64c665b2dbdaca4a20aaef96d625091757008c88b49d71070e4eefcd45d986d8

Resubmissions

10-05-2024 17:13

240510-vrrk4sgd7t 10

10-05-2024 17:09

240510-vphv7abd29 10

Analysis

max time kernel
119s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

High Priority/file.exe
Size

101KB
MD5

88dbffbc0062b913cbddfde8249ef2f3
SHA1

e2534efda3080e7e5f3419c24ea663fe9d35b4cc
SHA256

275e4633982c0b779c6dcc0a3dab4b2742ec05bc1a3364c64745cbfe74302c06
SHA512

036f9f54b443b22dbbcb2ea92e466847ce513eac8b5c07bc8f993933468cc06a5ea220cc79bc089ce5bd997f80de6dd4c10d2615d815f8263e9c0b5a4480ccb4
SSDEEP

1536:fkSJkZlpqwZoMoG5XoZnOZBX7D/3BINVRX3FjBqa8D3tSYS9h:MXlpqwZoMz5XoZncB/3BINZjy9SYS

Score

7^/10

persistence

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\High Priority\\file.exe"	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3984	1128	file.exe	94
PID 1128 wrote to memory of 3984	1128	file.exe	94
PID 3984 wrote to memory of 3496	3984	vbc.exe	96
PID 3984 wrote to memory of 3496	3984	vbc.exe	96
PID 1128 wrote to memory of 4080	1128	file.exe	97
PID 1128 wrote to memory of 4080	1128	file.exe	97
PID 4080 wrote to memory of 1548	4080	vbc.exe	157
PID 4080 wrote to memory of 1548	4080	vbc.exe	157
PID 1128 wrote to memory of 3008	1128	file.exe	100
PID 1128 wrote to memory of 3008	1128	file.exe	100
PID 3008 wrote to memory of 5080	3008	vbc.exe	102
PID 3008 wrote to memory of 5080	3008	vbc.exe	102
PID 1128 wrote to memory of 3920	1128	file.exe	134
PID 1128 wrote to memory of 3920	1128	file.exe	134
PID 3920 wrote to memory of 2144	3920	vbc.exe	105
PID 3920 wrote to memory of 2144	3920	vbc.exe	105
PID 1128 wrote to memory of 3756	1128	file.exe	106
PID 1128 wrote to memory of 3756	1128	file.exe	106
PID 3756 wrote to memory of 4840	3756	vbc.exe	108
PID 3756 wrote to memory of 4840	3756	vbc.exe	108
PID 1128 wrote to memory of 3140	1128	file.exe	109
PID 1128 wrote to memory of 3140	1128	file.exe	109
PID 3140 wrote to memory of 3804	3140	vbc.exe	111
PID 3140 wrote to memory of 3804	3140	vbc.exe	111
PID 1128 wrote to memory of 2116	1128	file.exe	112
PID 1128 wrote to memory of 2116	1128	file.exe	112
PID 2116 wrote to memory of 3120	2116	vbc.exe	114
PID 2116 wrote to memory of 3120	2116	vbc.exe	114
PID 1128 wrote to memory of 700	1128	file.exe	115
PID 1128 wrote to memory of 700	1128	file.exe	115
PID 700 wrote to memory of 2680	700	vbc.exe	117
PID 700 wrote to memory of 2680	700	vbc.exe	117
PID 1128 wrote to memory of 1672	1128	file.exe	118
PID 1128 wrote to memory of 1672	1128	file.exe	118
PID 1672 wrote to memory of 1440	1672	vbc.exe	120
PID 1672 wrote to memory of 1440	1672	vbc.exe	120
PID 1128 wrote to memory of 768	1128	file.exe	121
PID 1128 wrote to memory of 768	1128	file.exe	121
PID 768 wrote to memory of 4208	768	vbc.exe	154
PID 768 wrote to memory of 4208	768	vbc.exe	154
PID 1128 wrote to memory of 4572	1128	file.exe	124
PID 1128 wrote to memory of 4572	1128	file.exe	124
PID 4572 wrote to memory of 2384	4572	vbc.exe	126
PID 4572 wrote to memory of 2384	4572	vbc.exe	126
PID 1128 wrote to memory of 4052	1128	file.exe	127
PID 1128 wrote to memory of 4052	1128	file.exe	127
PID 4052 wrote to memory of 4332	4052	vbc.exe	129
PID 4052 wrote to memory of 4332	4052	vbc.exe	129
PID 1128 wrote to memory of 3456	1128	file.exe	130
PID 1128 wrote to memory of 3456	1128	file.exe	130
PID 3456 wrote to memory of 4584	3456	vbc.exe	132
PID 3456 wrote to memory of 4584	3456	vbc.exe	132
PID 1128 wrote to memory of 1916	1128	file.exe	133
PID 1128 wrote to memory of 1916	1128	file.exe	133
PID 1916 wrote to memory of 812	1916	vbc.exe	135
PID 1916 wrote to memory of 812	1916	vbc.exe	135
PID 1128 wrote to memory of 456	1128	file.exe	136
PID 1128 wrote to memory of 456	1128	file.exe	136
PID 456 wrote to memory of 5032	456	vbc.exe	138
PID 456 wrote to memory of 5032	456	vbc.exe	138
PID 1128 wrote to memory of 5084	1128	file.exe	139
PID 1128 wrote to memory of 5084	1128	file.exe	139
PID 5084 wrote to memory of 3768	5084	vbc.exe	141
PID 5084 wrote to memory of 3768	5084	vbc.exe	141

C:\Users\Admin\AppData\Local\Temp\High Priority\file.exe
"C:\Users\Admin\AppData\Local\Temp\High Priority\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\559rvlkt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F0F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9107F299C36544C9801DED44CEB47CE1.TMP"
    3⤵
    PID:3496
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\da7uxkde.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FDA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc19CF6473981047E78F1F4BC82C67B3.TMP"
    3⤵
    PID:1548
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ntfjjwsc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA066.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc46397071D67C4369A1C5874D17E99C.TMP"
    3⤵
    PID:5080
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fc8jqdlr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0C4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc42E75454F2D84171A31DE1682058438D.TMP"
    3⤵
    PID:2144
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rvlrlf0z.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA122.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB085C8A612C4197A6561A70CC88A066.TMP"
    3⤵
    PID:4840
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vjsr3h5x.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA170.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1A73622B9CBB460D957EB9C41F507975.TMP"
    3⤵
    PID:3804
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eeisnucq.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc788418E8675C4E8D90BED05C4266031.TMP"
    3⤵
    PID:3120
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\azrwmuzm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA20C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD7AB94BFB9414CAE8CDD18E68971E83.TMP"
    3⤵
    PID:2680
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qichg5d9.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA25A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc301FFE6B87D24D968B53E2CDE93ADC8.TMP"
    3⤵
    PID:1440
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pe_g6ltr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2B8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD032B70210024BECB01C9B6A56DB9F5.TMP"
    3⤵
    PID:4208
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uofzyeao.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA306.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc63D45552C1E348629E2CA8FF572F567.TMP"
    3⤵
    PID:2384
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gfuwx5je.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA364.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD8F811C942334E6EB5FF56A0FF2C99D.TMP"
    3⤵
    PID:4332
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fyxyu2n-.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA3C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1CA8F50F58E43768DD1018E29FDBCA.TMP"
    3⤵
    PID:4584
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ikcoh2pe.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3920
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA41F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1E50761878C248229015E9EF2723B50.TMP"
    3⤵
    PID:812
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5pubv39t.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA48D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1DE9CAF1B17844E88E28FD1DBB82DB4.TMP"
    3⤵
    PID:5032
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fbm67vtg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4DB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7541B9147AA44E39A9556D82CA6A406A.TMP"
    3⤵
    PID:3768
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5nbghnjy.cmdline"
  2⤵
  PID:3296
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA568.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFAD4F76090104262B82ED13BD314FFA.TMP"
    3⤵
    PID:3036
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wr9-nebp.cmdline"
  2⤵
  PID:4900
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5B6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7D56C60731FD4A9B927EC25DBAB5E284.TMP"
    3⤵
    PID:5060
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v0sjfm1e.cmdline"
  2⤵
  PID:1612
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA613.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCA9825B8BB584B3884DC8C163EE7C19.TMP"
    3⤵
    PID:4704
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1aehcaxw.cmdline"
  2⤵
  PID:440
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA671.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc52EF49F074B54B45A280CC75425482B.TMP"
    3⤵
    PID:5028
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8zqhmm7_.cmdline"
  2⤵
  PID:4208
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6CF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc166BB6C29D9C46BFB2261A80FF92B82C.TMP"
    3⤵
    PID:1236
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xxsbvfal.cmdline"
  2⤵
  PID:1548
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA71D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7D340635A35B43D580691CA596ED13.TMP"
    3⤵
    PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\RevengeRAT\vcredist2010_x64.log-MSI_vc_red.msi.ico

Filesize
4KB

MD5
c350868e60d3f85eb01b228b7e380daa

SHA1
6c9f847060e82fe45c04f8d3dab2d5a1c2f0603e

SHA256
88c55cc5489fc8d8a0c0ace6bfb397eace09fba9d96c177ef8954b3116addab7

SHA512
47555d22608e1b63fbf1aacee130d7fc26be6befaa9d1257efb7ad336373e96878da47c1e1e26902f5746165fc7020c6929a8a0b54d5ad1de54d99514cc89d85

Download Submit
C:\ProgramData\RevengeRAT\vcredist2010_x64.log.ico

Filesize
4KB

MD5
64f9afd2e2b7c29a2ad40db97db28c77

SHA1
d77fa89a43487273bed14ee808f66acca43ab637

SHA256
9b20a3f11914f88b94dfaa6f846a20629d560dd71a5142585a676c2ef72dc292

SHA512
7dd80a4ed4330fe77057943993a610fbd2b2aa9262f811d51f977df7fbcc07263d95c53e2fb16f2451bd77a45a1569727fbf19aeded6248d57c10f48c84cb4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\559rvlkt.0.vb

Filesize
376B

MD5
52ddcb917d664444593bbd22fc95a236

SHA1
f87a306dffbfe5520ed98f09b7edc6085ff15338

SHA256
5c55dcac794ff730b00e24d75c2f40430d90b72c9693dd42c94941753a3d657d

SHA512
60dafb21f44cbf400e6f8bc5791df9a8d497da6837fb1a453fda81b324ac6f70fb9ec0efb1e7649b9bed0dfe979016360f3bcfef543d7e9432a97b96c8b9fd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\559rvlkt.cmdline

Filesize
256B

MD5
196be558c9c23625610f0d407f10ac14

SHA1
ec56d8a27917d77f186f7481b19c1d33637ef137

SHA256
5e78f28ce5cd9c923f291d032ed545a948bf40a84c43d5be491faa7c9082d135

SHA512
bc89e118eff75fe85d203e40c5e67797b10ab535454cded8c53c904cc18cc97d7ec068ade600f9c302b437fd5fd0b5fb29fd7ace7ab6c987c479095d1473026d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9F0F.tmp

Filesize
5KB

MD5
7273fbffe24eb9ea5b0ad9b75d24198d

SHA1
fac29a96b85589fcbf69b0ff5721369193c3ed5e

SHA256
33b60b3f12e9b55b796988a9d2dbfd5441e3b43a882c33202273411982e95ec4

SHA512
ad50175325b6acd29b9b7aafc1a258e93261e47920c52f736c137abf5b1492512e6d8c378a1be0d784001034d185a82aa0afbbb5ef8dabebf6b9adb55d9d1e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9FDA.tmp

Filesize
5KB

MD5
53db422aa354bc1648e9ea7c56d8ce6a

SHA1
e4eda0d05889d2b65642c3ffc2c02b4b7502578d

SHA256
ea8e0d33e731bcb095b2f051111d82c0e2ef7bb9744d405ae68f7a856ed23fba

SHA512
e3cdc68faac48759088c48e871d964cd684546bbb7ad5f7fc3ea0889ba9e295b10bef42695d3344715f2f6606c86717dc72729a2958829547ff4ec3b2e3cb703

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA066.tmp

Filesize
5KB

MD5
65f004e931f451b227cc2e0a52ad416e

SHA1
5273562e785e44ac8aa762e807dc2a0937861092

SHA256
1162f851c64b3610062b9f64ef24c0b475bb008810f513266c4fccfac1eca84b

SHA512
411b77b701040b4509f1387332073d50e0c40d0121a773ac06788cac80f3527c5687f91bd244308f7d6d9ca92e5880c1a1ed32763e4f4af3a0223cde1c631da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA0C4.tmp

Filesize
5KB

MD5
8678a26c5ec90eb41b4b09fb0729ab3c

SHA1
ed715b61a6b6190fb33ece5cc23356af8ecca59c

SHA256
447c7d1d038430c5f1d0d70b500603ff5201f84028b98f72e3b3c36bff49748e

SHA512
84c7f57f921970af5f53c424eaf585b221f49694b88278806183de7fcfc24dba72d8bfb269ba7eb1d1280ae248126a75fc2d62d46ab2c225fde1560d0d1724f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA122.tmp

Filesize
5KB

MD5
da6b566cf4addf45adc46400a6efb512

SHA1
60dd11a4687115b0a7b7bbdec6e8d2f9ee481a19

SHA256
7b76d4dfa3d194d09c3c3c12e36503da2c261c685b8a79562346153c5fe6f2fe

SHA512
47793169f9278d48d04b6f94f9e36ce92d501a39bebfbae81469cbfe246f520bbe2f68a22e1451864d3afa7bc31cceae4158ec95e0ab0ae723e101df6b5ce7f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA170.tmp

Filesize
5KB

MD5
a3ed95ac946fd2ede9b42b79e0936a9a

SHA1
72d228566f9db2962f53c7ecbaf154d5065f30e7

SHA256
1472c2a2f20f9a96f077fc4b65a6fd78486399fa3afa5f6b58d6401adae00200

SHA512
dc581f7e27a82e2ba00785247983c3f801d6fe2a1454b79d8620fcb44096e90671b05b46211ba8528a063dbdc22fa502cbf9f30eb03e6deb6700b89fbe4d84ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA1BE.tmp

Filesize
5KB

MD5
479d95d6f06d02993da83fe8b4ace888

SHA1
c47ce19bc77e9862fab91e2edbf4c38eabd22d42

SHA256
e9ce880d5810e3cf18467d3b1ca3cb45159070f4fee027cfe85dff6ec1af216a

SHA512
93c5fad619076655facb8b46e7c80f781a609be858778b76e48d06d19d9e5a0c8274a202699cdedaaa715ded380a05bc616b6960541ba3717de64b06514aa8b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA20C.tmp

Filesize
5KB

MD5
43ccb6d4478b0f3c7c51d22049d4a77f

SHA1
3dd8c221f349cc87fdf13e59d7c9d1d9a71c2a52

SHA256
7544f71d208327d3d637a836f364e71e78bbe7df9c7c7fe71cedd8709ac52d89

SHA512
f5417a1c9f73fcd396e40cf0823576e3ae3a9de0e4165296b2c343ff6861e5e6c8024c9b05a0726094eea8619a7b555030047591e2336e4dd59d44dc80be4413

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA25A.tmp

Filesize
5KB

MD5
b83c6edc244026577b241f6c2e6ace89

SHA1
e702ba3ce99995fc7e8c793e8b641157f6ce31ec

SHA256
ad0db7f2af95b6c2beea95c9b6b9d88afb8943e878ca7769461254efca46a6fa

SHA512
e4831c2e77a0f7e025ff3fdba88afef3775d8575cd6f357584f26c205377f44483256b082374088dc65bc8e1627ddff6a4456325b86671479d510a25faabff72

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA2B8.tmp

Filesize
5KB

MD5
d28dead6a640f7c2838c740a493cfbbf

SHA1
8aa6e2085035330e36b465d2936a0463b02a35bb

SHA256
40dc1c3e97bb80c522ec888e29961b4048510ecd14849924a844b6d4ba6ee514

SHA512
4c5690befce2e304e50ca6ba1351a14eb595e5766834f64a3ff4a4e63b56a2038caec12808b915e9e17eeccd7480e1f83b6f55b3ce8a4c751bad168fc47e4f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA306.tmp

Filesize
5KB

MD5
b0c91f33c7144b49d6458f810e780b87

SHA1
29d80cec0e07fc1332b04d87c254c5876fc48dfe

SHA256
624e57ce24c0580270000f5745a568587468f503ccb47260dfd88cfd04be333d

SHA512
34e34951ec29d3890c3e4c25ac9cc0e204102f15cfd1ed09e514bfa34132bbd58c6fe2830e4d9b6901607dd2feb607584f06ccd464be857a15c88949543b2e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA364.tmp

Filesize
5KB

MD5
b77842939bd979ec46fec879855f4d81

SHA1
1f16f252fa74b724c4660db3272d84a09dd69c71

SHA256
41fb66e85f383ac948ee0f70b96dc112d2ec9c9e168e37797ae4287087e11c5b

SHA512
0ed5bfeeb0de3b44667b7f292f237cab25ab957f7bf5bf334b1e898ecb8848c5674216cd63a2dfaf7caefd98ef30b6dc5fd17bc48b74119b620086e7212328a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\azrwmuzm.0.vb

Filesize
383B

MD5
a236870b20cbf63813177287a9b83de3

SHA1
195823bd449af0ae5ac1ebaa527311e1e7735dd3

SHA256
27f6638f5f3e351d07f141cabf9eb115e87950a78afafa6dc02528113ad69403

SHA512
29bec69c79a5458dcd4609c40370389f8ec8cc8059dd26caeaf8f05847382b713a5b801339298ff832305dd174a037bfdb26d7417b1b1a913eacf616cd86f690

Download Submit
C:\Users\Admin\AppData\Local\Temp\azrwmuzm.cmdline

Filesize
270B

MD5
cd85ff4769c3618855a8889cc6cf3454

SHA1
dfa02cf2e38f66349416c8e3121f59145ae7ca76

SHA256
19f5e1d76cc116cca33c49bcdedb37810bb8761cfbd047c728b0d5584d2d5409

SHA512
5780a74e0bde7ecbe685c7f0d7faf08f2b5a2c99d91cbb25a4927b0df8f91c133b8fc18ed4a632ac508c77bd694621580439796e415305be85527154d01cf9fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\da7uxkde.0.vb

Filesize
362B

MD5
31e957b66c3bd99680f428f0f581e1a2

SHA1
010caae837ec64d2070e5119daef8be20c6c2eae

SHA256
3e32c4b27f7a5840edc2f39d3fc74c2863aa2dfd9a409f1f772b8f427091a751

SHA512
6e61d77c85c1bf3fd0c99630156e0390f9a477b4df0e46218054eae65bee7766443905f48e3f3c7dec72b3fb773f758cf175df54f1ed61ac266469579f3997af

Download Submit
C:\Users\Admin\AppData\Local\Temp\da7uxkde.cmdline

Filesize
227B

MD5
6604ecd02d9668169d6f0b47f99f91a5

SHA1
bcbc978250cf3a738314af2fcb7e391d213da42c

SHA256
df723e78b048ce079abeed795a2bc8daa15eed54b6758e3b1fa623be9486e1a3

SHA512
af303ce6e2791bd017976b469354a2a8b20a7ac016a9ef35dd9b01dc149ea4d87166d255a2093795998a112c38f6873f70245b7a9ae3983d9f17cbb228b7aa30

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeisnucq.0.vb

Filesize
380B

MD5
6a3d4925113004788d2fd45bff4f9175

SHA1
79f42506da35cee06d4bd9b6e481a382ae7436a1

SHA256
21be523eca2621b9e216b058052970dc749312d2c26836639d8e8faff94c76bb

SHA512
2cfdecfa0604ad7fd54f68bf55e7c52701c7b196de51412e172526affffd6e6c4bc443b6df0fb21d2c777c809aa4e3809bd2b5b385e0d033604b6b653a0f416d

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeisnucq.cmdline

Filesize
264B

MD5
29493838daee99aba8a589a2310c8c18

SHA1
9093ab4c3d5f773f5dabf931ad29539cb0ed97ea

SHA256
b470b84b01c8de3c466e4349cc887ca3959e3f1cc7b1703b81d5845d2673a195

SHA512
34cfa117619b8e4d14e08bd04e2516297d119d76992f7f8261077ad79bf94833ef2740acb5d107852a643f579b6f02ae32b71e3000d12f0171a1671a5facacb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fc8jqdlr.0.vb

Filesize
362B

MD5
3b4aed436aadbadd0ac808af4b434d27

SHA1
f8711cd0521a42ac4e7cb5fc36c5966ff28417b6

SHA256
ee55ee594a9bb7acee0dfaa9aaa31ebc044e3090b5a68baef63ddd2f6493d3a6

SHA512
6ca8a69f31876db620e8818d896257d3683dcf859841afa3ba7b83ae57ce67c47b98b4e44c449b02eb789b683b840e769857b10cf16a5a5882683e96f65ab5ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\fc8jqdlr.cmdline

Filesize
227B

MD5
c0f07695ae8ca933cdec205bbd38643a

SHA1
f118860d6b0b5e6099239a275adf9d810054f465

SHA256
e59961b0ed0cc6a8c56e450e069ed61fb3ea05c82ad08c91caef579a3fbff320

SHA512
17df8ea2186bde9a9f8f4c879f765f27d10f67c90e2436e74c17c357c0e3d782728a2b13d2a4b7abf34991b72153047d1d33584e8d4d3731043c1747040e8aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\fyxyu2n-.0.vb

Filesize
382B

MD5
37c6619df6617336270b98ec25069884

SHA1
e293a1b29fd443fde5f2004ab02ca90803d16987

SHA256
69b5796e1bb726b97133d3b97ebb3e6baac43c0474b29245a6b249a1b119cd33

SHA512
c19774fc2260f9b78e3b7ee68f249ce766dcdc5f8c5bc6cfc90f00aa63ce7b4d8c9b5c6f86146aa85e15fd0c5be7535cc22e0a9949ef68fbd5aca0436c3bd689

Download Submit
C:\Users\Admin\AppData\Local\Temp\fyxyu2n-.cmdline

Filesize
268B

MD5
2b2a34f5d2c20f640878713c39386cac

SHA1
4c782269be3b4598d9f4692473da0e9ff5bf0881

SHA256
a696543622f9b8dbaa31623b1612f8c74e199643881819f5c65733a3640daba3

SHA512
9e5b4385c4bec4a299e5bafdbb912ee85c9e5a0256decdce990c441fafc8131d4c8c0ce3c58e8c3b8bd9784df77e34dea82ca6137cacf2f8c83606e027581a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\gfuwx5je.0.vb

Filesize
385B

MD5
40650ce23f89e4cd8462efe73fa023ce

SHA1
8709317f898d137650ecb816743e3445aa392f75

SHA256
ae23b3ffff9fb03b649f412247c342e9cd970e371b0d5dea6be75a26617a5afb

SHA512
b6ec7998e2a9703e2badcb41e60128f340c1c4ffcb9aa2c6532b3dc18024abdec1f739148f45d66417df84f3beed1a15ddbf9f33da073018ab902531ccbde850

Download Submit
C:\Users\Admin\AppData\Local\Temp\gfuwx5je.cmdline

Filesize
274B

MD5
b89befc3974923ac2435b6134a3dbd07

SHA1
0f1232d8226291c0006a0a73a6cfedf6c6748199

SHA256
55bd2d0fdc7f404717c8b0c08703eef9ea42a5a209fd917a586ad0b7fedc824e

SHA512
9cd504092c985ccec6fd5586d9309b22d672b6720474ec8fa7efc26028c7c0852dce40a75ffcddbec8517494028165b41f63079c6f84311aca1b6f50059d40cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntfjjwsc.0.vb

Filesize
376B

MD5
0c699ac85a419d8ae23d9ae776c6212e

SHA1
e69bf74518004a688c55ef42a89c880ede98ea64

SHA256
a109cb0ae544700270ad4cb1e3e45f7f876b9cfac5f2216875c65235502982fe

SHA512
674e3f3c24e513d1bb7618b58871d47233af0a450f1068762e875277bbddf6c4f78245988c96e907dbbf3aafb5ff59e457528b3efa8e0a844f86a17a26d4f3d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntfjjwsc.cmdline

Filesize
256B

MD5
b6724ac2709586596c57d7f912dec71c

SHA1
2f6fe80c16eb241c7516051dd61636403755f3ee

SHA256
5c9b9f93739f6b7dc0a42de90154b98f5c7906dac6b1a90d9d719d4b0883ec80

SHA512
ce74949e643e70a5ef95e95a23d4990ba2e6b553285c17edad184d03cbc989b7e997c55810016ae5b42861e66ba01ca888ff005d4cc7c9a4b8c6235f7565b11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pe_g6ltr.0.vb

Filesize
385B

MD5
0ad1ae93e60bb1a7df1e5c1fe48bd5b2

SHA1
6c4f8f99dfd5a981b569ce2ddff73584ece51c75

SHA256
ea68ce9d33bd19a757922ba4540978debcba46f1133fbc461331629e666d6397

SHA512
a137a8f18a2b2ff9c31556044dd7c41fb589a6a52b15e4dc6cbb3ba47ab4a06d8b9ad54fb498100dab33f8a217848d31f14daca736045afb4f76ffb650b17f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\pe_g6ltr.cmdline

Filesize
274B

MD5
bcf29589595ad1ce834812b599f2efcb

SHA1
eef58f7eaa282f4059e3d73ac494c4a68b5b006c

SHA256
5b45232b1fa2140953cc7692fe4c35979bb5d66dd7919c7b04b71ad9c6650b6f

SHA512
b78adddff08d36aee5cdb4091d457e19e4a4136d1691ed6961d43c6889ad981bc1250339008cb0e7d2496c4385106417eb2725ad3c47b44c588360ca88148305

Download Submit
C:\Users\Admin\AppData\Local\Temp\qichg5d9.0.vb

Filesize
382B

MD5
44ab29af608b0ff944d3615ac3cf257b

SHA1
36df3c727e6f7afbf7ce3358b6feec5b463e7b76

SHA256
03cbb9f94c757143d7b02ce13e026a6e30c484fbadfb4cd646d9a27fd4d1e76d

SHA512
6eefa62e767b4374fa52fd8a3fb682a4e78442fe785bfe9b8900770dbf4c3089c8e5f7d419ec8accba037bf9524ee143d8681b0fae7e470b0239531377572315

Download Submit
C:\Users\Admin\AppData\Local\Temp\qichg5d9.cmdline

Filesize
268B

MD5
254e86fb52c0e2c27e54cecaa627cc1e

SHA1
d6017a7d2b3fb24146a0465d80fe66881c338ad9

SHA256
d9c4da57afdbebd903d547fcca2cb369a4cd8893f8c221643ed46b32961cccd4

SHA512
e3d6b667d896de4c6091438b66470e9379452542a6242506f333d2abc9d22f186343963cded9c27b9412b90a956a99466fe8b3123307cbf510ef079bf6183281

Download Submit
C:\Users\Admin\AppData\Local\Temp\rvlrlf0z.0.vb

Filesize
380B

MD5
3cbba9c5abe772cf8535ee04b9432558

SHA1
3e0ddd09ad27ee73f0dfca3950e04056fdf35f60

SHA256
946d0a95bf70b08e5b5f0005ff0b9ad4efe3b27737936f4503c1a68a12b5dc36

SHA512
c3c07c93011dc1f62de940bc134eb095fa579d6310bd114b74dd0ae86c98a9b3dd03b9d2af2e12b9f81f6b04dc4d6474bd421bce2109c2001521c0b32ae68609

Download Submit
C:\Users\Admin\AppData\Local\Temp\rvlrlf0z.cmdline

Filesize
264B

MD5
865c0255d024559bb8323c8f874091b3

SHA1
61a789ad43bc8a3465de724b8d028ef264c4ce7a

SHA256
11cc25857578fb456516579921cc55b54a9bf54c9c712f368d947a0b24831da1

SHA512
0ac5189511ffb25a9e15c0880753f39896b1f91f8a83d3bc441650613a3f0358e855b1c1dbfa98faecf669e0e3eef4d7b108a3775a7c36dd416fc238773aafb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\uofzyeao.0.vb

Filesize
382B

MD5
7d4fad6697777f5a8450a12c8d7aa51f

SHA1
879db5558fb1a6fac80a5f7c5c97d5d293a8df5c

SHA256
741018cae167c9f6c1206e75ddf3d758543f9a16bec5d56a07fab9eb5439e3f6

SHA512
6a31b4eab1829db245773e18e97f9a9956224174e28218476e45e8907bf8b4341ed732a0153a320cb956f2eca4e014c1ef6b0c6f627cf97a79b7a81f8e1fe144

Download Submit
C:\Users\Admin\AppData\Local\Temp\uofzyeao.cmdline

Filesize
268B

MD5
c207debd8ad04c1f8aa8d2bcaeaebcb6

SHA1
2ecef96589ed62600bd8182b4f6fadbdd36dd33b

SHA256
679d5ade4ed756b76949230b8f3a903da70396b8a964140be36b358e400d2170

SHA512
48adf80bdfc1e0ece704be2d48bd32f8fe3730d278f9fbf2d158f691127252dad74f2228a6c6d624e981a95cac529581dd17905327f3214857628343a8dca566

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc19CF6473981047E78F1F4BC82C67B3.TMP

Filesize
5KB

MD5
0fe8a8eff02f77e315885b53503483a8

SHA1
953a58a0ff6736967270494a986aca7b5c490824

SHA256
2d2c202dfa06961e1fad395fe08f9caa4b1004f71a0c37457581fa095229afba

SHA512
e0fbfcb9a2db833bea58e5ed923f93689ee598c76f27fb57e19d9a7f110369035f00c3d0d4f229997aeb7b3dd38a24a5a76d55f66f35040fe986f31d8f79a7af

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1A73622B9CBB460D957EB9C41F507975.TMP

Filesize
5KB

MD5
bd6b22b647e01d38112cdbf5ff6569a1

SHA1
1d5267e35bd6b3b9d77c8ba1aca7088ad240e2b9

SHA256
ff30b5f19155f512e7122d8ab9964e9edb148d39c0a8eb09f4b39234001f5a6e

SHA512
08c7f1400f1a3cd4e1442152ef239a18dda7daac61f4c0b0ff461c2264949b3dcd6227cbca39ff3eef39345e001f89c1ca6702065d1b9bb1659f2cf48b299a9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1CA8F50F58E43768DD1018E29FDBCA.TMP

Filesize
5KB

MD5
9874538991433131fb3158b7b1f83d46

SHA1
9e9efd410b28be52f091ceab335eb1e6ed8e001c

SHA256
2d5286b5a40631602fb0c35d2b9da6236434a22f3dfc1b98239987d72ae8d04c

SHA512
9ee53b9dccdc5418870ffee74e692b01c0d78305bebbb360d01aa628957914a4ed8f36afa83cbc016ee8694b8da8d08fec4de4b227b6429b5f1f48b13a3efb42

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc301FFE6B87D24D968B53E2CDE93ADC8.TMP

Filesize
5KB

MD5
17a9f4d7534440cae9e1b435719eceb9

SHA1
bc4c3569dbd3faf4beac74a4b3ea02b33e019530

SHA256
5e05232caa624438da3cd74d3cf72b04c2b383fd68448a110b892a4913e91470

SHA512
673b374c701d5756a55fd20122b00c497843b5116cc6e7dfd4b71755a692024d70a30c00f803427c343f2227ed5bc48df67234a41cb88dbf5eed70810e470f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc42E75454F2D84171A31DE1682058438D.TMP

Filesize
5KB

MD5
83005fc79370bb0de922b43562fee8e6

SHA1
d57a6f69b62339ddadf45c8bd5dc0b91041ea5dc

SHA256
9d8d4560bcacb245b05e776a3f2352e6dbecd1c80ac6be4ce9d6c16bc066cd9c

SHA512
9888bf670df3d58880c36d6d83cb55746111c60e3949ec8a6b6f773a08c96d7d79305192c5ad9d7c6689e93770880a5be56968bd12868b8b5d354bf5b39bee05

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc46397071D67C4369A1C5874D17E99C.TMP

Filesize
5KB

MD5
bb7c2818b20789e4b46db3b54dbbbb12

SHA1
b262ea7343363caae54bcce98e96e163cdf4822d

SHA256
a944a5a52b5edfd19415c068a810b7249e5b5622d8faeee5d36f3fcb2462de67

SHA512
b101eb7a02d1911adee23bd63f5dbc84490b498583b802b4db0ab763de2c6abcbbb1bd28b17f9ad24e094e51bc3614bcf09c3a72841c500a9ae8d57e02a211ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc63D45552C1E348629E2CA8FF572F567.TMP

Filesize
5KB

MD5
694fb05871caccdce836dd0f109c4f86

SHA1
0cfa12096a38ce2aa0304937589afc24589ff39a

SHA256
bc1513ac66cd5adf438ed32370cf1bb219e07e602cc796525b822b0bd78b12fe

SHA512
50944dfe4013054ddf1529e6fe4d23af42aada5164dfea1316fbf18846e38006ba3cc8ef03dd6ab7ceb810ccf25dafc0fb790e2a6a0b0f3b2197b640d65cacd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc788418E8675C4E8D90BED05C4266031.TMP

Filesize
5KB

MD5
40106f913688ab0f9bcbe873333d3dbd

SHA1
bbe7cd918242a4ddc48bdcd394621cccf5a15d91

SHA256
1d1a8ff68478aed22714dab15691996d196dc975a18f656261417dfdd85dcf47

SHA512
67052405e9a8bdf9d836af9fdb13f0a4f57e7e90f0d2c3c5fd10830423e1401193699ff3b195e0cdcb2a89a3582f623ec9e5ebbef899300cf354c0ae89b765d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc9107F299C36544C9801DED44CEB47CE1.TMP

Filesize
5KB

MD5
7092dd0251b89b4da60443571b16fa89

SHA1
08cb42f192e0a02730edf0dfa90f08500ea05dd2

SHA256
2aa88b69c033bd712f9752eefa5624f534b915bb5dada74133d2ac0c67beebf7

SHA512
7067f485062be4fea3d52815e4dbdad50b1c53c30b5b354d64ddf4d5126788d169b90bba26dec25ecbf40e23ea59991d149e12859838e6b10028be0c86c5af7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcB085C8A612C4197A6561A70CC88A066.TMP

Filesize
5KB

MD5
97ea389eab9a08a887b598570e5bcb45

SHA1
9a29367be624bb4500b331c8dcc7dadd6113ff7e

SHA256
ab2e9e4fa0ade3a234fb691e1043822f23b6642a03bf355e8a94bbe648acd402

SHA512
42ab57f66062848ed8ed5384f3e3beca0d446fa1889f2960e349271ccd72f80632b7c372d11a7cf3e9da8c1119668bc748ac663def652b044101f2f31e398a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcD032B70210024BECB01C9B6A56DB9F5.TMP

Filesize
5KB

MD5
3ca7194685ffa7c03c53d5a7dbe658b1

SHA1
c91550da196d280c258d496a5b482dfdae0d337c

SHA256
09fd06c1908591feac9dcda2a519bf862519267cd4e42c9d25b772b1d9161f39

SHA512
949801ea9aa592e118678ff62949633e9f0502f2c07bbb398484de6911f9cf652f40bfb446aee8ec59f6262fb8da8792efa56119c90eee44a199dab7226b54b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcD7AB94BFB9414CAE8CDD18E68971E83.TMP

Filesize
5KB

MD5
38a9e24f8661491e6866071855864527

SHA1
395825876cd7edda12f2b4fda4cdb72b22238ba7

SHA256
a0dba3d6dd5111359fcaeea236f388b09fe23c4f8ec15417d5de1abf84958e96

SHA512
998fb6143141262e98dd6109bd43e1fc7389728a047d819b4a176b39bb1594e5f36c1e38cbbe41023bb91a32a33b0aa9901da1dda82513882ade7f8bd4196755

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcD8F811C942334E6EB5FF56A0FF2C99D.TMP

Filesize
5KB

MD5
b751c6d2b6e47c4ca34e85791d8d82ff

SHA1
e9e7402eece094b237e1be170fecc62b33ffb250

SHA256
c66789b3014305976b263fa7bbb629bcf543d07f0c2bfa11cde4a2aa957b26d4

SHA512
d9f7a8a1ffffcf13c6fa35a8a76f9adbde49ebfe1de6a4fa0e3e0cfcd3a28e035a0ba5a6e5d9a4c5fc9cad2adf1f93fecff036f1540f3f623fdafa226f2ded0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vjsr3h5x.0.vb

Filesize
383B

MD5
e8615295f45d210bf3b7d023e3688b9f

SHA1
e33be2e3faddd8e48f62e0f30ad3cdc08bae7e33

SHA256
c81a9b36d60cc8d54374337bf1b116165c41be0cd2460ac35223fb790f5f94fc

SHA512
b48fa683711c9cd16f6e4e007145a508b617bbf9847efc1d81cdea75dda43bf88a3d094fc93fe8ef7c4b55e3dd1c4e687a6044b504b106262b2566c4ab944919

Download Submit
C:\Users\Admin\AppData\Local\Temp\vjsr3h5x.cmdline

Filesize
270B

MD5
eb835c5fa96fc04a3279f8e0c77f0965

SHA1
9aa55a35b99cf74d67cfe57dd2072a3caa21681a

SHA256
716b28f6da91c030a2fd4f52d952f9df0f3a53053b79efbf48fef16f79b65b8a

SHA512
b785d2d66b46ab541e83abbdf083b8c2c4bb22bd8bd17202f51dff387a4c1dd0578a64dfea99404b0bf9bf771303ce224c900e04d082a09d7113a74d4a346bdd

Download Submit
memory/1128-3-0x000000001C5F0000-0x000000001C696000-memory.dmp

Filesize
664KB

Download
memory/1128-7-0x00007FFB474E0000-0x00007FFB47E81000-memory.dmp

Filesize
9.6MB

Download
memory/1128-10-0x000000001D8C0000-0x000000001D95C000-memory.dmp

Filesize
624KB

Download
memory/1128-6-0x00007FFB47795000-0x00007FFB47796000-memory.dmp

Filesize
4KB

Download
memory/1128-5-0x000000001CD00000-0x000000001CD62000-memory.dmp

Filesize
392KB

Download
memory/1128-0-0x00007FFB47795000-0x00007FFB47796000-memory.dmp

Filesize
4KB

Download
memory/1128-4-0x00007FFB474E0000-0x00007FFB47E81000-memory.dmp

Filesize
9.6MB

Download
memory/1128-1-0x00007FFB474E0000-0x00007FFB47E81000-memory.dmp

Filesize
9.6MB

Download
memory/1128-2-0x000000001C070000-0x000000001C53E000-memory.dmp

Filesize
4.8MB

Download
memory/3984-17-0x00007FFB474E0000-0x00007FFB47E81000-memory.dmp

Filesize
9.6MB

Download
memory/3984-26-0x00007FFB474E0000-0x00007FFB47E81000-memory.dmp

Filesize
9.6MB

Download
memory/4080-43-0x00007FFB474E0000-0x00007FFB47E81000-memory.dmp

Filesize
9.6MB

Download
memory/4080-295-0x00007FFB474E0000-0x00007FFB47E81000-memory.dmp

Filesize
9.6MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads