remcos | 64f8d40a94818b9385624dc6237edee725cc7edf78c09da9fd60454a7b1e2cdc

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Main_Order.vbs
Size

963B
MD5

8b5f64100174bb8bafd5ad78d6f2b277
SHA1

f284046c61b75fd44bf55661701c5e15b97efb28
SHA256

64f8d40a94818b9385624dc6237edee725cc7edf78c09da9fd60454a7b1e2cdc
SHA512

ddf8052d129252ff570e2fe21a06a69978cea57b43b75ce6f1dff2a3cb6674df9e5ff6ecec78ef3192e17841c9903823c194e2153fcbaec5268f87bc7dcf7346

Score

10^/10

remcos thales 10101 discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Thales 10101

103.28.89.34:10101

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
process.exe
copy_folder
Tencent
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HP44IR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4324	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1280	powershell.exe
5180	powershell.exe
1176	powershell.exe
4540	powershell.exe
4768	powershell.exe
1068	powershell.exe
5480	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	tmp58BF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	tmp58BF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	process.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	process.exe

Executes dropped EXE 10 IoCs

pid	Process
1712	tmp58BF.exe
3752	tmp58BF.exe
2068	process.exe
2416	process.exe
4264	process.exe
4652	process.exe
4616	process.exe
808	process.exe
5792	process.exe
1396	process.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HP44IR = "\"C:\\ProgramData\\Tencent\\process.exe\""	tmp58BF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-HP44IR = "\"C:\\ProgramData\\Tencent\\process.exe\""	tmp58BF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HP44IR = "\"C:\\ProgramData\\Tencent\\process.exe\""	process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-HP44IR = "\"C:\\ProgramData\\Tencent\\process.exe\""	process.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 3752	1712	tmp58BF.exe	109
PID 2068 set thread context of 4652	2068	process.exe	126
PID 4616 set thread context of 1396	4616	process.exe	140

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	process.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	process.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	process.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp58BF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp58BF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	process.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	process.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	process.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4184	schtasks.exe
4720	schtasks.exe
1236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1280	powershell.exe
1280	powershell.exe
1712	tmp58BF.exe
1712	tmp58BF.exe
1712	tmp58BF.exe
5180	powershell.exe
5180	powershell.exe
1176	powershell.exe
1176	powershell.exe
1712	tmp58BF.exe
1712	tmp58BF.exe
5180	powershell.exe
1176	powershell.exe
2068	process.exe
2068	process.exe
2068	process.exe
2068	process.exe
4540	powershell.exe
4540	powershell.exe
4768	powershell.exe
4768	powershell.exe
2068	process.exe
4768	powershell.exe
4540	powershell.exe
4616	process.exe
4616	process.exe
4616	process.exe
5480	powershell.exe
5480	powershell.exe
1068	powershell.exe
1068	powershell.exe
4616	process.exe
4616	process.exe
4616	process.exe
4616	process.exe
5480	powershell.exe
1068	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	1712	tmp58BF.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeDebugPrivilege	2068	process.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4616	process.exe
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4652	process.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 1280	4324	WScript.exe	97
PID 4324 wrote to memory of 1280	4324	WScript.exe	97
PID 1280 wrote to memory of 1712	1280	powershell.exe	99
PID 1280 wrote to memory of 1712	1280	powershell.exe	99
PID 1280 wrote to memory of 1712	1280	powershell.exe	99
PID 1712 wrote to memory of 1176	1712	tmp58BF.exe	103
PID 1712 wrote to memory of 1176	1712	tmp58BF.exe	103
PID 1712 wrote to memory of 1176	1712	tmp58BF.exe	103
PID 1712 wrote to memory of 5180	1712	tmp58BF.exe	105
PID 1712 wrote to memory of 5180	1712	tmp58BF.exe	105
PID 1712 wrote to memory of 5180	1712	tmp58BF.exe	105
PID 1712 wrote to memory of 4184	1712	tmp58BF.exe	107
PID 1712 wrote to memory of 4184	1712	tmp58BF.exe	107
PID 1712 wrote to memory of 4184	1712	tmp58BF.exe	107
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 1712 wrote to memory of 3752	1712	tmp58BF.exe	109
PID 3752 wrote to memory of 2068	3752	tmp58BF.exe	114
PID 3752 wrote to memory of 2068	3752	tmp58BF.exe	114
PID 3752 wrote to memory of 2068	3752	tmp58BF.exe	114
PID 1336 wrote to memory of 2416	1336	cmd.exe	115
PID 1336 wrote to memory of 2416	1336	cmd.exe	115
PID 1336 wrote to memory of 2416	1336	cmd.exe	115
PID 3836 wrote to memory of 4264	3836	cmd.exe	116
PID 3836 wrote to memory of 4264	3836	cmd.exe	116
PID 3836 wrote to memory of 4264	3836	cmd.exe	116
PID 2068 wrote to memory of 4540	2068	process.exe	120
PID 2068 wrote to memory of 4540	2068	process.exe	120
PID 2068 wrote to memory of 4540	2068	process.exe	120
PID 2068 wrote to memory of 4768	2068	process.exe	122
PID 2068 wrote to memory of 4768	2068	process.exe	122
PID 2068 wrote to memory of 4768	2068	process.exe	122
PID 2068 wrote to memory of 4720	2068	process.exe	124
PID 2068 wrote to memory of 4720	2068	process.exe	124
PID 2068 wrote to memory of 4720	2068	process.exe	124
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 2068 wrote to memory of 4652	2068	process.exe	126
PID 4280 wrote to memory of 4616	4280	cmd.exe	131
PID 4280 wrote to memory of 4616	4280	cmd.exe	131
PID 4280 wrote to memory of 4616	4280	cmd.exe	131
PID 5900 wrote to memory of 808	5900	cmd.exe	132
PID 5900 wrote to memory of 808	5900	cmd.exe	132
PID 5900 wrote to memory of 808	5900	cmd.exe	132
PID 4616 wrote to memory of 5480	4616	process.exe	133
PID 4616 wrote to memory of 5480	4616	process.exe	133
PID 4616 wrote to memory of 5480	4616	process.exe	133
PID 4616 wrote to memory of 1068	4616	process.exe	135
PID 4616 wrote to memory of 1068	4616	process.exe	135
PID 4616 wrote to memory of 1068	4616	process.exe	135

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Main_Order.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\DownloadedScript.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Users\Admin\AppData\Local\Temp\tmp58BF.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp58BF.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmp58BF.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1176
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gFnEPEuEhX.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5180
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gFnEPEuEhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAAC7.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\tmp58BF.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp58BF.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\ProgramData\Tencent\process.exe
        
        "C:\ProgramData\Tencent\process.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2068
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Tencent\process.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4540
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gFnEPEuEhX.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gFnEPEuEhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFCCF.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4720
      - C:\ProgramData\Tencent\process.exe
        
        "C:\ProgramData\Tencent\process.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Tencent\process.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\ProgramData\Tencent\process.exe
  C:\ProgramData\Tencent\process.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Tencent\process.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\ProgramData\Tencent\process.exe
  C:\ProgramData\Tencent\process.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Tencent\process.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4280
- C:\ProgramData\Tencent\process.exe
  C:\ProgramData\Tencent\process.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Tencent\process.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gFnEPEuEhX.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gFnEPEuEhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FC1.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1236
- - C:\ProgramData\Tencent\process.exe
    "C:\ProgramData\Tencent\process.exe"
    3⤵
    - Executes dropped EXE
    PID:5792
- - C:\ProgramData\Tencent\process.exe
    "C:\ProgramData\Tencent\process.exe"
    3⤵
    - Executes dropped EXE
    PID:1396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Tencent\process.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5900
- C:\ProgramData\Tencent\process.exe
  C:\ProgramData\Tencent\process.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
168B

MD5
9e8cc498d8fc30542536a05c9c707277

SHA1
2274f5ff62047db22bdec5c7c3bf2dae09a4c347

SHA256
26aa00777ea0a958880dd4cb8ad4782259cad2cca7daed6242a80f3c2f1c6e21

SHA512
e099d701d0ce0d63b1a2273a2fd009d72e97ff90e6d8a14c8c181addd6960e99d6602b22f11e946caa844dc83ed95c9e3f1113871ad4c3b8f956a266f1618f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\process.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
5b2971ee0505b044384a13cbaea05487

SHA1
d8e83296372e31d8958668986b39175bd06dfaaf

SHA256
7ef7691536a6752f8d1af95570c378967b0b2191bde971b07e5687394382c46c

SHA512
3f60dd412ed63814b19d7e60c405a85961f2e42acb0924c9c7864450b954fa88d4a3c460807011f755d0fc4d4f6792a940f484d224e7b9ace4b37de1c99968e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
728f648310d80cba8ea01fe90a7ce005

SHA1
4ea0685b1cf2074dc81ea47f38f9ad8027e230b1

SHA256
cdcc908c36ff72f51fa1f6523b9f7a954a065905369e612f9a92c595ef9b839b

SHA512
faf75d5f0fd18dfbcf1a3fcaf299a3bf9c21aa67cfc4a9e3d4a75b613fa264468587ea78c075af762da0c41b2ef3c725907348b052183f441bfa7d7a7817de88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
d02e9415135e192b0ad9af26763bd016

SHA1
1fb54c19ef3ab8517fa72165b002fa0eeae624c9

SHA256
ecb3385831b2a0ce07adc14951c678a83f5fc6f4b2309742e9b8bd4e34645de1

SHA512
f6437a39a8e4cfb2f1a00a79cd18b3235cb038019f4772ad7fc278f4010279c052844c5a56a584cd585c59d10383b4bbe2a16bb22ed45d3b49c41fa8b1bb2255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
0aa6049227c735476127b8352019e759

SHA1
068d0d1f15b15de956fbd5dd73fb8565e2a19372

SHA256
b7f29c3442ba15de780523f2990642f33fa2e58016dbd97795f8a9b6937af8c9

SHA512
6d99b0c3d76cc822bf3da420070936d8af28ab0a3a723396ec8afa82ce0254b030ed4f04e6e2db295ce77b3a7dc4968000c02dd8bbac751723eac59b978a7d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\DownloadedScript.ps1

Filesize
1.3MB

MD5
642647cf863119977d7bd52e848e0cfe

SHA1
e72fff2ea6ed161b3d3d6f22c23551b5df46d965

SHA256
7eb324d64219307096ea286640458671dc964fb218395d775dc5fe5e7f339e00

SHA512
6c5a9d36008c6b88735646517d62706ccd1713fa15beafdee6ca5e0fb3977bb770fc9ecf9111b82b6dcd6c126fc18f6655f195027f72df159a2e63f9c61c734b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zcn3chtf.lqv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp58BF.exe

Filesize
973KB

MD5
6b2ea6f71bd2165cc92875b0b87862de

SHA1
913189ac1120dd8aa61658c53e71a0b9c2908c46

SHA256
e5aa1acd8c864164ebb1e0c2cfede53df7791f504c1eb1faa15d5f637e938ebd

SHA512
b7c207b47738b43b5ee398ac325a5ebc588a74a5b3b16b4f864bf7feff92c627549b3523a1f302b6a42c66803055a931fbf5d181bba7f0c28d770dcc3d146d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAAC7.tmp

Filesize
1KB

MD5
7efe2437fc59cd7bd446b37f80081d48

SHA1
f1b02148417efef7bdc23567b3c9ca6d206ebd6d

SHA256
fcb75d0b87b114b468d831f2985d0813e1269fd2ab0d4e1c606b4e4e0ff58a06

SHA512
d4c8c284ca40d33affa104a0394c67e04d5b85355b2d5019a30fc9fb512697554815ea3d60b982e5fa27abc479e61f2035fa8d90e3a166dcf253c41f9da581b2

Download Submit
memory/1068-225-0x0000000073300000-0x000000007334C000-memory.dmp

Filesize
304KB

Download
memory/1176-99-0x00000000072E0000-0x00000000072FE000-memory.dmp

Filesize
120KB

Download
memory/1176-111-0x00000000078F0000-0x0000000007904000-memory.dmp

Filesize
80KB

Download
memory/1176-84-0x00000000750E0000-0x000000007512C000-memory.dmp

Filesize
304KB

Download
memory/1176-37-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

Filesize
216KB

Download
memory/1176-38-0x0000000005570000-0x0000000005B98000-memory.dmp

Filesize
6.2MB

Download
memory/1176-106-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/1176-41-0x0000000005350000-0x00000000053B6000-memory.dmp

Filesize
408KB

Download
memory/1176-104-0x0000000007350000-0x00000000073F3000-memory.dmp

Filesize
652KB

Download
memory/1176-112-0x00000000079F0000-0x0000000007A0A000-memory.dmp

Filesize
104KB

Download
memory/1176-40-0x00000000052B0000-0x00000000052D2000-memory.dmp

Filesize
136KB

Download
memory/1176-105-0x0000000007CF0000-0x000000000836A000-memory.dmp

Filesize
6.5MB

Download
memory/1176-113-0x00000000079D0000-0x00000000079D8000-memory.dmp

Filesize
32KB

Download
memory/1280-15-0x00007FF801E60000-0x00007FF802921000-memory.dmp

Filesize
10.8MB

Download
memory/1280-12-0x0000027342120000-0x0000027342142000-memory.dmp

Filesize
136KB

Download
memory/1280-25-0x00007FF801E60000-0x00007FF802921000-memory.dmp

Filesize
10.8MB

Download
memory/1280-2-0x00007FF801E63000-0x00007FF801E65000-memory.dmp

Filesize
8KB

Download
memory/1280-14-0x00007FF801E60000-0x00007FF802921000-memory.dmp

Filesize
10.8MB

Download
memory/1396-210-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1712-29-0x0000000005980000-0x000000000598A000-memory.dmp

Filesize
40KB

Download
memory/1712-32-0x0000000008430000-0x00000000084F4000-memory.dmp

Filesize
784KB

Download
memory/1712-30-0x0000000005C10000-0x0000000005CAC000-memory.dmp

Filesize
624KB

Download
memory/1712-28-0x00000000058E0000-0x0000000005972000-memory.dmp

Filesize
584KB

Download
memory/1712-27-0x0000000005FE0000-0x0000000006584000-memory.dmp

Filesize
5.6MB

Download
memory/1712-26-0x0000000000DF0000-0x0000000000EE4000-memory.dmp

Filesize
976KB

Download
memory/1712-31-0x0000000005AD0000-0x0000000005AE8000-memory.dmp

Filesize
96KB

Download
memory/3752-62-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3752-64-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4540-153-0x0000000006570000-0x00000000065BC000-memory.dmp

Filesize
304KB

Download
memory/4540-123-0x0000000005990000-0x0000000005CE4000-memory.dmp

Filesize
3.3MB

Download
memory/4540-165-0x0000000007300000-0x00000000073A3000-memory.dmp

Filesize
652KB

Download
memory/4540-176-0x0000000007520000-0x0000000007531000-memory.dmp

Filesize
68KB

Download
memory/4540-155-0x0000000070C80000-0x0000000070CCC000-memory.dmp

Filesize
304KB

Download
memory/4652-252-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-139-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-141-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-140-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-136-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-135-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-213-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-244-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-245-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-185-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-250-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-257-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4652-258-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4768-166-0x0000000070C80000-0x0000000070CCC000-memory.dmp

Filesize
304KB

Download
memory/4768-177-0x0000000007300000-0x0000000007314000-memory.dmp

Filesize
80KB

Download
memory/5180-82-0x0000000006A70000-0x0000000006AA2000-memory.dmp

Filesize
200KB

Download
memory/5180-78-0x0000000006490000-0x00000000064AE000-memory.dmp

Filesize
120KB

Download
memory/5180-110-0x00000000079F0000-0x00000000079FE000-memory.dmp

Filesize
56KB

Download
memory/5180-79-0x0000000006560000-0x00000000065AC000-memory.dmp

Filesize
304KB

Download
memory/5180-57-0x0000000005E60000-0x00000000061B4000-memory.dmp

Filesize
3.3MB

Download
memory/5180-109-0x00000000079C0000-0x00000000079D1000-memory.dmp

Filesize
68KB

Download
memory/5180-42-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/5180-83-0x00000000750E0000-0x000000007512C000-memory.dmp

Filesize
304KB

Download
memory/5180-108-0x0000000007A40000-0x0000000007AD6000-memory.dmp

Filesize
600KB

Download
memory/5180-107-0x0000000007830000-0x000000000783A000-memory.dmp

Filesize
40KB

Download
memory/5480-224-0x0000000007270000-0x0000000007313000-memory.dmp

Filesize
652KB

Download
memory/5480-236-0x00000000076A0000-0x00000000076B4000-memory.dmp

Filesize
80KB

Download
memory/5480-235-0x0000000007650000-0x0000000007661000-memory.dmp

Filesize
68KB

Download
memory/5480-214-0x0000000073300000-0x000000007334C000-memory.dmp

Filesize
304KB

Download
memory/5480-193-0x0000000005A50000-0x0000000005DA4000-memory.dmp

Filesize
3.3MB

Download
memory/5480-212-0x0000000006170000-0x00000000061BC000-memory.dmp

Filesize
304KB

Download