e2d93485b8d4098c4622955fd181
SSDEEP 6144:yCn/Vwd6XNbiVOeWh5kPbBsHkZHFOyJjJ:ndwd2bYODhejB6md
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 221KB
SHA256 07a2de3892b933f0e4b871ccdc4ac81d6c47e2fcac83455ff7c4b9a1ad654b3c
MD5 6f3ba254b854b19cecfcb87b2c080ce5
SHA1 91f0755c26e340c6679a5106e26f64c2d416c5ba
SHA512 1da6ca6e1cf34149f263f1ffe663a20f1a4707d43ede9c5e1d8dc63c74d6ad8f19962dee290b81ac96b738a7ed67aba757c01c68a2c8f4327b29e0991a057ce0
SSDEEP 6144:KyUWd13gRNcV59XTtvl30HjCSA2CmtU+NOAhxdl:ZUW8u5tFxM+SA2ciOAxH
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 28KB
SHA256 b1617d6a41f6300ced47cc06472b4c93e26d3cfa8033b2446c4ccbaa6cf4ab29
MD5 997e9b72aa389a7b2ec96eb7636be753
SHA1 5ccc6c5eb7db70a6a5a11e887a43587c920c3adc
SHA512 1aa2443bdae194c5e7f54aae16eb1f265f3a91b219d7e95b4de565c80e9613f658d499ca9c61f4b36903e71c3e7c0b07eb53c0e5c30c66c2d9ab7874152ed953
SSDEEP 192:WZN0O1ZhjBml+iUFUZkCZ9JerIQQ6RV+VNZBYfSKCPe5cksFxccVIXaVf7hddrLV:4juUGxher/+IqFeCVIehrtVhn4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 97KB
SHA256 b176a3d223d01f1d3ff673207d070c7689c7f8174814f70236a2c4757ae1aad2
MD5 45a6e08b6ef48d93c893ff00b3185bc9
SHA1 b559432f66e9d7b63b30b39684b77635ab73b294
SHA512 102817e48331816125db3c47ce90ac48d85a1d1dffc132c1c4e4ae8a31c6b9094dc30bc3d424c767b4d55ccd933167f842d1f2860e284ce05d5b4d64d04ac155
SSDEEP 3072:kBs4fUftKDPNvQP5neUvCnKZfzv17Bmw+00R:h4f+tSSNeXnEfzttmhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 42KB
SHA256 9971ee6590de99da1f27409920ff706df9259afdbb05e6f1dce20a0c4e1939ce
MD5 e93f8ffaa5a67c497d1970bc63038f58
SHA1 387fe18e4a4849f052f5dd07c0821e15d806ded6
SHA512 c6946a077f89dfcb86145856756a39a88b3e24422390fad1114e6793e61ad494db16f90ce487a4399bc5a032a90fb7ffec11c8e55ccd1ebbcf15b0fe57426d5c
SSDEEP 768:aaee1uxlJH0XXoQ1en4c18hMCFDFfA7syx8SpQI2:aDSOH0XXhg4ceLllA7Zx8SO
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b3f88fcd93c5f1ea8d3adb5c83b5348e9487568cb4787c30c922c71759a5e3f1
MD5 97dd55cfa975d350f7d6eb8445a85db7
SHA1 4579abc6cb3822fb50acf1040848c8ae2c3a490d
SHA512 74292014870d3fa9465cad6147d9f1f4999e9871f6ca2b513747841d6517884e549398187787d3ea03152de20eb3cd43bd46a8968ee65dfbecc7b4ad59d03190
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59459a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59459a.TMP
Size 3KB
SHA256 a099226fe9b8d2ed182323e3c6c83a34da1e081df63be926f9d71722bcd75e3b
MD5 866f4a0755c9d86ff292ece522f5a461
SHA1 8cfafa08ab9acc834d3faaef7e8e6d81cec1a0f2
SHA512 aee53228b761f1a18cd716a6edd89c349da02667953111a724695be140dbe68762a8e470d98d2a76a96f41605964619ba887375e38adfc94624539d6d0a971a7
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 de4bd4258ae27f78c3a1b5bf0992cb7780b3eddb97f92f49a08ab77536f53c2f
MD5 34143f54fdde1640d782b2bf9d869dba
SHA1 ce5dfa39510b84f4af3671bf77e69786a71e38c2
SHA512 f389e5292a77a936846b2540d902273d7c0e17575671129088133e184605172696ca50b13dfd148e6d6803115e845cce5539279e86aee6796be98bfef33baf6e
SSDEEP 96:teMatUaAKpJFJTAKRTH/km72WkX1/ZMGlZD5kOO:tLaSaHfQKl/JytRMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 69e3ceb1c30ad2344e1d38394e3cc33be66982aa27e0eb62e51533e4789403c7
MD5 877d1011a02a5aa8bbd82fe24b7abea1
SHA1 7f4be6eb2ec9bf75f9f038f83cf7a3f7041f3950
SHA512 dd5857f5ce3cfd9eb5b1fba221dd73d8375735dc74f58b2ab2e3184de396e4dc366473665a2631402c840c242b40cd4ce8f8e96fb514782eec9b97ba8419a5a3
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0911d2a7267308a492036a7c71ab98c01f15bcb42953736f0ab7875eb893de83
MD5 b763f13c8df52b5d11fb29818a7090f5
SHA1 33661521b7ad3a5a987aedee283e79f8fcd08eb5
SHA512 f6c934b238cc52b6d7a62c66d8b624d68dbab66128e78d81fab6f112f16b5368473688d326167277ae284ead330b94da0c0f9276ab48aebe42bb844d8319ef9c
SSDEEP 192:sVrRVyMh/Ky0Ml8M3p2XsRfsQOaNbzoZ8pvI/Y+WNJ3kQAtfKJ9Byc+B8YkIgy0J:sVrdLPpgsR3Ow/g/SWQxnU8YI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 b2428cfd2aeec14eaf22f255d1cfc60cff8637e18213a4d52e0be70a1e89012c
MD5 dd0371ffef2856d04b9412d2a34a84e7
SHA1 9869d46043aac18570f10acee3cb0c2c59ffe7c8
SHA512 f498137f334dc6525e38123203ac05b70a05b330062d0c0fe493703029eb86b398308e1f021d90ed26d577ead11e4a764a409fd893cb3384d1ce12658d709bf8
SSDEEP 768:+Y8dM8jQ2k97pLmLl1/WRWDpQ3V8F1+UoAYDCx9Tuqh0VfUC9xbog/OV36WpuLlj:+Y8dM8jQ2kr8l1/WRWDpQ3Vu1jaK6Wpk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6b5de3508d1942e56096195c4344c5d798fa580160776cfe542c3bdf9b0aae0d
MD5 a2fdd48feb218144c4b703ae41b38c02
SHA1 3952b0fe69e631aa850a2a17cca55091642749b2
SHA512 f1272aea01320aaf4eb351d12866383f69ccfffc3a4aeb660846c8793e05fc810dc3b95455a28fcc2c440f0d6279fcee1da0949f937dbd1a9cb6a6cf7fa5d70e
SSDEEP 192:2CM1L7oH7NtNmFSbLz5BDKparjwv8TP5xBSxmPP/ddvutuFJd1Enb13XQ7mnjJrO:P
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 5KB
SHA256 b6ee4dea89e3726f9b768595a64ae2dee1febd2169a287e04ea1f22729028ba3
MD5 f2bced9f4037e33b502508cb668b26f8
SHA1 f104ce6ceaf1de5e6c2410eeb2334dd011126952
SHA512 07a1b609c7f758984eb1f0b59d8d35cdc237a63775199d21e172e85205602802c196cc08d2369898f2b080e73bc55dfbdf6f60c5cf5e977d9a98cc9d05410288
SSDEEP 96:K5JR+0+IC+H+DQ+B+XST+STk0I0ZeNcUynwxh7qyd7oEPn:K5XST+STktWejyKhWydMEPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 900B
SHA256 da1f011e6e1d3b9797f6fae30fd64502937851b3b3b7fa75d4dbbf1b90b6bef6
MD5 24ee6f38f2b645545bed23596cdbc275
SHA1 cd8bfa79acb9d2184a136a67106c330af30312cd
SHA512 6bed8a0a9ea9f207217c23fe6c7962830447870c25eac7eb78d39e7d955ddb528b3e056936d7855e68c09972e52a01613fd07fafa7c63a18cabdb47a907c5982
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 467B
SHA256 c4a9b2aeb9ea76eace94eb3ef970322d397a8ca0499c0224aee9e1b4edfd7392
MD5 b47717f7a7018718e3ca81c6148b5038
SHA1 ec299c84b0ad30eeba4733f2dad90a3580e783a5
SHA512 174407614fd30de8d692667339eae1891009c0a78bdee90946aaaf60ce2e83af4507333fccfd43979380a8e2f52ec04f58b601d7c667bd207a25732ca687f82c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 4503345ee70aa9ca0f90012b665743d7c13ec7052e7a943222287973b752b9c7
MD5 3bca8411b45106afaa963d562c371631
SHA1 78857d33a65e7061ca18a3540c304f01e7e85325
SHA512 a6a7e9af6613a30730a0b87be76f87144a3483afb756445d462de7b22543027e5e8f5822e0337ba2d7b65e413e526da962783d05d226c0d13d113d57d28b56ff
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uz:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 ac2a1523c1370f40eee13cdbd457c4cbaf2fc9e4fe37ab0a046389b9d7cd891d
MD5 c530231bcf4dc7c646e5a6d7d3c4d51a
SHA1 c1d0fd9df7cae1a82cb2010b40a0c9823cb6567d
SHA512 a4d6140c47f96425c3a62963f3f4eac92f21d4106373b80937839e186b982969a20a92cbfcb20858c803d659aacadafd6032b03ff7662e2f5c4503cb72610a02
SSDEEP 768:JF8BRE+D0tHVw7q3/CgcQCmXQ1jmRsA9vIW053GTY13UVxIY6gDK9wPLJJ4tVQQR:5yO39Q0SJT3FY6gm9ELz43QSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 9f44e1d60b4c192351fb9d34921adbb10ff28b2595ae3365194198ced2fd2973
MD5 63dbc999008e065275de47e8e9c0c954
SHA1 15fa3bd79838d431c4e1de8d154d317408081ac5
SHA512 a590e6881dfdba9927bed04257f63983d31cdabf1451a97b8bd3224137c5c4cac8d5aee54091d2bc7f0eb389504e3324b15a7e84063959e604508ac265d4ca0e
SSDEEP 768:aQ8BRE+D0tHVw7E3/wg5QCoHQ1jmRsA9vIW0y3GTY13UVxIY6gDK9wPLJJ4tVQQR:fyI3WQ0SYT3FY6gm9ELz43QSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ffe989b1ed05cdfa59926ededa19be622d817c45fcab7504c1bfcca5b7402c86
MD5 dc2a0c1f6669a7af3923c058db76ff01
SHA1 d8be87462a4b0c587efbb57e53a9b1b91b13a89c
SHA512 258af0def3d4ee25770518311982e01f066ddd49d44afc6ee75231d64a2f936af4b94dba908d2a0e6417d402c357765690175a34212a74bf8509902f0b013f85
SSDEEP 768:fQiE6esE8lDldUGz3UwgkQC5WQ1jmRsA9vIW0b37DK9wPLJJ4tVQQ9IY6gp:LeB85d73IQ0SD7m9ELz43QPY6gp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ea27d1f0a5b014ee223e84f8c2a9978171c3fb15e338d96f937bbe100a1418ed
MD5 9b7b461e85c1b9afb77f50c204838664
SHA1 3961acaddf43750096c459687c9be0e75b6c6196
SHA512 3ecfea7f3bdbd7e3143f79fdff8083bc4eefa77bb739cea9bba24a7aefd322a35c3879cf461437922868874f7ff968eaa5ab7369370bee7f2a301e0b21e49792
SSDEEP 768:aQiE6esE8lDldUGz3/wg5QCmrQ1jmRsA9vIW0b37DK9wPLJJ4tVQQ9IY6qdp:6eB85db3sQ0SD7m9ELz43QPY6ep
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 bfaddeb355e1db118184ae13261f5a6703882379dbfa5dc74ecb7bdf6e0dac03
MD5 ffac906d31121ce91d53e5743ff7ab1d
SHA1 2b9ae5deca5a95af294f33ad3084a3ed827b21c0
SHA512 6bedc1a193390c0d189049a01b76db6f3ba9249f46d44ba7e9dfeee00a5940eac4e1a5806d1f1377a33d9fc7cc7814e87fc1ed120b98262ae931b2e22e098277
SSDEEP 768:rQiE6esE8lDldUGz3UwgkQCg1QQ1jmRsA9wKy5wv8xDK9wPLJJ4tVQQ9IY6gp:feB85d73QWQ0LawUxm9ELz43QPY6gp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 245d1781cc35fc8b58adb2d8105f20c9ed0b58571748a1f7825f5194787a181c
MD5 e8b06f27ccd7c868bf7cbef062f8d563
SHA1 2cf6f5e8fa1831b592c0462baece303798ff450f
SHA512 8625039e0d28bedd9519a947d9ec2addca9e064d79414b6c2ba2ae15618856becbc8d558bb1c15d5430e1418249d5a7f801bb1bdc692d215d22e9a8e8f118be8
SSDEEP 768:aQ8BRE+D0tHVw7E3/wg5QCorQ1jmRsA9vIW0y3GTY13UVxIY6gDK9wPLJJ4tVQQR:fyI3CQ0SYT3FY6gm9ELz43QSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 82c7ac3fa3a6c3dd8b574ad60e9fa7b12325cde17d1109426cdcc56564fdcc85
MD5 65ec0dfd63485a0101f24c21020f67a8
SHA1 6648eeda04fa7565ef334e8596abc05e0ad04d2c
SHA512 28a6582fc69d4be8da9900db4414c1fbfc61bd0896df44ec7f8e9c94e83793df79ab3dfe943c99788860995153cabda66cd1a80f93c2e904f9a841b869cb6cd3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5904a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5904a9.TMP
Size 392B
SHA256 843180c14784e607256b55d5c96fafce1c10820f0901f42b88082d36629cfbb8
MD5 733162b4e2eb33b9c65f269fc880c738
SHA1 0477df694da75730c6e318779d630ac5461b1687
SHA512 6900ecef9fb4ba70cce954b433a85d63fd2c450a7018127f8bf4d72a31b84bdfd75de231f88f5cedba308f1871f0cecc4fae1110ad8e080a05010d9ffc3671cd
MD5 SHA1 SHA512

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
Size 161KB
SHA256 23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
MD5 d6a332ceaa785f20d7cf0ef7b9fc4790
SHA1 65f275d0b2d7b017fc8727298498dd43833d0940
SHA512 d79eba8bc96fe187f1284e7c3adf9323bd0525f73daba3e6f97013297588119256aa1af82ddccbdff5483b466f22b1846ee2f44afeb84fecd7f2c6951b7aa659
SSDEEP 3072:D0siC87t5FyUgTnPw2Aee5WZ/2gtjccLyD1FLrhHopoqxPVv+J09vXOj:3MTyJrP7xe8/RyDf/mpoGX9vXOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e8aa3162f519e3670b0fc79dfbeeca68ea2b65a17900cf3aafc6a48de3296d60
MD5 4a7f03a7ad1cae046d8ceac04256e5ae
SHA1 ef0bf767c91cba32b33c0b48f74f5eb153ae43d3
SHA512 382a91848be121734bce9f533bcb4747e5f21db5b1ea5dfc8cc567005f5be0f1dcc73a55516b83feb931cdc90601ed4d36fb890687f08e1056ff98da2365f01d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat
Size 280B
SHA256 911565628e1f5b1aa47e218096a95592a9cdbd4d7ca3b1ac1fc8670758449ded
MD5 21b95df2528baf7a1161ddf317df7fb0
SHA1 399aeb337ee40af6b01d609ef44bbd22d9e5dbd9
SHA512 0a563f6f26e3f4f17d27e24b41c10e8067d27c8b9d838f0068dfcad0e11864330915ce72162d4e7cbf49e237477ffaf0f36a4f1aa8e988c031805e107ab98dfc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat
Size 280B
SHA256 0d2440063ffd1054983bed30ed23f20e8b24730134c5642b70405eed9761c49a
MD5 bdf6d9b4ccc4ba0d3b44daed7d354d91
SHA1 a440390b4c20135f30180cb4e8752dacfbdfdd6b
SHA512 c43d46e866b4faba9261deed49df0ff3c6b71de42902c31933d002d49813992773d9607fc39382bfd32940b81aaa1f8718a97a2e677794b5d0f3ce4fe24a444a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat
Size 280B
SHA256 3dc33431cde51dfc4da6cab410aec713a51dbad36d3bb4caf0a26a181506bdc8
MD5 dbdeaaa2f61280fc1801c73f08dd69dc
SHA1 1dbe38903ec65a1deb2af1aa872b7cddd2c6930c
SHA512 5bfa4d307846014aef4b15e1d428483ee956e7b5e4329d58a353cb0f1008b0039a593964d87cd1a091cb4ac5a492318b0f93f1e703adb78b11d40d1c0e2223f4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat
Size 280B
SHA256 0aa4f3b7cdf39b2146de729cade1662b10e352cb994805255fc0625c40aac0de
MD5 171385df277278cd9bae8ee848cfd14c
SHA1 4d04a9f505f9ac8d635e461bfc4b1e595d8189fa
SHA512 ee9ba7ae9233c5a5869afe7cc816a8798518aaeb47f7a3090f463f4d40c470dad04e5e08dd0f886b0f9b4d837bc2125baf5c53ea92313c74747857f76021d4ab
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1c97f813bc4c44250f2a4f4936906926ad9a599b75ece9152ca14f0a44e8af76
MD5 f684a9b9b2e58df84cf5f00be0715f55
SHA1 a14d55c113018a92bb498ebf06cbca3d7d64aa31
SHA512 ebbb22b4165911b91c48dc5c80dc5119060e6fa7c2e034c85a327adc977af3f38514244e2f0eb365767755e0fc2a37e265062fc170203cdd4f3458ae93a4b4e1
SSDEEP 6:/F8d8/ENi0s7I+ENYHc7uYTQKLuVKGeghll:de8EiV7INh7d/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 9f7cea59001302cc256c91499e449f40209699faaa04b5f03b70492365de4b71
MD5 7e3e63b4ccb1a6ea943c8a3f63a743d5
SHA1 6fa5be2a9bf5b47e1e802514c84f6aaaea77d835
SHA512 12af4b0a7eff78e2abe7ff16461d4bfc4dc33704e1f79b174bf41e1d4cd1c1503c4f6fd845cba872f47a3187c91808dbe568815943b235a586a1ea6ea0861e37
SSDEEP 24:JmHiSyWV302CNh0nWRecKUUIBt6BWYMECkYXgIbb:+V30zT0W4vs6BWaUgmb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 2bd737fc4599c94375da466b5a38c1234b6dd5b3608cd543539a137d80b78810
MD5 3bbcb1dfc5c00c15710990bde78b9cc2
SHA1 e36f776393b6c04fc8b6c7863ec7e22b868339c1
SHA512 c9aa66b5e2a864e54b0cc3d86418a70e964c097a024550259faa40a3aeb9072fa40a9f7c8de0432928ac093ae26b85e39122fffd437f172e3a220f6f369b01d9
SSDEEP 1536:HAfToDY5N1ifzsn6swKToDO2GToDeNMkuQlfBThx1:gflmfztJK4GkcfV
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\index
Size 256KB
SHA256 2098ffacfde1e3c7e3952ebe528c72a6f4e63862d24d9e314f0ad75fa8a95b15
MD5 e737cce28987c3854876103783ea5889
SHA1 19110c73dd1e69e33180df347ff2bdc90a72a556
SHA512 5fe759a78de2481be598a89dc820009b5d4864197cdba0fc106893fcba47368ead0a16c53980fca16d676f5163219390d6bb7735afc8214edaba73c73a3c7005
SSDEEP 3:LsYllOlNllkll/l+3Kh1Bll8n8Ntl2lXlNlXlAl:LsL3lEt+3KNNm
MD5 SHA1 SHA512 SSDEEP

Submit Download

0fc970dd1eb84dc9_0

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\0fc970dd1eb84dc9_0
Size 254B
SHA256 b7746619d2c10044a602574b952b903b2ca050a160417b0959f4a875876b1f1c
MD5 e63921ebc145c26b62f847f06cbb8b30
SHA1 c1d8b109aa13ab1d0f897b9eb1b75692dd541001
SHA512 a53b77c87ccb2ef1d900306f2ee2ae4fc8b5d240e169fb9248cc1b44f249805ddcc45e249e1a6917e44f7ecaf8c1e5ba86b8d2f69f3ed48b356d9d5640dd8ecf
MD5 SHA1 SHA512

Submit Download

f7aa053e6f64e0db_0

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\f7aa053e6f64e0db_0
Size 254B
SHA256 578bf1013156d05f30dfb488a200e3d7896fcbbd75f90984d0390f72cfd25153
MD5 ede115e867ec03c3465f07209d7d830f
SHA1 ec167b8b6f64aa24c8d27172ad0569a8466b2fe6
SHA512 a3b484027464e90c26869303306a4deba85129c9e67c8d3e15bd85c5f04807b4f88834f9ba4c13ac8630b4a94ce5628f2ad1420537036358ccb88aeed2d03391
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 d7f9c3559cd37eb593c15a040ab931dc7bdd44bcfef417d4b543666cfe418eac
MD5 c158b5c0370d06a6e875c5cfe9dec8b8
SHA1 8c0bf3ef762fcb6af05286d274a909baa3e04494
SHA512 f450ec0dca836381c8c33180f058a53a2afa417dc1fecc133b10d99204b3a8bb5fdd87bcbafecb8da97e7460b5d082d85449e359b21459adbb17b6ec0b8e84e2
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5946f2.TMP

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index~RFe5946f2.TMP
Size 48B
SHA256 4eeb8913a76bbbf2df642724eb71347f828f245a92c5b69c1788c5a33d07793e
MD5 6d177ca74bf8361e36b9da91d519214e
SHA1 a84fd133ab3a89aa1eb60658a5779d5317b31792
SHA512 8bef15f4b9b84c14e2017842fee94d2e26e843b9017bc71e2b9f0edf2e9ab79c19074f7c279627c40a28e8a4d2bf34b5d291b6d940ec401ed1a7254077323c3f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 1d0ff77889ae803da07b69fc36c05e539e45e5d078ceb3c9737f59887634ba2c
MD5 e3ebce1342ac9cbe204ce29412fcb057
SHA1 8ec00b099e72d9666b0fc824731366924d472b99
SHA512 eeca0fa30bcffcc388cb8e7aea74a2565a82a473978585e3f482e55a99351f361683ec923c6f81666fa3382baa551cce8094068c53e7cc21d4b7cdcf4e60a209
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences
Size 10KB
SHA256 40d751926bf969e5b63de57a69de1365ec7da64a42105a7d875c11c385533a28
MD5 8e62218f41856f8376ec08012a179a55
SHA1 165400b746311eeff425a8dd372714a021a4570c
SHA512 796b5072ca012b83fa3f3bc7d8ae0a648e33abd784d17c68f9e26c8e9e3b221460bbc443adbed7a4ce12f759ce9597454a6eb233dbe4e1fb4663156f8cf4d000
SSDEEP 192:rRJI3p1sCWcFfbTWOss8I9C8pXV/S+WNQRZoNNwdbY2XQSIgXJ:rRJYp1sCWc1PXslAF/cW0NwOHy5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe5949e0.TMP

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences~RFe5949e0.TMP
Size 8KB
SHA256 5cfae598027190a858e17ff36ff2d83173c239881c146025c3fb8ee0f560fbf6
MD5 f24c4d21cd84c93a37f5c00c0b2d1f2c
SHA1 27a4a0b7e96f96c938f05d3029f8d2a4a0d0d161
SHA512 7ba8ded21fdb31f31b80e565bcc05b16eec966644fa689f7365d15b4fa0b314e15c2c5a1a4f42774e1317996fd1724982fbde0d373ec45b07a29bb4bd11066c5
SSDEEP 192:B7c1s0ufbTWOssa9C8pXV/S+WNaZoNNwdbQ2g8SIg9J:Bo1s/PXsLF/cu0NwW0yH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences
Size 37KB
SHA256 b6f5be950330d209f0bda01852bd4001273c933161c7762130b07d919e693e85
MD5 02ad7573ac1a9d6ea93202e28cc099b4
SHA1 f3ae17a38f23ed2daeefdd1b7e23246ad1a10ff3
SHA512 287c45800327d6824786cd50ed6069c00d29ab9c063b301e69c9716ee7fd216ce2052144c7a1db02a5f0e96669a3bb76019ad2c732760149bf4a22cd19a8a9c7
SSDEEP 768:zY8dM8jQ2k97pLmLl1/WRWDpQ3V8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TWQuLlS:zY8dM8jQ2kr8l1/WRWDpQ3Vu1jaKTWQx
MD5 SHA1 SHA512 SSDEEP

Submit Download

arbitration_service_config.json

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\arbitration_service_config.json
Size 18KB
SHA256 15af1d2e507ede3610b17309b6cfd203563c1964aed4df9787f6fbea7ee50fd8
MD5 cc61d87ba84fb087c8b5d1356310634f
SHA1 43d9c3abdd9d359a2d7a01dc3f37972f3e813b8a
SHA512 21ceb4675843e15b18eaf51774a31d2142aeac5aefbab0aafb2584ecb32b93958ab5d409fa262a107754e1bfff6e05d8e238d414e4d434fd2d5a75dc3e1422dd
SSDEEP 192:vQ8fRR+nft0joCxc/i4utSfnwGOq52efYw54ecoaSbqG/I5zT8H:vQwKF0jojq4uGv8efYSraSbqG/V
MD5 SHA1 SHA512 SSDEEP

Submit Download

d6cbb385-9626-4553-882c-7b41f60383fd.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\d6cbb385-9626-4553-882c-7b41f60383fd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_vs42s2zw.cr0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vs42s2zw.cr0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

klcslqidtmbdfkgrezyqfxffal

Path C:\Users\Admin\AppData\Local\Temp\klcslqidtmbdfkgrezyqfxffal
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/928-26-0x00000149BB4B0000-0x00000149BB4D2000-memory.dmp

Download

memory/1180-7-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/1180-30-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/1180-10-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/1180-6-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/1180-5-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/2192-4-0x000001D6714B0000-0x000001D67158E000-memory.dmp

Download

memory/2192-0-0x000001D6531A0000-0x000001D6532BC000-memory.dmp

Download

memory/2192-3-0x000001D66EE90000-0x000001D66EEA0000-memory.dmp

Download

memory/2192-2-0x000001D671110000-0x000001D671122000-memory.dmp

Download

memory/2192-1-0x000001D66EE90000-0x000001D66EEA0000-memory.dmp

Download

memory/2448-79-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2448-98-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3160-81-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3160-96-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3708-100-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4888-48-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-25617-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-30124-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-18462-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-895-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-19549-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-20105-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-653-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-162-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-21059-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-149-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-142-0x0000029322A20000-0x0000029322A3D000-memory.dmp

Download

memory/5144-146-0x0000029322A20000-0x0000029322A3D000-memory.dmp

Download

memory/5144-21756-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-22717-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-17756-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-145-0x0000029322A20000-0x0000029322A3D000-memory.dmp

Download

memory/5144-23379-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-24105-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-24728-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-25471-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-25467-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-5874-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-26188-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-26833-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-27637-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-28110-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-28896-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-16963-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-15950-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-1320-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-87-0x0000000180000000-0x0000000180148000-memory.dmp

Download

memory/5144-29579-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-13849-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-30917-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-31479-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-86-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-82-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-2158-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-12798-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-76-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-75-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-73-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-69-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-68-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-36-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-37-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-41-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-11784-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-43-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-10667-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-9879-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-8756-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-3133-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-7683-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-6858-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-3347-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-3088-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-4065-0x0000000140000000-0x000000014009F000-memory.dmp

Download

memory/5144-4834-0x0000000140000000-0x000000014009F000-memory.dmp

Download