mRemoteNG

Appsv1

Author: Markus Einarsson (@einarssonm)

description

mRemoteNG

paths

3 paths

CommunicationsmRemoteNG Logs

C:\Users\%user%\AppData\Roaming\mRemoteNG\mRemoteNG.log

Contains log entries for remote connections

CommunicationsmRemoteNG Connection Configuration and Backups

C:\Users\%user%\AppData\Roaming\mRemoteNG\confCons.xml*

Contains connection config, often with obfuscated credentials

CommunicationsmRemoteNG Program Settings

C:\Users\%user%\AppData\*\mRemoteNG\user.config

Contains user-specific program settings

› paths use Windows environment syntax

collection commands

source:

destination:

# PowerShell Artifact Collection Script
# Target: mRemoteNG
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. mRemoteNG Logs
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\mRemoteNG\"
Collect-Artifact -SourcePath "$UserPath\mRemoteNG.log" -FolderName "mRemoteNG_Logs"

# 2. mRemoteNG Connection Configuration and Backups
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\mRemoteNG\"
Collect-Artifact -SourcePath "$UserPath\confCons.xml*" -FolderName "mRemoteNG_Connection_Configuration_and_Backups"

# 3. mRemoteNG Program Settings
$UserPath = Join-Path $env:USERPROFILE "AppData\*\mRemoteNG\"
Collect-Artifact -SourcePath "$UserPath\user.config" -FolderName "mRemoteNG_Program_Settings"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1