Analysis

  • max time kernel
    4294201s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    14-03-2022 17:06

General

  • Target

    b99be412390b1eee50bca4b7f5a152c5ca7782fa9fef0107762be9c5fe01e743.exe

  • Size

    9.4MB

  • MD5

    d1b8484fc84c85b2d75e850f44d193fb

  • SHA1

    8901ee513eca44bd50115c1ef8cef90fed050e4b

  • SHA256

    b99be412390b1eee50bca4b7f5a152c5ca7782fa9fef0107762be9c5fe01e743

  • SHA512

    9e93ea0720e9c8a84f109d1caf734d2418f40b20b341dd1809c5135741d91cb947e1bfe4095f24bc08d6d349faf0992e7a3d3ee43f36a42496a18f714a92e1d7

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • RevengeRat Executable 9 IoCs
  • Executes dropped EXE 10 IoCs
  • Drops startup file 3 IoCs
  • Loads dropped DLL 35 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b99be412390b1eee50bca4b7f5a152c5ca7782fa9fef0107762be9c5fe01e743.exe
    "C:\Users\Admin\AppData\Local\Temp\b99be412390b1eee50bca4b7f5a152c5ca7782fa9fef0107762be9c5fe01e743.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe
      "C:\Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:568
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Monotone.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Monotone.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xsdg17wr.cmdline"
          4⤵
          • Drops startup file
          PID:1988
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB636.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB635.tmp"
            5⤵
              PID:1724
      • C:\Users\Admin\AppData\Local\Temp\Monotone-Starter.exe
        "C:\Users\Admin\AppData\Local\Temp\Monotone-Starter.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1268
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\tk.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\tk.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:596
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c pass.exe /stext 1.txt
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:540
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pass.exe
              pass.exe /stext 1.txt
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:1956
      • C:\Users\Admin\AppData\Local\Temp\Monotone-Spoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\Monotone-Spoofer.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\478B.tmp\478C.tmp\478D.bat C:\Users\Admin\AppData\Local\Temp\Monotone-Spoofer.exe"
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2012
          • C:\Windows\system32\mode.com
            mode 80,20
            4⤵
              PID:1232
            • C:\Windows\system32\PING.EXE
              ping localhost
              4⤵
              • Runs ping.exe
              PID:1488
            • C:\Users\Admin\AppData\Local\Temp\colorecho-vc10-x86_64.exe
              colorecho-vc10-x86_64.exe " Monotone" 1
              4⤵
              • Executes dropped EXE
              PID:976
            • C:\Users\Admin\AppData\Local\Temp\batbox.exe
              batbox /c 0xf0 /g 21 17 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /g 21 16 /a 32 /d " " /a 32 /g 21 15 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /c 0x07
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1940
            • C:\Users\Admin\AppData\Local\Temp\batbox.exe
              Batbox /g 23 16 /c 0xf0 /d " Enter " /c 0x07
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:692
            • C:\Users\Admin\AppData\Local\Temp\GetInput.exe
              GetInput /M 21 15 39 17 /H 70 70
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1964

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\478B.tmp\478C.tmp\478D.bat

        MD5

        c5b9f5f77bee19857e4331300d080e3b

        SHA1

        50f5d39311cf12636d9ebe58aa4464578995f112

        SHA256

        a689ce9bdcdbc32ad39cbab6349453847a71a386cb4c4be4ffe2daff57fce52d

        SHA512

        ecb86677eb5bb0c0dc8b7c1d351cd7409772699393ebce902fcaa05442d46da112cfe8ca2215794ae2308c573d56fd51fd8920c488ff20c7b1c96cd7fced1dd1

      • C:\Users\Admin\AppData\Local\Temp\Button.bat

        MD5

        96fefe69f2facf74197a8af3004a6167

        SHA1

        80baf02b5d984dd8055ac3a6f42593ad98b78307

        SHA256

        38aa0c1ad69d96732c776cbd73275f5ccb881d42158158b32815dad869ef9876

        SHA512

        1aa6335a5cc340191613c52fa3e55625ed058abad8bd8d5ed1575bb9cd59b19e1fb3fcf3f5df199ea6f9b9d10bdee45e099c9247457b35ea65c7b1e403f0e888

      • C:\Users\Admin\AppData\Local\Temp\Monotone-Spoofer.exe

        MD5

        cd6cddac2686df01814705f21e6da343

        SHA1

        f29ad4efdc160ffba5cb63e01349ec9b84123e30

        SHA256

        0f7f86530b7fa2e693a2a3a5bf69957e61c2f45d39418d077285a1ea6f4bb992

        SHA512

        a673d521f316d3e0fa87a99effa33c5dc4fde315e72b7f6cbb828a94ffe8ebeed4bf9ca6fe858b3c69327aa4ce05ae02b37e2a392abb7cc728c4bbe2ab9a6de4

      • C:\Users\Admin\AppData\Local\Temp\Monotone-Starter.exe

        MD5

        0496cb725385619fb77acee33aa9e057

        SHA1

        581ca3efbd308fa6b89a66be36f7fcdc70da57e4

        SHA256

        7a6501943f695cff1cea15b5a3bd1510478dcde394f2b34375369c73b184d19a

        SHA512

        d9281c2bb30c1c64b9187e86eec5b4d9b3f1abc70a41cd151031f9cecb4813797abd675d764034734c5866c3f719d0e12ea64c7304bce10241a3fdaf86e65858

      • C:\Users\Admin\AppData\Local\Temp\Monotone-Starter.exe

        MD5

        0496cb725385619fb77acee33aa9e057

        SHA1

        581ca3efbd308fa6b89a66be36f7fcdc70da57e4

        SHA256

        7a6501943f695cff1cea15b5a3bd1510478dcde394f2b34375369c73b184d19a

        SHA512

        d9281c2bb30c1c64b9187e86eec5b4d9b3f1abc70a41cd151031f9cecb4813797abd675d764034734c5866c3f719d0e12ea64c7304bce10241a3fdaf86e65858

      • C:\Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • C:\Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\_socket.pyd

        MD5

        a4bd8e0c0597a22c3f0601fe798668aa

        SHA1

        5f4a7a23bcdb2d32fb15997536cddfd7f2bf7ca8

        SHA256

        96b0a3cfc16e215f0ef5d1e206f0137b4255005052720e91a58bc98cde8c898e

        SHA512

        7b325ab8b1978b8e8b23aad5714855b96c4c4284f7618475187a8d9043b04c4f79e6953c7d2b03981f34d31e7bd7d21747891d47dedd4f8f7646d3281f779ac0

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\_ssl.pyd

        MD5

        cc5c8eb32acb2261c42a7285d436cca9

        SHA1

        4845cde2d307e84e3076015a71f8ebc733aa71da

        SHA256

        07ea50e536886f68473635ffefcfcaa7266e63c478ef039ba100ddf02f88ce61

        SHA512

        352f3201a0f47e7741c3c9bfa207769f1afe287a9e9f4e6879d37b2a9cf7fc6ace02ebf0de1ad4a5847134bc3adfeee748f955d8d554b0f552d0e98703c6cd88

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\collections\__init__.pyc

        MD5

        d7374d2b4f5c84f1656b41abc2e483c9

        SHA1

        9531d05927cadc6df7d52a23fe43bb61661caf0f

        SHA256

        fe5306608e8ba3d236ace081b7ba7387656d3b158758d4b05e474f1e3bf4fff3

        SHA512

        314931083bf60daa0bac24051b6ea2a7501dd9836eedd1be7d68bdab24606efed143bb926982b2fced65f7c2f533abd36a21ec1fc623cd70674e46e34ee9a67c

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\collections\abc.pyc

        MD5

        1fbf4e36c62dc217c0b2e2b9bcf3b8a9

        SHA1

        2b6d4ec3c7048bf5e72ea38a38b01e6be6bc49a9

        SHA256

        1c65dc3c07f5377f9b3fadec7daf509710c662bf8453c4370dbdbc550ca5178c

        SHA512

        818e3b2e58a8ece01005545370f9c6541c9554b1ee8ff98c8edf8407e08488ab6f08b6843feecf70424b3d8727fe2bf2d65584e0687ed0f0cbf4534ee7a5768a

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\encodings\__init__.pyc

        MD5

        a9606233f772487f73c8b2ff15740dd1

        SHA1

        0f0836595be78be26c22caba1ed8a2ced601f110

        SHA256

        6add416d8a18747a4a8d52ab5a2ecbbd62d1107581a81aab3fafaa7e17231faa

        SHA512

        78bb4726b859d768c461409c7c5675142baaecefc672845bdeda6daae13edd53c7a8c50cc9385aa237e903403febeb9762213f46fde9d8b7287d2f6e322de546

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\encodings\aliases.pyc

        MD5

        47119def4b0a69a9e3eeb0ee7a7f1fc4

        SHA1

        867d69e7e8468fb42b3f4ef252c661c9beeabcaf

        SHA256

        ceb35af028794e1486e41e67a92c2be7b6e5b6358cbae1ed288cd785b1a2a0db

        SHA512

        7fd1b1dd517ae558705d37461bf9498325443799eb4a515b15f4892ed73af54b9eecaa35b82945c38b82ab0c9a94bce38e9da6701098cbcc601dc473422c95dd

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\encodings\latin_1.pyc

        MD5

        56e868c3ed0c60c9cc642b91da46747b

        SHA1

        2d474d17db89a2b829ee8131a0a9d036ba296bdd

        SHA256

        f8bc94a0fccfa662d9102757b18e86395ff8331d55be66c9ca2191f3d308bfd4

        SHA512

        edcd2974031cc4ec99cdc221f6f6c2db98cae32aa86ece22f778b8aec87465cb141f00f89febeaafd4571081b9055883607d09bfdc2bb05ce710d89a067d25dc

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\encodings\utf_8.pyc

        MD5

        092c4c1423f5ec2ea6204a594b2939ae

        SHA1

        4e630d267be152bc9d9a396e88e097ae0e3c40ce

        SHA256

        95769f29230111308b26845d55eb33a306e53189ae436322c03f0f857a327f20

        SHA512

        bd07346e4507403960143ff9533582faea30abab7c84803ede45653edda1ed78bc7989dd5ef2511ace7f4f0c5185f890f44e066499567a828ecef0b373c436c8

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\importlib\__init__.pyc

        MD5

        8a6d41718b406876bd0d84073dc96bf4

        SHA1

        e1df6e4822ae25633ef9a0aa67e73ef27ade9cb5

        SHA256

        87e4bb3d9010cf401c29b68b5f49e4cadac97c074095a8f90200bec2939dcd69

        SHA512

        3b4d84da6f60529190a03cb48df5b19b780cb027d14f40c1823a05576248bddc81d9c03d584e6164a7bd56b3f9c204521a0c8303f36bbd76ae7ea2ffd53aef35

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\importlib\abc.pyc

        MD5

        4de14332654c0871d623b7a6cf9824d0

        SHA1

        2a131ffdc13f412acfae212ca55d214e87e2a0a4

        SHA256

        301d5d697ac0a0e431a858ddc17387e02f74f48b9e2a73acd7d4859220cd5e37

        SHA512

        e086f80dd1c7385024fe4d4d1f2f2fa44c49132e2c1db971fc592645b7aa5c3327d43d2a602fc19c4dcd3cd2e846781b3d759da5422556e2b7605798ba13cd47

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\importlib\machinery.pyc

        MD5

        991a91d835b6c6be1be457fa55b7fd3d

        SHA1

        6d63529ccb754932fe912ddb1e74c4ec4dfb2af9

        SHA256

        ce13a5c6f52ac271ef3da8ebeb5668d979667794b6ea577e3f4fd5c92dcf1768

        SHA512

        cc7657b6487e8ffa01fb8c1171d7cbdf8ed4fb08ec9b2dbd317937fc7cb88f73957513355a4ac9dea36f6221f8da229f6db660018be328857983122a9464f3bb

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\importlib\util.pyc

        MD5

        0d98dbe516c6c9a798c59a8e48758863

        SHA1

        9505ae87830adda0ce40e05c635ebe3290b90409

        SHA256

        2e43c01be79effffef2cb7d7f8d1c17c55b8974938a27287716ba21e12e1df06

        SHA512

        ef96f2bb4c4a40f7b2f65778a46151eaf2c1e3c697679f893f058974b5ac1208b759cbc7436033de81cca59373c696043812a8967f1dd347c623cdba7a71ada7

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\json\__init__.pyc

        MD5

        ca451cc36b836b878edd1170ac2e8f31

        SHA1

        ce6254d671c6f5593736526cbc8b890ce07fd87e

        SHA256

        c270e6748aa0661643d66604765c2c86723cdc68a6496b2351d4ccba720ca3d4

        SHA512

        da9b9f43547bea928a347710e7bd146bbb328159e4d387d58939a76fc6b2e241005ac449c1ab70513b5ce2279939faba3a4a015c50e821970442adccfcd20490

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\json\decoder.pyc

        MD5

        63e208772823a96b4e9d099ac855b3c6

        SHA1

        ff91457969014a065078223fd28872f0c716add4

        SHA256

        149b17234b7e47ef82a2bc37a7dcf0b75f1bf7fb8a33ef625c7e5c34409bd692

        SHA512

        381c74195bb794cfe27a6bc75e986569267360e7adbf5349c4ecb9b36c71e2810090502a8006264cfe0934122e4ae1beacfda24c671a08bbfc3148077e5edd1b

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\json\encoder.pyc

        MD5

        9572aa24d394f169aa135ab4aaac3e4e

        SHA1

        f54c3f21c5a3a4ca482dc95b6a52f61c94094996

        SHA256

        ecacaac6fb4b273f9d87f7f62e460b85b5b08f111d7e40840a683cace266412b

        SHA512

        6de2f647cf90f22267375b58a132764e3d2862e3079fb8b57fcf59a2fae506abd67216a64649e9d5d242a90f283618317697a9797245207b799f1e979e2240a4

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\json\scanner.pyc

        MD5

        340a86b7f3c1f9ff9d5081f5bf0b7769

        SHA1

        dcca5d96b1496516d1459d27b80658db0c682441

        SHA256

        46032bd42484f60bd376598f457ce06003e184c1bd0dc16f8066af7cd07c0ac0

        SHA512

        84b746f4c2c9e77741ca8363ae151ce7dd935cffa20e2f3c81100dcf32c10215c4888edcd07b3d0004dcd67405013425cc49990639320fe53d5d4a783358131f

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\libcrypto-1_1.dll

        MD5

        c0e55a25dd5c5447f15eed0ca6552ab7

        SHA1

        467bc011e0224df3e6b73ac3b88a97b911cc73b8

        SHA256

        9fefba93fa3300732b7e68fb3b4dbb57bf2726889772a1d0d6694a71820d71f3

        SHA512

        090b03626df2f26e485fea34f9e60a35c9d60957fbcc2db9c8396a75a2b246669451cc361eb48f070bbc051b12e40cacf2749488ebb8012ba9072d9f0b603fa6

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\library.zip

        MD5

        e3a0c33716147a5f6074d92a10f1b083

        SHA1

        aad3048828627682aef7a313d1aed7eb2607ea5f

        SHA256

        7e0afb32c3dd3cd3c401480e32b1122b5c09812d252bdcf7e967a7518fdfc7fd

        SHA512

        162b8b5299c2ccd0ed5c4031ad1e408bfc8e56a39262e3b79321e648c0204b7bfe0627f613b8a76f7ef50c9c11be66ab8515fe4d24fdf40e0355cfad1dd13e73

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\libssl-1_1.dll

        MD5

        5adb49cc84abd6d3c8f959ca5a146ad7

        SHA1

        90faa543515960b2d47554b86d2478105497d853

        SHA256

        f4d5df50bdf3e7304c67c81ace83263c8d0f0e28087c6104c21150bfeda86b8d

        SHA512

        bf184a25e32bea2ac7d76d303562118eaa87bb5cd735142d6aa5a1a9247290d28c45476842e22c61e47a06316595834f8c0ebb35dfc622fe2f02a1e44a91e5d8

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\logging\__init__.pyc

        MD5

        14fb65fecb5414c611e4c37845a40e3d

        SHA1

        f23d94822cf17ed823674190a2bf6232f9ae30f9

        SHA256

        2beae7a02f2d770bfafd91822bbddf3f7ae98ba9258e83f57753cd63280237e1

        SHA512

        663c521a30798245aa026368e7692cfabde46eaed7e4348e915da6d4b6fa01d256a2d8fcace96c32db2f3e42c82b4d9450c168db690679d3a0efe2ec55d120b6

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\requests\__init__.pyc

        MD5

        8f2557151466b97d690a53e3bc3f29c2

        SHA1

        a5999cc51e4be21be4e89aa4a8be1f27adaf3d3a

        SHA256

        302bef84293492e493aed87ce163f2e16da8329e55ff7f040998f291c528f489

        SHA512

        389c02a8bae2b02bfda377eb9899b6accda3c36e97051de22a1534d1c859317229124cf09c21ea133deb9c8f09e0273a643591a8551009dccc0c7981aa9e89cf

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\select.pyd

        MD5

        6a796088cd3d1b1d6590364b9372959d

        SHA1

        3de080d32b14a88a5e411a52d7b43ff261b2bf5e

        SHA256

        74d8e6a57090ba32cf7c82ad9a275351e421842d6ec94c44adbba629b1893fa7

        SHA512

        582d9a3513724cc197fd2516528bfd8337f73ae1f5206d57f683bf96367881e8d2372be100662c67993edecfbd7e2f903c0be70579806a783267b82f32abd200

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\telebot\__init__.pyc

        MD5

        43d603dae54d6847c711fbcc1c0daca8

        SHA1

        54bc067b291fdcf6c40dc6583ad06c08078bf420

        SHA256

        41a0c5afe323cf0a041efc272c0b39606c188cd08aa15c28eec0ac5dc3d032a6

        SHA512

        d09b0ee98cd84417dedc44f68723ad7c8b32c6e2cdbc69b614df56a4eb2ff574dccea6415c82ed8fe754d009400e913055ee6ad4cfc589007e17b0f49b44fff3

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\telebot\apihelper.pyc

        MD5

        caf1066fa9db760928ea9fde7b10133d

        SHA1

        d6c033043f17350083b03b54ac0198edb43491d1

        SHA256

        7cf27d0211a895064d54e564e7733bbc12802cdda74f494bc79b54d0a4ee3d4d

        SHA512

        d66fc1c86a476573ea72ffa60fa0ae7213165f3c6f13e0d1bc9e8a7234f914c1cc679bce7cac88475f27c089ca372897a1fffe1e7a09c7d555d35447c41b351c

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\__init__.pyc

        MD5

        2093c8cfd9c53188654e33c5a0a7a702

        SHA1

        37e87aa3494f12f3fe81020d89e1348e41f4426d

        SHA256

        3c96ed048ed43cae65d8a60a3fed0e2caacd4a18f9a87ad7835c9235581161ee

        SHA512

        e23e9f71001bd0bb1fbf7ca2f13730d35dceeb6e50cfbd63b825764143087368af9cc8cfb91263b1e191571e1cb16804c7baefbc5d3d69ac3900599c50b5d9aa

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\connectionpool.pyc

        MD5

        a61acfd25425a1f856320659686b038c

        SHA1

        8b94e285a02f259ef06a400b9e9837be4cda7e46

        SHA256

        1f1c5174722fa4fc29f4f4bce1b05867dc9be759917a9303b5fbd87cf86f08eb

        SHA512

        4ca8627d73d788b1fd9c3a4557af58a630f56f4cd86fc3dfc46497fde6ef8b2a6f89c029e39de1602d49736c9940b1e5ad49f350a4ee20aece8032339283deeb

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\exceptions.pyc

        MD5

        319e8d6c3e89853f3a090a8b06d97211

        SHA1

        768563ce7cafa10b4ff963045d2bedf8cab3730d

        SHA256

        b9d9ff0d2f4de97b112bf7151245281ce6170a651f919bcebd993370f7e1dc4e

        SHA512

        48c96cbfc35e8a3de63d0b07fce8434e510c1656814a6030f110e6c6641785b3b339a6fdbaa67274fd34de2aa7248b52aabab32f88e0732fe8cd89d4dcb4d016

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\packages\__init__.pyc

        MD5

        5ae0941e82ef9d8621d6973a2bb44fb8

        SHA1

        1a44088787703a332a6bb32d0f7b66b375799579

        SHA256

        12431f536fbcbc32efeddfb931ab53fb62ca37726f4a6708d97959ab08154d86

        SHA512

        de26951ced5a4e7d3e93448b104dbf56ad14c57d9b6efb5a9c97dbda71ddc144ce540f290baaf2fdc0f5a422414f89672371111c6f7e4f40863f81f969d97ec9

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\packages\ssl_match_hostname\__init__.pyc

        MD5

        4f5cd4030a6cb2b9dd5b207a43b76ac6

        SHA1

        f33d1744ec12443e6cce830fd763a16348aedb5c

        SHA256

        fb7d528d0945db98517c6fa699bd75f4aee04ee7c48210692c072156c2500e2e

        SHA512

        4ea7e07c32d359ac1559157e743c4593db5f6670dd257c62ce9042b2dd1cc60eb0235347b649be9904ca3fa7d80fded65e2c1dbaf7bac411c7b655cbbe0151ca

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\python37.dll

        MD5

        d49eac0faa510f2b2a8934a0f4e4a46f

        SHA1

        bbe4ab5dae01817157e2d187eb2999149a436a12

        SHA256

        625ca7bb2d34a3986f77c0c5ce572a08febfcacf5050a986507e822ff694dcaa

        SHA512

        b17f3370ecd3fe90b928f4a76cbad934b80b96775297acc1181b18ede8f2c8a8301d3298bafa4402bce4138df69d4b57e00e224a4ddbb0d78bb11b217a41a312

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\tk.exe

        MD5

        569b8f9c079e443c643ecd1133c898b8

        SHA1

        05ddc600527dba0f5d0ac2d81ad82c0490f01853

        SHA256

        bdf1f895167cd51a9d75c2ae40e1055a81d9952c660c2c47e0fe7d4e17046fb4

        SHA512

        ff17d2edda34483db40d1b4cfbf7e8b6c2b8fc926e2c9ad0fc672bf914d5003ecfd358205bd497473214987f7e3d34fae5ddb4843de3bfb205d490e7eb216d1f

      • C:\Users\Admin\AppData\Local\Temp\colorecho-vc10-x86_64.exe

        MD5

        e2f377052409beeebf852803734e007a

        SHA1

        4d5e977acc59912bd451edae77ad58d977ed086b

        SHA256

        76fe5f9cef2c3a5c4f765d4c45167f4cf26cc6d469031f0d195d96724e9d82a8

        SHA512

        d88d3319a32ec3a8475fae03c74b1a5d7d8e92f3f5ffa1bc3326779d7d39e0bd18928a511be1ac965fb1c2e2da1cf0935fea38bbf847f54033887c62b6c842d7

      • C:\Users\Admin\AppData\Local\Temp\colorecho-vc10-x86_64.exe

        MD5

        e2f377052409beeebf852803734e007a

        SHA1

        4d5e977acc59912bd451edae77ad58d977ed086b

        SHA256

        76fe5f9cef2c3a5c4f765d4c45167f4cf26cc6d469031f0d195d96724e9d82a8

        SHA512

        d88d3319a32ec3a8475fae03c74b1a5d7d8e92f3f5ffa1bc3326779d7d39e0bd18928a511be1ac965fb1c2e2da1cf0935fea38bbf847f54033887c62b6c842d7

      • \Users\Admin\AppData\Local\Temp\Monotone-Spoofer.exe

        MD5

        cd6cddac2686df01814705f21e6da343

        SHA1

        f29ad4efdc160ffba5cb63e01349ec9b84123e30

        SHA256

        0f7f86530b7fa2e693a2a3a5bf69957e61c2f45d39418d077285a1ea6f4bb992

        SHA512

        a673d521f316d3e0fa87a99effa33c5dc4fde315e72b7f6cbb828a94ffe8ebeed4bf9ca6fe858b3c69327aa4ce05ae02b37e2a392abb7cc728c4bbe2ab9a6de4

      • \Users\Admin\AppData\Local\Temp\Monotone-Spoofer.exe

        MD5

        cd6cddac2686df01814705f21e6da343

        SHA1

        f29ad4efdc160ffba5cb63e01349ec9b84123e30

        SHA256

        0f7f86530b7fa2e693a2a3a5bf69957e61c2f45d39418d077285a1ea6f4bb992

        SHA512

        a673d521f316d3e0fa87a99effa33c5dc4fde315e72b7f6cbb828a94ffe8ebeed4bf9ca6fe858b3c69327aa4ce05ae02b37e2a392abb7cc728c4bbe2ab9a6de4

      • \Users\Admin\AppData\Local\Temp\Monotone-Starter.exe

        MD5

        0496cb725385619fb77acee33aa9e057

        SHA1

        581ca3efbd308fa6b89a66be36f7fcdc70da57e4

        SHA256

        7a6501943f695cff1cea15b5a3bd1510478dcde394f2b34375369c73b184d19a

        SHA512

        d9281c2bb30c1c64b9187e86eec5b4d9b3f1abc70a41cd151031f9cecb4813797abd675d764034734c5866c3f719d0e12ea64c7304bce10241a3fdaf86e65858

      • \Users\Admin\AppData\Local\Temp\Monotone-Starter.exe

        MD5

        0496cb725385619fb77acee33aa9e057

        SHA1

        581ca3efbd308fa6b89a66be36f7fcdc70da57e4

        SHA256

        7a6501943f695cff1cea15b5a3bd1510478dcde394f2b34375369c73b184d19a

        SHA512

        d9281c2bb30c1c64b9187e86eec5b4d9b3f1abc70a41cd151031f9cecb4813797abd675d764034734c5866c3f719d0e12ea64c7304bce10241a3fdaf86e65858

      • \Users\Admin\AppData\Local\Temp\Monotone-Starter.exe

        MD5

        0496cb725385619fb77acee33aa9e057

        SHA1

        581ca3efbd308fa6b89a66be36f7fcdc70da57e4

        SHA256

        7a6501943f695cff1cea15b5a3bd1510478dcde394f2b34375369c73b184d19a

        SHA512

        d9281c2bb30c1c64b9187e86eec5b4d9b3f1abc70a41cd151031f9cecb4813797abd675d764034734c5866c3f719d0e12ea64c7304bce10241a3fdaf86e65858

      • \Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • \Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • \Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • \Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • \Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • \Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • \Users\Admin\AppData\Local\Temp\MonotoneUpdater.exe

        MD5

        5167555a2d5a69c8152c78393027eee3

        SHA1

        c7fc3ba4e00e2be22bfec6d9048cf1a5b3947320

        SHA256

        99309281c0fd45b553df3cdafe486aca822dd52d3d3fb3ad54ffa80af0623d8e

        SHA512

        9a6a1e129a0086416f656dc819092cfefbaa4341e9e19316a8beda2d90886cca3aa380fe90d0d9bfe0ce230154da2882f2b02cd181a7d43ae6c7691d3b917af2

      • \Users\Admin\AppData\Local\Temp\RarSFX0\lib\_socket.pyd

        MD5

        a4bd8e0c0597a22c3f0601fe798668aa

        SHA1

        5f4a7a23bcdb2d32fb15997536cddfd7f2bf7ca8

        SHA256

        96b0a3cfc16e215f0ef5d1e206f0137b4255005052720e91a58bc98cde8c898e

        SHA512

        7b325ab8b1978b8e8b23aad5714855b96c4c4284f7618475187a8d9043b04c4f79e6953c7d2b03981f34d31e7bd7d21747891d47dedd4f8f7646d3281f779ac0

      • \Users\Admin\AppData\Local\Temp\RarSFX0\lib\_ssl.pyd

        MD5

        cc5c8eb32acb2261c42a7285d436cca9

        SHA1

        4845cde2d307e84e3076015a71f8ebc733aa71da

        SHA256

        07ea50e536886f68473635ffefcfcaa7266e63c478ef039ba100ddf02f88ce61

        SHA512

        352f3201a0f47e7741c3c9bfa207769f1afe287a9e9f4e6879d37b2a9cf7fc6ace02ebf0de1ad4a5847134bc3adfeee748f955d8d554b0f552d0e98703c6cd88

      • \Users\Admin\AppData\Local\Temp\RarSFX0\lib\libcrypto-1_1.dll

        MD5

        c0e55a25dd5c5447f15eed0ca6552ab7

        SHA1

        467bc011e0224df3e6b73ac3b88a97b911cc73b8

        SHA256

        9fefba93fa3300732b7e68fb3b4dbb57bf2726889772a1d0d6694a71820d71f3

        SHA512

        090b03626df2f26e485fea34f9e60a35c9d60957fbcc2db9c8396a75a2b246669451cc361eb48f070bbc051b12e40cacf2749488ebb8012ba9072d9f0b603fa6

      • \Users\Admin\AppData\Local\Temp\RarSFX0\lib\libssl-1_1.dll

        MD5

        5adb49cc84abd6d3c8f959ca5a146ad7

        SHA1

        90faa543515960b2d47554b86d2478105497d853

        SHA256

        f4d5df50bdf3e7304c67c81ace83263c8d0f0e28087c6104c21150bfeda86b8d

        SHA512

        bf184a25e32bea2ac7d76d303562118eaa87bb5cd735142d6aa5a1a9247290d28c45476842e22c61e47a06316595834f8c0ebb35dfc622fe2f02a1e44a91e5d8

      • \Users\Admin\AppData\Local\Temp\RarSFX0\lib\select.pyd

        MD5

        6a796088cd3d1b1d6590364b9372959d

        SHA1

        3de080d32b14a88a5e411a52d7b43ff261b2bf5e

        SHA256

        74d8e6a57090ba32cf7c82ad9a275351e421842d6ec94c44adbba629b1893fa7

        SHA512

        582d9a3513724cc197fd2516528bfd8337f73ae1f5206d57f683bf96367881e8d2372be100662c67993edecfbd7e2f903c0be70579806a783267b82f32abd200

      • \Users\Admin\AppData\Local\Temp\RarSFX0\python37.dll

        MD5

        d49eac0faa510f2b2a8934a0f4e4a46f

        SHA1

        bbe4ab5dae01817157e2d187eb2999149a436a12

        SHA256

        625ca7bb2d34a3986f77c0c5ce572a08febfcacf5050a986507e822ff694dcaa

        SHA512

        b17f3370ecd3fe90b928f4a76cbad934b80b96775297acc1181b18ede8f2c8a8301d3298bafa4402bce4138df69d4b57e00e224a4ddbb0d78bb11b217a41a312

      • \Users\Admin\AppData\Local\Temp\RarSFX0\tk.exe

        MD5

        569b8f9c079e443c643ecd1133c898b8

        SHA1

        05ddc600527dba0f5d0ac2d81ad82c0490f01853

        SHA256

        bdf1f895167cd51a9d75c2ae40e1055a81d9952c660c2c47e0fe7d4e17046fb4

        SHA512

        ff17d2edda34483db40d1b4cfbf7e8b6c2b8fc926e2c9ad0fc672bf914d5003ecfd358205bd497473214987f7e3d34fae5ddb4843de3bfb205d490e7eb216d1f

      • \Users\Admin\AppData\Local\Temp\RarSFX0\tk.exe

        MD5

        569b8f9c079e443c643ecd1133c898b8

        SHA1

        05ddc600527dba0f5d0ac2d81ad82c0490f01853

        SHA256

        bdf1f895167cd51a9d75c2ae40e1055a81d9952c660c2c47e0fe7d4e17046fb4

        SHA512

        ff17d2edda34483db40d1b4cfbf7e8b6c2b8fc926e2c9ad0fc672bf914d5003ecfd358205bd497473214987f7e3d34fae5ddb4843de3bfb205d490e7eb216d1f

      • \Users\Admin\AppData\Local\Temp\RarSFX0\tk.exe

        MD5

        569b8f9c079e443c643ecd1133c898b8

        SHA1

        05ddc600527dba0f5d0ac2d81ad82c0490f01853

        SHA256

        bdf1f895167cd51a9d75c2ae40e1055a81d9952c660c2c47e0fe7d4e17046fb4

        SHA512

        ff17d2edda34483db40d1b4cfbf7e8b6c2b8fc926e2c9ad0fc672bf914d5003ecfd358205bd497473214987f7e3d34fae5ddb4843de3bfb205d490e7eb216d1f

      • \Users\Admin\AppData\Local\Temp\RarSFX0\tk.exe

        MD5

        569b8f9c079e443c643ecd1133c898b8

        SHA1

        05ddc600527dba0f5d0ac2d81ad82c0490f01853

        SHA256

        bdf1f895167cd51a9d75c2ae40e1055a81d9952c660c2c47e0fe7d4e17046fb4

        SHA512

        ff17d2edda34483db40d1b4cfbf7e8b6c2b8fc926e2c9ad0fc672bf914d5003ecfd358205bd497473214987f7e3d34fae5ddb4843de3bfb205d490e7eb216d1f

      • \Users\Admin\AppData\Local\Temp\colorecho-vc10-x86_64.exe

        MD5

        e2f377052409beeebf852803734e007a

        SHA1

        4d5e977acc59912bd451edae77ad58d977ed086b

        SHA256

        76fe5f9cef2c3a5c4f765d4c45167f4cf26cc6d469031f0d195d96724e9d82a8

        SHA512

        d88d3319a32ec3a8475fae03c74b1a5d7d8e92f3f5ffa1bc3326779d7d39e0bd18928a511be1ac965fb1c2e2da1cf0935fea38bbf847f54033887c62b6c842d7

      • \Users\Admin\AppData\Local\Temp\colorecho-vc10-x86_64.exe

        MD5

        e2f377052409beeebf852803734e007a

        SHA1

        4d5e977acc59912bd451edae77ad58d977ed086b

        SHA256

        76fe5f9cef2c3a5c4f765d4c45167f4cf26cc6d469031f0d195d96724e9d82a8

        SHA512

        d88d3319a32ec3a8475fae03c74b1a5d7d8e92f3f5ffa1bc3326779d7d39e0bd18928a511be1ac965fb1c2e2da1cf0935fea38bbf847f54033887c62b6c842d7

      • memory/568-78-0x0000000073FB0000-0x000000007455B000-memory.dmp

        Filesize

        5.7MB

      • memory/568-76-0x0000000073FB0000-0x000000007455B000-memory.dmp

        Filesize

        5.7MB

      • memory/568-77-0x0000000002050000-0x0000000002051000-memory.dmp

        Filesize

        4KB

      • memory/1604-54-0x0000000076851000-0x0000000076853000-memory.dmp

        Filesize

        8KB

      • memory/1728-127-0x0000000073710000-0x0000000073CBB000-memory.dmp

        Filesize

        5.7MB

      • memory/1728-128-0x0000000002160000-0x0000000002161000-memory.dmp

        Filesize

        4KB

      • memory/1780-73-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

        Filesize

        8KB