revengerat | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

max time kernel
145s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2023 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Size

21KB
MD5

6fe3fb85216045fdf8186429c27458a7
SHA1

ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA256

905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
SHA512

d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
SSDEEP

384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1

Score

10^/10

revengerat xdsddd stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

XDSDDD

84.91.119.105:333

Mutex

RV_MUTEX-wtZlNApdygPh

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 4 IoCs

stealer

resource	yara_rule
behavioral28/files/0x0009000000022e72-14.dat	revengerat
behavioral28/files/0x0009000000022e72-16.dat	revengerat
behavioral28/files/0x0009000000022e72-17.dat	revengerat
behavioral28/memory/4616-20-0x00000000012A0000-0x00000000012B0000-memory.dmp	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	MSSCS.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	MSSCS.exe

Executes dropped EXE 1 IoCs

pid	Process
4616	MSSCS.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\MSSCS.exe	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
File opened for modification	C:\Windows\system32\MSSCS.exe	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
File opened for modification	C:\Windows\system32\MSSCS.exe	MSSCS.exe
File created	C:\Windows\system32\MSSCS.exe	MSSCS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Token: SeDebugPrivilege	4616	MSSCS.exe
Token: SeDebugPrivilege	4796	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4616	1544	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	107
PID 1544 wrote to memory of 4616	1544	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	107
PID 4616 wrote to memory of 4796	4616	MSSCS.exe	109
PID 4616 wrote to memory of 4796	4616	MSSCS.exe	109
PID 4616 wrote to memory of 3508	4616	MSSCS.exe	111
PID 4616 wrote to memory of 3508	4616	MSSCS.exe	111
PID 3508 wrote to memory of 4512	3508	vbc.exe	113
PID 3508 wrote to memory of 4512	3508	vbc.exe	113
PID 4616 wrote to memory of 1456	4616	MSSCS.exe	114
PID 4616 wrote to memory of 1456	4616	MSSCS.exe	114
PID 1456 wrote to memory of 2720	1456	vbc.exe	116
PID 1456 wrote to memory of 2720	1456	vbc.exe	116
PID 4616 wrote to memory of 1732	4616	MSSCS.exe	117
PID 4616 wrote to memory of 1732	4616	MSSCS.exe	117
PID 1732 wrote to memory of 4496	1732	vbc.exe	119
PID 1732 wrote to memory of 4496	1732	vbc.exe	119
PID 4616 wrote to memory of 1228	4616	MSSCS.exe	120
PID 4616 wrote to memory of 1228	4616	MSSCS.exe	120
PID 1228 wrote to memory of 2652	1228	vbc.exe	122
PID 1228 wrote to memory of 2652	1228	vbc.exe	122
PID 4616 wrote to memory of 3908	4616	MSSCS.exe	123
PID 4616 wrote to memory of 3908	4616	MSSCS.exe	123
PID 3908 wrote to memory of 2772	3908	vbc.exe	125
PID 3908 wrote to memory of 2772	3908	vbc.exe	125
PID 4616 wrote to memory of 1960	4616	MSSCS.exe	126
PID 4616 wrote to memory of 1960	4616	MSSCS.exe	126
PID 1960 wrote to memory of 2236	1960	vbc.exe	128
PID 1960 wrote to memory of 2236	1960	vbc.exe	128
PID 4616 wrote to memory of 4696	4616	MSSCS.exe	130
PID 4616 wrote to memory of 4696	4616	MSSCS.exe	130
PID 4696 wrote to memory of 4560	4696	vbc.exe	131
PID 4696 wrote to memory of 4560	4696	vbc.exe	131
PID 4616 wrote to memory of 1324	4616	MSSCS.exe	132
PID 4616 wrote to memory of 1324	4616	MSSCS.exe	132
PID 1324 wrote to memory of 1480	1324	vbc.exe	134
PID 1324 wrote to memory of 1480	1324	vbc.exe	134
PID 4616 wrote to memory of 3592	4616	MSSCS.exe	135
PID 4616 wrote to memory of 3592	4616	MSSCS.exe	135
PID 3592 wrote to memory of 3336	3592	vbc.exe	137
PID 3592 wrote to memory of 3336	3592	vbc.exe	137

C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\system32\MSSCS.exe
  "C:\Windows\system32\MSSCS.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v1k0oeay.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7D8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFF08AA3720A942E49F75BB537242913.TMP"
      4⤵
      PID:4512
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1osxeic4.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF8C3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD948183C3B1243148B8E1751DE6B102E.TMP"
      4⤵
      PID:2720
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yps8m1qn.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1C3C6A9F81A24698997C46BA7F8A941D.TMP"
      4⤵
      PID:4496
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jrrovskl.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAC6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF61AF793A6FD4882A24019F42C7E1EA8.TMP"
      4⤵
      PID:2652
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xv_4fui8.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC2E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc68F7C19E3E024EB3AF94EC7B624E448.TMP"
      4⤵
      PID:2772
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pdo0qrue.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDA5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3F5411E768784A4096A7DACB36C72495.TMP"
      4⤵
      PID:2236
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nx1c8pub.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE31.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE7D6D5BABBC4F40BAC72C3EA9DF497.TMP"
      4⤵
      PID:4560
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f1vbuivi.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF2B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2CDD86AC109C4CDEBE1770DC67533158.TMP"
      4⤵
      PID:1480
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ygwb2wnt.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFF6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5E6B7D81B67E4F44864FDE81FE5AEE3E.TMP"
      4⤵
      PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1osxeic4.0.vb

Filesize
263B

MD5
d1110a95f1e40f726584bd99eca52fe7

SHA1
97fac683e1116ab31a9cc9c3dcfd9fe9e53505c3

SHA256
00f373eb310beace70146b6e0fd188aa2f437efb2e5a2714a11d4d58e27d3142

SHA512
f15b5b310ace82a0106b551d71ad3d48e1c75085aa78b8bb3374a2334ceb073bd4d1bf4cd0b4e39034c39f01b6bcd76e8be30198e4872f5641a7d29b255154b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1osxeic4.cmdline

Filesize
163B

MD5
b8becf102fe262eef280be9177e410be

SHA1
cb307df21a421fb2d967b9170999df7a4210028a

SHA256
393bb6df35015c57fc01aaf6273a08ceecb60be189ec5c0a80c671124c40c150

SHA512
31b569765b4b58f6e877ba9baf6cd86e2967bf792ba6ae29bb40c768e209a1dfac8c54266760d40370a8e97da6dc60abc3a3a2e2d78353a971d53282965dad8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF7D8.tmp

Filesize
1KB

MD5
c134a1179d3d1cb200fc32518bf179fd

SHA1
b41737709234eb1cb909a4646087f8109f67a293

SHA256
3530cfe9b61220354d66ea466e3e5a25f2606a050a73abe995caf81d544b496a

SHA512
5f9511b73f3719ff1dc70fb224128f62b5a30e5c9387ec5c4aee54fa1276de261b7c37f67e43cf0a1b84a97002532d0a786023f27da822e813890fd0c6bc0ff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF8C3.tmp

Filesize
1KB

MD5
b8683ce69621fcc4a362b7d04c1396e5

SHA1
08d293bbfc2d8bcf36e5e069b7c9e94b6303573d

SHA256
4d49b66a2d323352346c4f99f2dc58326e17d62d6a1b9c567a82ea800aee5ce8

SHA512
1bc0c5358f676fbb49f4e54382b6004b458d8d99325d20a1809bc70f547010623a99ec77779e3f38ca529b99c8bd7ed3df88d8dbab0fcbe5b0b03af3a185f10a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF9CC.tmp

Filesize
1KB

MD5
11c52fe9f9e72ad582bd0693cf4c3ca9

SHA1
3fa74fded8c2a248f3f6c15b4ed6ad483b9fc76b

SHA256
5cc95311f98471d65b5b243fea783b356dbe8c3028027efecd15ef9fef9f5c9d

SHA512
2fbbb9fc524c21897bf20dccbb6589eff0f887b5f7fd56792e65d873d61a0cdebfe9268f1e2c7e244b8dd4ba40561b44054a09e1de5a2a559b9827f75d3b74c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFAC6.tmp

Filesize
1KB

MD5
070914751baeb900f73b4fb34714a094

SHA1
e88aaaee638e33e5b372041943b6583bf6badb65

SHA256
9643608bed72019d7384fd9463ebd85b50e26bcdd1191a75b63501bdf7b7b88d

SHA512
a20d7f2b0f26ee64bfc68439ae3c3aff8b37e454b49d59912249626e29495839ae1fa932217a1c869e05d4bf80a329a91bbbf4bb80cea60953095181e9668a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFC2E.tmp

Filesize
1KB

MD5
8c90c3df88c4d7154311b659d9dcda57

SHA1
4012284c938b7f61ac5444d0aef3c17c81a6d33d

SHA256
2a09c097b78e90a959d5a37a53ba67445dc985d26e6a9fce1341118adace41a6

SHA512
ff0bf6c517aa8670aa4571f4f324c27427ec718064b167d773fca9901f4bb8a43209157115fc33606db04a86df4012914ef35e75045b4abe9a40ee9bfbe34cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFDA5.tmp

Filesize
1KB

MD5
7323473f7a97618aa59e98a5d8e93bfe

SHA1
b05376a4328f7b221a1fec02a4bab0762a83c847

SHA256
62f24178255e9ee2ea3df1703fedd3e08854bd56eabcbc7d9a4da0701be3f479

SHA512
9d77f2b048135f2e027c8115808383131151b51ceeb8cdea11006c2203fa4122db247c7483b333585903bd6b1376cedb9766c83e22965d9ec95493764987c8c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFE31.tmp

Filesize
1KB

MD5
fe070e2e6a1219a34f232b16669f8ac7

SHA1
ff4e7b0fecee9dc2f33e5856bad225a64e6310e9

SHA256
22f2727c374444406e084b0398d7f30e842df6f08a5debe94c5bb4b63b873082

SHA512
a2eb5f716e5d09e42bdbc57d050c97160a83a4e9c18d318b4243512498b45aa9e5b178ffb5d5feecc16981d7a09a3574b0dfc6767ae6dfdaeee64bf504828e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFF2B.tmp

Filesize
1KB

MD5
a97d0c601fbce3533ffd75ccba5f53ee

SHA1
4d5b03f73a18eddcf3b38eac6325557297196478

SHA256
18bd31c19995fbd679521e9a3f2bfe3cbf65c55772943f28706277e679d74b27

SHA512
ff6148e7db28e78a9cb981b37d8a7bca242ad1a9c3a2e67a4d171142cf9bec77a025bc9b705be041301e877a160ec2b6a99f17c68fe51401a609edfd3db50671

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFFF6.tmp

Filesize
1KB

MD5
83d2da7174f4517589a6ad0dd60573e9

SHA1
da3d191a1b7949874dea08545b0e013ac43fb4a3

SHA256
0b1c977145475cdc6a6101ab0cec70530705a240ab87a7ed908d2fabeb2472dc

SHA512
85f8bc2915dd5c7f0cd95f37edfad15b6cce1764482d68832c90210444ed0f01793fb5a4825894e1e789012d5355c4aa2424430c0021a2c395702cd26ad86d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vgpmv2ks.q1y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1vbuivi.0.vb

Filesize
270B

MD5
658573fde2bebc77c740da7ddaa4634b

SHA1
073da76c50b4033fcfdfb37ba6176afd77b0ea55

SHA256
c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607

SHA512
f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1vbuivi.cmdline

Filesize
170B

MD5
3504bce523cc1e78c0a5cb9181fcbe70

SHA1
a07e510f54b6e4f18eb34bb9fdeaea6323b090c7

SHA256
bc75eca1584cd24b7900c36caeffa0ce04c09b0f5eaa68c01309271ac2bebfb7

SHA512
1a79c722ce7d306e5d1273d4f0ceba32e3d90aedbfff96584d7920e3e226064232f0a6290f6c35d9bdbc13d398c2548c420248913e7f3e87a3d48d7294f469e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\jrrovskl.0.vb

Filesize
272B

MD5
2b3aac520562a93ebef6a5905d4765c9

SHA1
10ab45c5d73934b16fac5e30bf22f17d3e0810c8

SHA256
b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89

SHA512
9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446

Download Submit
C:\Users\Admin\AppData\Local\Temp\jrrovskl.cmdline

Filesize
172B

MD5
93d1136541fac659d9b53c747bb48aaf

SHA1
a1b99cadfe4f364b0e9c01323764e6bdd1b0edb0

SHA256
53f9eafd762fd6bfd6117b1be421ccc1724a682fe1d68786541364ed6e8df19a

SHA512
44db089d69015ce937ca7337dfe592c87372ac37b0ee1a366f7f059a23a6a14ffb3f22ddcb8a1ba8629b1f9a0fd20729f52e726441edbdf1607ba967e2a06c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nx1c8pub.0.vb

Filesize
264B

MD5
5ce3977a153152978fa71f8aa96909e9

SHA1
52af143c553c92afc257f0e0d556908eaa8919cb

SHA256
e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed

SHA512
eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\nx1c8pub.cmdline

Filesize
164B

MD5
aedf1f1fadc17466f2bb5119f550d3e0

SHA1
701c951888f48293015ad61497a192551bb1ab66

SHA256
380f939cf66fd722261abfab0f143c55574d89aa4d5d8851a4a9b32d0be7838b

SHA512
594c89a84180c59bece880f6426523b3f55d2b603d131701e5ae6ead5159ea76a2fb5f0ba5624b9a752b3e788459cbea415e462a50d52a73cb6c4eafe949070a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdo0qrue.0.vb

Filesize
274B

MD5
539683c4ca4ee4dc46b412c5651f20f5

SHA1
564f25837ce382f1534b088cf2ca1b8c4b078aed

SHA256
ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e

SHA512
df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdo0qrue.cmdline

Filesize
174B

MD5
67e71c8731e99a8ea72be16a61365a20

SHA1
18fe1c7c278982d08bcc1631d7cf75c0a022e250

SHA256
6fe8ae8bb5382d85eae3d86c012c672f4d9f49eb8ad21a5fcbf697ffa300c808

SHA512
30a38f34035c80505310827765f424cf944e29c915f980a0c9a6462cae60aa17b6a17ad577434d8ad628bbb0160ec9c45908604adde304f6a2dba38ef70e3410

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1k0oeay.0.vb

Filesize
256B

MD5
076803692ac8c38d8ee02672a9d49778

SHA1
45d2287f33f3358661c3d6a884d2a526fc6a0a46

SHA256
5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3

SHA512
cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1k0oeay.cmdline

Filesize
156B

MD5
72d39d441863f5a8af1dfcc9ae84b304

SHA1
1fa1b843e792e267a3acbcae42889e1fcf132cdf

SHA256
9d2a779229dcf9a1216a26a1b71ad124ae30371733fcd30757b0d800e34e662a

SHA512
feed84c4fbfe5377b744b8a0c73e69f39899f2150241316c748f68031e90e9c264067469503770177ed863fec1c19e024c86794c5a86b530f8c7d57bed90af8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1C3C6A9F81A24698997C46BA7F8A941D.TMP

Filesize
668B

MD5
3906bddee0286f09007add3cffcaa5d5

SHA1
0e7ec4da19db060ab3c90b19070d39699561aae2

SHA256
0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

SHA512
0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc2CDD86AC109C4CDEBE1770DC67533158.TMP

Filesize
668B

MD5
3906bddee0286f09007add3cffcaa5d5

SHA1
0e7ec4da19db060ab3c90b19070d39699561aae2

SHA256
0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

SHA512
0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc2CDD86AC109C4CDEBE1770DC67533158.TMP

Filesize
668B

MD5
3906bddee0286f09007add3cffcaa5d5

SHA1
0e7ec4da19db060ab3c90b19070d39699561aae2

SHA256
0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

SHA512
0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc3F5411E768784A4096A7DACB36C72495.TMP

Filesize
684B

MD5
8135713eeb0cf1521c80ad8f3e7aad22

SHA1
1628969dc6256816b2ab9b1c0163fcff0971c154

SHA256
e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

SHA512
a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc5E6B7D81B67E4F44864FDE81FE5AEE3E.TMP

Filesize
684B

MD5
7a707b422baa7ca0bc8883cbe68961e7

SHA1
addf3158670a318c3e8e6fdd6d560244b9e8860e

SHA256
453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

SHA512
81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc68F7C19E3E024EB3AF94EC7B624E448.TMP

Filesize
676B

MD5
85c61c03055878407f9433e0cc278eb7

SHA1
15a60f1519aefb81cb63c5993400dd7d31b1202f

SHA256
f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

SHA512
7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcD948183C3B1243148B8E1751DE6B102E.TMP

Filesize
676B

MD5
85c61c03055878407f9433e0cc278eb7

SHA1
15a60f1519aefb81cb63c5993400dd7d31b1202f

SHA256
f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

SHA512
7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcE7D6D5BABBC4F40BAC72C3EA9DF497.TMP

Filesize
644B

MD5
dac60af34e6b37e2ce48ac2551aee4e7

SHA1
968c21d77c1f80b3e962d928c35893dbc8f12c09

SHA256
2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

SHA512
1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcE7D6D5BABBC4F40BAC72C3EA9DF497.TMP

Filesize
644B

MD5
dac60af34e6b37e2ce48ac2551aee4e7

SHA1
968c21d77c1f80b3e962d928c35893dbc8f12c09

SHA256
2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

SHA512
1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcF61AF793A6FD4882A24019F42C7E1EA8.TMP

Filesize
676B

MD5
85c61c03055878407f9433e0cc278eb7

SHA1
15a60f1519aefb81cb63c5993400dd7d31b1202f

SHA256
f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

SHA512
7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcF61AF793A6FD4882A24019F42C7E1EA8.TMP

Filesize
676B

MD5
85c61c03055878407f9433e0cc278eb7

SHA1
15a60f1519aefb81cb63c5993400dd7d31b1202f

SHA256
f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

SHA512
7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcFF08AA3720A942E49F75BB537242913.TMP

Filesize
644B

MD5
dac60af34e6b37e2ce48ac2551aee4e7

SHA1
968c21d77c1f80b3e962d928c35893dbc8f12c09

SHA256
2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

SHA512
1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

Download Submit
C:\Users\Admin\AppData\Local\Temp\xv_4fui8.0.vb

Filesize
271B

MD5
325f27ef75bebe8b3f80680add1943d3

SHA1
1c48e211258f8887946afb063e9315b7609b4ee3

SHA256
034c75813491d628a1a740b45888fc0c301b915456aaa7ba6433b4f1368cda35

SHA512
e2165b425558872897990953c26e48776f45751a53da035f1ad86ac062ec23a2923b984d84f992de5c0170f6e192feb155ffff25f51bc76ab273b996daacb804

Download Submit
C:\Users\Admin\AppData\Local\Temp\xv_4fui8.cmdline

Filesize
171B

MD5
4372d6f471fb60ff0c285d314a9e642d

SHA1
691bab1dd73db1de0f043e7866b90c3831d08daa

SHA256
3a194b6866559f66dc619ffcd374d144f7b26588b4607efde6cce43bfe2db441

SHA512
d3081eff460bece6254b65309ef141c538eb34e6899c7f4a2c2bc8b1981d5784f4838af3f981511c1925f100e4d9a4f1978d7cddfa35dfbf473ed6cf5549d6c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ygwb2wnt.0.vb

Filesize
273B

MD5
3c3d3136aa9f1b87290839a1d26ad07a

SHA1
005a23a138be5d7a98bdd4a6cc7fab8bdca962f4

SHA256
5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd

SHA512
fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\ygwb2wnt.cmdline

Filesize
173B

MD5
eaf6356afdcab012cf924add702d8a5d

SHA1
5c52f1b2314c746643badf0d3f9d3e5c9401a7f6

SHA256
8c091bb5eda3dfd3c4340c13be8193c626682e94fe99bad471d09f2f662abb00

SHA512
60c719f66afb7451379a888a503d79994afdedd06d136d20aa986ccdd6ae337a301124863872062aedaf6ea76a0ee6908de3e6e9f4419fc56d8a3b8cbc829f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\yps8m1qn.0.vb

Filesize
271B

MD5
ac972015bef75b540eb33503d6e28cc2

SHA1
5c1d09fcf4c719711532dcfd0544dfc6f2b90260

SHA256
fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7

SHA512
36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83

Download Submit
C:\Users\Admin\AppData\Local\Temp\yps8m1qn.cmdline

Filesize
171B

MD5
82d32b02cc844e9fff847a2763e2fddf

SHA1
f33045144ed99e42b930d2f77c6b23dcd13552f1

SHA256
48f1f2a3e6635b8d18f3d9af95c5c2878b7d38e1841eeb0996160f59aa342a30

SHA512
6cf7e74d8e16fc17b822165d43f1f481d2ad5df6e6a231b6584ff69f972f9a4dcacaad3c776ec7cf8a7ef1435569d3ba6bdef2f9967fdecb3393919b84ad9da6

Download Submit
C:\Windows\System32\MSSCS.exe

Filesize
21KB

MD5
6fe3fb85216045fdf8186429c27458a7

SHA1
ef2c68d0b3edf3def5d90f1525fe87c2142e5710

SHA256
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

SHA512
d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

Download Submit
C:\Windows\System32\MSSCS.exe

Filesize
21KB

MD5
6fe3fb85216045fdf8186429c27458a7

SHA1
ef2c68d0b3edf3def5d90f1525fe87c2142e5710

SHA256
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

SHA512
d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

Download Submit
C:\Windows\system32\MSSCS.exe

Filesize
21KB

MD5
6fe3fb85216045fdf8186429c27458a7

SHA1
ef2c68d0b3edf3def5d90f1525fe87c2142e5710

SHA256
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

SHA512
d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

Download Submit
memory/1228-92-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/1324-154-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/1456-62-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/1544-4-0x00007FFCE2D00000-0x00007FFCE36A1000-memory.dmp

Filesize
9.6MB

Download
memory/1544-21-0x00007FFCE2D00000-0x00007FFCE36A1000-memory.dmp

Filesize
9.6MB

Download
memory/1544-9-0x00007FFCE2D00000-0x00007FFCE36A1000-memory.dmp

Filesize
9.6MB

Download
memory/1544-8-0x00000000012A0000-0x00000000012B0000-memory.dmp

Filesize
64KB

Download
memory/1544-5-0x000000001C7C0000-0x000000001C822000-memory.dmp

Filesize
392KB

Download
memory/1544-6-0x000000001D080000-0x000000001D11C000-memory.dmp

Filesize
624KB

Download
memory/1544-7-0x00007FFCE2D00000-0x00007FFCE36A1000-memory.dmp

Filesize
9.6MB

Download
memory/1544-3-0x000000001BC30000-0x000000001BCD6000-memory.dmp

Filesize
664KB

Download
memory/1544-1-0x00000000012A0000-0x00000000012B0000-memory.dmp

Filesize
64KB

Download
memory/1544-0-0x00007FFCE2D00000-0x00007FFCE36A1000-memory.dmp

Filesize
9.6MB

Download
memory/1544-2-0x000000001C200000-0x000000001C6CE000-memory.dmp

Filesize
4.8MB

Download
memory/1960-128-0x0000000002240000-0x0000000002250000-memory.dmp

Filesize
64KB

Download
memory/3508-47-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/3592-169-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/3908-114-0x0000000002160000-0x0000000002170000-memory.dmp

Filesize
64KB

Download
memory/4616-20-0x00000000012A0000-0x00000000012B0000-memory.dmp

Filesize
64KB

Download
memory/4616-19-0x00007FFCE2D00000-0x00007FFCE36A1000-memory.dmp

Filesize
9.6MB

Download
memory/4616-22-0x00007FFCE2D00000-0x00007FFCE36A1000-memory.dmp

Filesize
9.6MB

Download
memory/4616-23-0x00000000012A0000-0x00000000012B0000-memory.dmp

Filesize
64KB

Download
memory/4796-38-0x00000159AEA50000-0x00000159AEA72000-memory.dmp

Filesize
136KB

Download
memory/4796-39-0x00007FFCDE8B0000-0x00007FFCDF371000-memory.dmp

Filesize
10.8MB

Download
memory/4796-40-0x00000159AEB00000-0x00000159AEB10000-memory.dmp

Filesize
64KB

Download
memory/4796-43-0x00000159AEB00000-0x00000159AEB10000-memory.dmp

Filesize
64KB

Download
memory/4796-44-0x00000159AEB00000-0x00000159AEB10000-memory.dmp

Filesize
64KB

Download
memory/4796-107-0x00007FFCDE8B0000-0x00007FFCDF371000-memory.dmp

Filesize
10.8MB

Download