60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RAT/file.exe
Size

101KB
MD5

88dbffbc0062b913cbddfde8249ef2f3
SHA1

e2534efda3080e7e5f3419c24ea663fe9d35b4cc
SHA256

275e4633982c0b779c6dcc0a3dab4b2742ec05bc1a3364c64745cbfe74302c06
SHA512

036f9f54b443b22dbbcb2ea92e466847ce513eac8b5c07bc8f993933468cc06a5ea220cc79bc089ce5bd997f80de6dd4c10d2615d815f8263e9c0b5a4480ccb4
SSDEEP

1536:fkSJkZlpqwZoMoG5XoZnOZBX7D/3BINVRX3FjBqa8D3tSYS9h:MXlpqwZoMz5XoZncB/3BINZjy9SYS

Score

7^/10

persistence

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RAT\\file.exe"	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 2904 file.exe

description	pid	process
Token: SeDebugPrivilege	2904	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exe

description	pid	process	target process
PID 2904 wrote to memory of 1324	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 1324	2904	file.exe	vbc.exe
PID 1324 wrote to memory of 4608	1324	vbc.exe	cvtres.exe
PID 1324 wrote to memory of 4608	1324	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 3108	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 3108	2904	file.exe	vbc.exe
PID 3108 wrote to memory of 3292	3108	vbc.exe	cvtres.exe
PID 3108 wrote to memory of 3292	3108	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 2292	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 2292	2904	file.exe	vbc.exe
PID 2292 wrote to memory of 4140	2292	vbc.exe	cvtres.exe
PID 2292 wrote to memory of 4140	2292	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 5084	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 5084	2904	file.exe	vbc.exe
PID 5084 wrote to memory of 760	5084	vbc.exe	cvtres.exe
PID 5084 wrote to memory of 760	5084	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 4468	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 4468	2904	file.exe	vbc.exe
PID 4468 wrote to memory of 5036	4468	vbc.exe	cvtres.exe
PID 4468 wrote to memory of 5036	4468	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 4372	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 4372	2904	file.exe	vbc.exe
PID 4372 wrote to memory of 4792	4372	vbc.exe	cvtres.exe
PID 4372 wrote to memory of 4792	4372	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 3196	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 3196	2904	file.exe	vbc.exe
PID 3196 wrote to memory of 2152	3196	vbc.exe	cvtres.exe
PID 3196 wrote to memory of 2152	3196	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 1384	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 1384	2904	file.exe	vbc.exe
PID 1384 wrote to memory of 2236	1384	vbc.exe	cvtres.exe
PID 1384 wrote to memory of 2236	1384	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 4828	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 4828	2904	file.exe	vbc.exe
PID 4828 wrote to memory of 4564	4828	vbc.exe	cvtres.exe
PID 4828 wrote to memory of 4564	4828	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 5020	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 5020	2904	file.exe	vbc.exe
PID 5020 wrote to memory of 4196	5020	vbc.exe	cvtres.exe
PID 5020 wrote to memory of 4196	5020	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 3504	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 3504	2904	file.exe	vbc.exe
PID 3504 wrote to memory of 5040	3504	vbc.exe	cvtres.exe
PID 3504 wrote to memory of 5040	3504	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 3256	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 3256	2904	file.exe	vbc.exe
PID 3256 wrote to memory of 4192	3256	vbc.exe	cvtres.exe
PID 3256 wrote to memory of 4192	3256	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 5076	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 5076	2904	file.exe	vbc.exe
PID 5076 wrote to memory of 4724	5076	vbc.exe	cvtres.exe
PID 5076 wrote to memory of 4724	5076	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 2880	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 2880	2904	file.exe	vbc.exe
PID 2880 wrote to memory of 2688	2880	vbc.exe	cvtres.exe
PID 2880 wrote to memory of 2688	2880	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 1564	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 1564	2904	file.exe	vbc.exe
PID 1564 wrote to memory of 1044	1564	vbc.exe	cvtres.exe
PID 1564 wrote to memory of 1044	1564	vbc.exe	cvtres.exe
PID 2904 wrote to memory of 1536	2904	file.exe	vbc.exe
PID 2904 wrote to memory of 1536	2904	file.exe	vbc.exe
PID 1536 wrote to memory of 996	1536	vbc.exe	cvtres.exe
PID 1536 wrote to memory of 996	1536	vbc.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\RAT\file.exe
"C:\Users\Admin\AppData\Local\Temp\RAT\file.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p-hv4a6q.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6B0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A086572AE244D0B91F8F7C581C89D68.TMP"
    3⤵
    PID:4608
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dhbh1esl.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA827.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7AD09316C55B4032B0D924F613997ED1.TMP"
    3⤵
    PID:3292
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kn1ejcu4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB05.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2EBC17E162B64B489AD1A4CB1369EF.TMP"
    3⤵
    PID:4140
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qmsd1zr7.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB63.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc70C3FE59FC30405A89F4DCCE9B2A9FFA.TMP"
    3⤵
    PID:760
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sluubnfr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABC1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6F1A695C71F540D7AE5DD99B2392F56C.TMP"
    3⤵
    PID:5036
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vnphape9.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC1E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc396AA5CC9DC24A54A37A8362B162DF5.TMP"
    3⤵
    PID:4792
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fhvfqf97.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC6C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9F4A0B47B4E34796A7C81C83C3D6F8.TMP"
    3⤵
    PID:2152
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b2pjkgfe.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACCA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc65AE38A3C616458DAF3DDD286DDA4FBB.TMP"
    3⤵
    PID:2236
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0dap2wor.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD28.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc326103BF8B4B44AEA621AF29932FF7F.TMP"
    3⤵
    PID:4564
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k8cqcjv9.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD76.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc199BA9907E3C448980476FDE72996747.TMP"
    3⤵
    PID:4196
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ld_v7fe0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADE3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBA457F373E384D899E255B80FAA75E6.TMP"
    3⤵
    PID:5040
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_wgfc6jt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE41.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB54B5E289AC84054A3DE3E4AF85D23F0.TMP"
    3⤵
    PID:4192
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r9r5clas.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE9F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6D913BE52179433FB0AAE1ECF44DDD3.TMP"
    3⤵
    PID:4724
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pmxxyiac.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEFD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc186D72A3A0A43E0B0FC51F7B7953B1B.TMP"
    3⤵
    PID:2688
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\puvjnumd.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF5A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc496957A9591542C29F7AC6B0A1C61945.TMP"
    3⤵
    PID:1044
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vbr3_3mi.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFA9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE04021A8FCEE476E89CD3F11529A08D.TMP"
    3⤵
    PID:996
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fganpuix.cmdline"
  2⤵
  PID:4920
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB016.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4BAD0FAF41EF4C609C279EE02F932925.TMP"
    3⤵
    PID:3148
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ck-vzxo2.cmdline"
  2⤵
  PID:2428
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB074.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A5C0A50243F4465B6F4F4D226BFA5B.TMP"
    3⤵
    PID:3068
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uxgr8cqa.cmdline"
  2⤵
  PID:2384
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7ABB2D3259064AFB864D59AD052C33F.TMP"
    3⤵
    PID:3628
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i0aejhwo.cmdline"
  2⤵
  PID:4060
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB100.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc61A2ABA83011478A928C2770C523A4CD.TMP"
    3⤵
    PID:3456
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lbndsvso.cmdline"
  2⤵
  PID:1272
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB15E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA8779DB39CC6498885ED62E4EB7412B8.TMP"
    3⤵
    PID:1748
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g6tcslyq.cmdline"
  2⤵
  PID:2276
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1AC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6FE8D130A7DE463797EAD334256A7C19.TMP"
    3⤵
    PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\RevengeRAT\vcredist2010_x64.log-MSI_vc_red.msi.ico

Filesize
4KB

MD5
c350868e60d3f85eb01b228b7e380daa

SHA1
6c9f847060e82fe45c04f8d3dab2d5a1c2f0603e

SHA256
88c55cc5489fc8d8a0c0ace6bfb397eace09fba9d96c177ef8954b3116addab7

SHA512
47555d22608e1b63fbf1aacee130d7fc26be6befaa9d1257efb7ad336373e96878da47c1e1e26902f5746165fc7020c6929a8a0b54d5ad1de54d99514cc89d85

Download Submit
C:\ProgramData\RevengeRAT\vcredist2010_x64.log.ico

Filesize
4KB

MD5
64f9afd2e2b7c29a2ad40db97db28c77

SHA1
d77fa89a43487273bed14ee808f66acca43ab637

SHA256
9b20a3f11914f88b94dfaa6f846a20629d560dd71a5142585a676c2ef72dc292

SHA512
7dd80a4ed4330fe77057943993a610fbd2b2aa9262f811d51f977df7fbcc07263d95c53e2fb16f2451bd77a45a1569727fbf19aeded6248d57c10f48c84cb4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\0dap2wor.0.vb

Filesize
382B

MD5
44ab29af608b0ff944d3615ac3cf257b

SHA1
36df3c727e6f7afbf7ce3358b6feec5b463e7b76

SHA256
03cbb9f94c757143d7b02ce13e026a6e30c484fbadfb4cd646d9a27fd4d1e76d

SHA512
6eefa62e767b4374fa52fd8a3fb682a4e78442fe785bfe9b8900770dbf4c3089c8e5f7d419ec8accba037bf9524ee143d8681b0fae7e470b0239531377572315

Download Submit
C:\Users\Admin\AppData\Local\Temp\0dap2wor.cmdline

Filesize
268B

MD5
84e1f12faf8f4abfd106069615d0200a

SHA1
f466a564f5d80d3ed468e8653455394e86a7c95f

SHA256
5588f9aff0460de2ab6144ad7a4648a0457c224a9ac74fea0fb68fabf0affe58

SHA512
409e76c4e407f4fa8e7be69251310c8799e6076648a797a8aa0c983dd7539cf626f47dd255e1841aa66ed9ec5143580b8cdae0a65acc1cd8009c75c5b1925470

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA6B0.tmp

Filesize
5KB

MD5
b63dfe9efcf6f901b922c1637f36f3ef

SHA1
85c5197f8e5dd14ad33fd38b6a1de7466392545f

SHA256
e16b598ff6c66d70c392e6d2cd616b8d46a3482d11f97019250712b34d6e1883

SHA512
bf73dbbc7908657c078cd66ea23b3d51c0886a9509d4ade2fcf61f59777da94c5ff1a81a15e678635606ba9c2c07a668eccbb22b3b07ffe1bcd6bfdc11e25c36

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA827.tmp

Filesize
5KB

MD5
05fba0fdfdbfe47568dd16bc952de930

SHA1
c3a7f8e4885900219853f444eee5dc3c0556c874

SHA256
3745ab7190f10644c05fd207d7bbb98740c7af3b9b411d450e9ef92cc9b36d79

SHA512
88048ac53b465f5c06ab9b642082af1dc4ca21339953fbbe7ba077f8b38c54b7ac1f4d337993ec728c95d0de4e1e3f765a3e88b88500c3069c6c8bb23a7519b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAB05.tmp

Filesize
5KB

MD5
3af123368d5ea07990a37534a8b485a6

SHA1
24ab32e110aa33876b7d9cf0ab9d0bd105555d76

SHA256
ed9c12464a2a7ad046f41e85f43f9eda33ee4fbf69b21765d6aa5a7a674705d9

SHA512
be3a2467935fcd8f4213b8024f6c2793b1aa524e5a1d09b9541d55c914f514d1b7c2c3ad7c239d27d7494d38145a2a70080e87bb3299560ed7ce8e7dc0771aa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAB63.tmp

Filesize
5KB

MD5
b7eca4477038878d4bae4ad2353a736b

SHA1
a3291c45c980f7f9f26016a0cb853e2abca6c739

SHA256
f5463c37b153e471349623efe2eb311acf63014caeae8142e742039fbea6443a

SHA512
c48d113ef511741074ca0bd40c24bbda436ebc5311cbfcdf0de22f704e0a7e58eb269d2d3c226330ab190569c821f603401baaf787a7cb37ba68a66e3d369507

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESABC1.tmp

Filesize
5KB

MD5
7d767c6aa7ab904f4b967d6a5dfda889

SHA1
50fd6deaf65dcd18e78be80b79ea11185f3fca15

SHA256
bd885336bdad7c6b33cafb5832245c9ffbb9077e81658dace2022ad4821cac39

SHA512
92c75494a4f6e2e423afbc1cb4786846887c58eb8a6bea842625388291a8138230609810512a6739be04bc7260089ba2a4ce8d13c4060ede0b3005015bb57571

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAC1E.tmp

Filesize
5KB

MD5
707c2b6bd3c9c92c1696164e2532d87d

SHA1
30763a964a4e57fcb9b125c3ce1516b989eb68a8

SHA256
2322a210599c60b1ad828b53372d713a646937fa830de17f62ae8fdc3c6b7a9a

SHA512
3813140d49118f192a55e4c4608ef469622b7a99d022d7eaab0def149dfcb4c2a9e9a9cf726ff6263dccf4cc092cb113af992e6736eb875f3a7644917effb0bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAC6C.tmp

Filesize
5KB

MD5
5da75749daf2696dd21c65856d74e955

SHA1
5008dc9ce9c5cfc7f28e4f66f99ba3376afffe09

SHA256
144fcffdce1fc8d2115e109c89abdac09d628926f56b0d59c67d4ae99fdbf90f

SHA512
595ff7ae535d3744a07cd38478b1dba8bfce1d4159b848a681f77b7c4e1493638d8d3056bb43f55793cf0a2b704cd1acbcf0ddccd9dc1b8c009fac994a2baef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESACCA.tmp

Filesize
5KB

MD5
b636b31921bc57d87168260d9967c8e0

SHA1
fcb966b16f313fb3813bca4222f0c3a8253c5fcd

SHA256
bd966691406c8ca29cc4f1f1ab571273759b32f946a5c9b96f05b3b51bcb231e

SHA512
08ab787fcd361d7e31fef5336d717b4eb682399406da047f9503981338edd04ba695943fe9484f641cd071a166be6ce6b1f48355da506f1ab4ea119ff14dba25

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAD28.tmp

Filesize
5KB

MD5
5941bf1427800c015c44782a1fde827f

SHA1
05f5e34cc03327a7a029b15ac954e9115c7005f5

SHA256
6dee066155b52150d27b9f70ff803f0195d6202727c49a61a11d28f75d77b9ef

SHA512
a61d29669c4402783b6a3897ef0cf7068f23ae8af15cbfbe1bbaba3d1e1ae7002a975ad5f3927ffeffae19a7a16dde449014e9b4863671a484c19661da004df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAD76.tmp

Filesize
5KB

MD5
b02e9b887012ab3fc13a37fa39276f16

SHA1
1bbc3dc2c9909095db43bfe4528b6561972d07ec

SHA256
0aa5fec6df5a16a627a2fc067d87d30822d8fc9668a5b99043d51fad13b8a4cf

SHA512
fe27f282d0dae89261c52751c3f23b874dde1341c68909beba0deec68af9569cee53ad6cb97ed988f799150a8d5fe2dbfbeb3fe8eed596052731c5bbdb807add

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESADE3.tmp

Filesize
5KB

MD5
7da711accdfe64404d6f6879ed5d72a7

SHA1
9f20dad8aa2f298a78ff89e241364d6b9403db68

SHA256
861d6da848bd6cccef3f743097b6a83d20077d403258eac34c4aab335b82518e

SHA512
28c6e52ba3f4a300b2b5e7beb26792feaa15e5aacb31471c6a9c58c6fbba11b455a0803097e8c09654a685f444e3934a89c99862574353d14090ada3c08d0b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAE41.tmp

Filesize
5KB

MD5
d5e324aa51d77d991754b7953831af3a

SHA1
73caefd1d0cfd0cb25b720b75a483ba3462cf1a7

SHA256
1c44dfecd48ef473896f80bb551d012b8779d75c856ace04dc540dda1b24ffa8

SHA512
499e72f8dabdb56fe359e0720b956d59aa6071eea65a0511525fb6edbd44ca7ad2a6029d3aced7a413ccbe0473afe9655164a36e0a7904b50d8d7c6c03dafa1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_wgfc6jt.0.vb

Filesize
385B

MD5
40650ce23f89e4cd8462efe73fa023ce

SHA1
8709317f898d137650ecb816743e3445aa392f75

SHA256
ae23b3ffff9fb03b649f412247c342e9cd970e371b0d5dea6be75a26617a5afb

SHA512
b6ec7998e2a9703e2badcb41e60128f340c1c4ffcb9aa2c6532b3dc18024abdec1f739148f45d66417df84f3beed1a15ddbf9f33da073018ab902531ccbde850

Download Submit
C:\Users\Admin\AppData\Local\Temp\_wgfc6jt.cmdline

Filesize
274B

MD5
231cb1b2afd77adeafb6d628de68ba99

SHA1
70a4f127dfd8114a873879eafafd7a112f595412

SHA256
2e2c328cbb9de5d5697e29fa3a0ac87e6ffc4fdfd4ddb35d967d3ba06e8bbb62

SHA512
0d9f5da27d71b00db047fb6fb2ff1c8e2a2a605f7a7655bd569580d5540d205e2836e19a712bd3a719c167267b18f9635aed53f9725a3ac6934cb82f83c6455f

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2pjkgfe.0.vb

Filesize
383B

MD5
a236870b20cbf63813177287a9b83de3

SHA1
195823bd449af0ae5ac1ebaa527311e1e7735dd3

SHA256
27f6638f5f3e351d07f141cabf9eb115e87950a78afafa6dc02528113ad69403

SHA512
29bec69c79a5458dcd4609c40370389f8ec8cc8059dd26caeaf8f05847382b713a5b801339298ff832305dd174a037bfdb26d7417b1b1a913eacf616cd86f690

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2pjkgfe.cmdline

Filesize
270B

MD5
009ed67bb0833844842063cb33ba9d20

SHA1
4b610080ede27deb7ec236726cefb50af4bf77f2

SHA256
ecd8a2d97e08119407b1f1833f4224ac2c4759ead50006eb3c93b079c104e706

SHA512
947757c484e1d51a2bba752de35711ef368748046d5d844631e784f40e1105afb4d3016e0c4083181f6bc6828f855d523aedb3033b6b8ef3e4064858a2ea2b0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhbh1esl.0.vb

Filesize
362B

MD5
31e957b66c3bd99680f428f0f581e1a2

SHA1
010caae837ec64d2070e5119daef8be20c6c2eae

SHA256
3e32c4b27f7a5840edc2f39d3fc74c2863aa2dfd9a409f1f772b8f427091a751

SHA512
6e61d77c85c1bf3fd0c99630156e0390f9a477b4df0e46218054eae65bee7766443905f48e3f3c7dec72b3fb773f758cf175df54f1ed61ac266469579f3997af

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhbh1esl.cmdline

Filesize
227B

MD5
126af5ce055f70321866963a297ea9b2

SHA1
4f4ff2e7dd38c5583085e6eecf791808c2dcb6f1

SHA256
38fd02b3e0f1ef1d22523d38291e3f47e03f43122d36850c66ead2a67ee891de

SHA512
9a61a2db18b3e5710dc43caea5d9f59deed575101918d95390bcd61d7d40568081e16d3abd62714909c74df792fd2119f05a8841752fc0b0f4d9522dabe332c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\fhvfqf97.0.vb

Filesize
380B

MD5
6a3d4925113004788d2fd45bff4f9175

SHA1
79f42506da35cee06d4bd9b6e481a382ae7436a1

SHA256
21be523eca2621b9e216b058052970dc749312d2c26836639d8e8faff94c76bb

SHA512
2cfdecfa0604ad7fd54f68bf55e7c52701c7b196de51412e172526affffd6e6c4bc443b6df0fb21d2c777c809aa4e3809bd2b5b385e0d033604b6b653a0f416d

Download Submit
C:\Users\Admin\AppData\Local\Temp\fhvfqf97.cmdline

Filesize
264B

MD5
1f4eeb1064298eb67fb1425b1bcab47e

SHA1
bf420559bef4937cfb1fc3dfd5968773b6bc8828

SHA256
3ba29cc822b5931c1cec612b5259bc9e7cfd925a7416068ab0bb81b7e317f07b

SHA512
4e8e4f0cf5ca258ce40cefcefdab495af4e1e992be7f9ba58184c809762841f4df5199a56e5702d3d1d55f015320dbdddc41af1f26f736b5e126860f91f50789

Download Submit
C:\Users\Admin\AppData\Local\Temp\k8cqcjv9.0.vb

Filesize
385B

MD5
0ad1ae93e60bb1a7df1e5c1fe48bd5b2

SHA1
6c4f8f99dfd5a981b569ce2ddff73584ece51c75

SHA256
ea68ce9d33bd19a757922ba4540978debcba46f1133fbc461331629e666d6397

SHA512
a137a8f18a2b2ff9c31556044dd7c41fb589a6a52b15e4dc6cbb3ba47ab4a06d8b9ad54fb498100dab33f8a217848d31f14daca736045afb4f76ffb650b17f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\k8cqcjv9.cmdline

Filesize
274B

MD5
44a1b9abc29141af55dd3c7337bda2a5

SHA1
ddce1f960864aebe7c5ba3f6220ec70cc6393275

SHA256
158f9dccf70373ada3240acdd3b9b7a1879fafd0abb2f0c3197e173340bc1b7c

SHA512
a0b5e5101baf488a49de38d190448554242b1a804590edde873842a6e4fe4a4225a10809f5f1010d1173b2303348d723017cce60c546c1dad4ba85eb34e44234

Download Submit
C:\Users\Admin\AppData\Local\Temp\kn1ejcu4.0.vb

Filesize
376B

MD5
0c699ac85a419d8ae23d9ae776c6212e

SHA1
e69bf74518004a688c55ef42a89c880ede98ea64

SHA256
a109cb0ae544700270ad4cb1e3e45f7f876b9cfac5f2216875c65235502982fe

SHA512
674e3f3c24e513d1bb7618b58871d47233af0a450f1068762e875277bbddf6c4f78245988c96e907dbbf3aafb5ff59e457528b3efa8e0a844f86a17a26d4f3d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\kn1ejcu4.cmdline

Filesize
256B

MD5
88bc3d1fae38d1208ef053d490bbabf7

SHA1
7a43400fe412d71427d577810ac8259d0d852a3f

SHA256
16427a2536e2915e37ff21d74f96f215ebb43a083c101b48a1fb456e779a9f0d

SHA512
7f3c23178b3473af91ca02fefe11774a8c56388ec347e1c389e7452d866b0b9586aaea5c0c111eb2834b3ca004411f2501aede1d4894934d1e6316f8665c14d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ld_v7fe0.0.vb

Filesize
382B

MD5
7d4fad6697777f5a8450a12c8d7aa51f

SHA1
879db5558fb1a6fac80a5f7c5c97d5d293a8df5c

SHA256
741018cae167c9f6c1206e75ddf3d758543f9a16bec5d56a07fab9eb5439e3f6

SHA512
6a31b4eab1829db245773e18e97f9a9956224174e28218476e45e8907bf8b4341ed732a0153a320cb956f2eca4e014c1ef6b0c6f627cf97a79b7a81f8e1fe144

Download Submit
C:\Users\Admin\AppData\Local\Temp\ld_v7fe0.cmdline

Filesize
268B

MD5
4e7a2ac998cef9807261aa010888a39e

SHA1
435080cc2ffd1a51b83d707d8acaef979d12de9d

SHA256
ea87a65d462ec7b86382ca3f66abd8ce10ca6a5a0bf1995b534239ce3631ef79

SHA512
4623c9e7606b1ed4976b4a3e3ee19e40bd2bf219ea0f3c033a96b5ed7932459df78af487e7c5bd4d958f11fd4e45e1d6b6fdb336c76fd6f2fe0f4c1c4f9c17d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\p-hv4a6q.0.vb

Filesize
376B

MD5
52ddcb917d664444593bbd22fc95a236

SHA1
f87a306dffbfe5520ed98f09b7edc6085ff15338

SHA256
5c55dcac794ff730b00e24d75c2f40430d90b72c9693dd42c94941753a3d657d

SHA512
60dafb21f44cbf400e6f8bc5791df9a8d497da6837fb1a453fda81b324ac6f70fb9ec0efb1e7649b9bed0dfe979016360f3bcfef543d7e9432a97b96c8b9fd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\p-hv4a6q.cmdline

Filesize
256B

MD5
623c6db7bf17bcb38928184ffcac98b1

SHA1
7392a251e517f04cd2c28ec2245ab4720602f796

SHA256
680beca97980e871f4e6a2b78d240db3d8fe95b646063b40172856d74a95548c

SHA512
cf336507094a53011c45519f22b747b7bae99b12ffc40d586df4c684d00e4064de8c14a0df99e435ae3c3c06cc5c347762d5674d2e54f0b31dfd8c75cee428c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\qmsd1zr7.0.vb

Filesize
362B

MD5
3b4aed436aadbadd0ac808af4b434d27

SHA1
f8711cd0521a42ac4e7cb5fc36c5966ff28417b6

SHA256
ee55ee594a9bb7acee0dfaa9aaa31ebc044e3090b5a68baef63ddd2f6493d3a6

SHA512
6ca8a69f31876db620e8818d896257d3683dcf859841afa3ba7b83ae57ce67c47b98b4e44c449b02eb789b683b840e769857b10cf16a5a5882683e96f65ab5ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\qmsd1zr7.cmdline

Filesize
227B

MD5
88cd5063dddc0bff8b69568ffbfc63e6

SHA1
db8874880d9d008a9abbde2c8eb42e99de6c6190

SHA256
32af60bc44a627020967f166de44909a7b26ac1f7a6a2efa0de909983b417887

SHA512
695fb212608095caa2938b4348db7a7046fb4a7d6d07b2884f3d8ddc4236a05c3838b93ae54fbea4bc477ff31e872325005de78af6b8897b1f399ff7443bacb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\r9r5clas.0.vb

Filesize
382B

MD5
37c6619df6617336270b98ec25069884

SHA1
e293a1b29fd443fde5f2004ab02ca90803d16987

SHA256
69b5796e1bb726b97133d3b97ebb3e6baac43c0474b29245a6b249a1b119cd33

SHA512
c19774fc2260f9b78e3b7ee68f249ce766dcdc5f8c5bc6cfc90f00aa63ce7b4d8c9b5c6f86146aa85e15fd0c5be7535cc22e0a9949ef68fbd5aca0436c3bd689

Download Submit
C:\Users\Admin\AppData\Local\Temp\r9r5clas.cmdline

Filesize
268B

MD5
7cbdbd47823c181ca1fa86369c45d10c

SHA1
11e0fb35884156a8e059ad1ee76abff71cd78d94

SHA256
55cd42d291f6a73a4fd0074edb9d7bbb9352dc2227353b59cda55a1ef156d46f

SHA512
70e53dbbc8e74785f040d88971938af830efcbe1b478b6ce9b93b9000b267023df98dcc5739cfab9760400811cfabbe68d6ef5979bc6dd28fded008f1b958f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sluubnfr.0.vb

Filesize
380B

MD5
3cbba9c5abe772cf8535ee04b9432558

SHA1
3e0ddd09ad27ee73f0dfca3950e04056fdf35f60

SHA256
946d0a95bf70b08e5b5f0005ff0b9ad4efe3b27737936f4503c1a68a12b5dc36

SHA512
c3c07c93011dc1f62de940bc134eb095fa579d6310bd114b74dd0ae86c98a9b3dd03b9d2af2e12b9f81f6b04dc4d6474bd421bce2109c2001521c0b32ae68609

Download Submit
C:\Users\Admin\AppData\Local\Temp\sluubnfr.cmdline

Filesize
264B

MD5
6578df11b545df9f437fdcd11d348915

SHA1
1a5b4ee5f5b8172ac527716ba4b82ef13f5628d0

SHA256
4e84db5db77417fb879f459c1bc95079d0355677581d4829266ddf0bb06022d6

SHA512
e0000225a51a819e2aacc554fc9183a4ada82423c97d6aa2f393bc585bf78b2a32dcf9b3f1eb29fdb9f19728c30c3019a0fb4873392a54e95baf7f84f980f3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc199BA9907E3C448980476FDE72996747.TMP

Filesize
5KB

MD5
3ca7194685ffa7c03c53d5a7dbe658b1

SHA1
c91550da196d280c258d496a5b482dfdae0d337c

SHA256
09fd06c1908591feac9dcda2a519bf862519267cd4e42c9d25b772b1d9161f39

SHA512
949801ea9aa592e118678ff62949633e9f0502f2c07bbb398484de6911f9cf652f40bfb446aee8ec59f6262fb8da8792efa56119c90eee44a199dab7226b54b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc2EBC17E162B64B489AD1A4CB1369EF.TMP

Filesize
5KB

MD5
bb7c2818b20789e4b46db3b54dbbbb12

SHA1
b262ea7343363caae54bcce98e96e163cdf4822d

SHA256
a944a5a52b5edfd19415c068a810b7249e5b5622d8faeee5d36f3fcb2462de67

SHA512
b101eb7a02d1911adee23bd63f5dbc84490b498583b802b4db0ab763de2c6abcbbb1bd28b17f9ad24e094e51bc3614bcf09c3a72841c500a9ae8d57e02a211ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc326103BF8B4B44AEA621AF29932FF7F.TMP

Filesize
5KB

MD5
17a9f4d7534440cae9e1b435719eceb9

SHA1
bc4c3569dbd3faf4beac74a4b3ea02b33e019530

SHA256
5e05232caa624438da3cd74d3cf72b04c2b383fd68448a110b892a4913e91470

SHA512
673b374c701d5756a55fd20122b00c497843b5116cc6e7dfd4b71755a692024d70a30c00f803427c343f2227ed5bc48df67234a41cb88dbf5eed70810e470f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc396AA5CC9DC24A54A37A8362B162DF5.TMP

Filesize
5KB

MD5
bd6b22b647e01d38112cdbf5ff6569a1

SHA1
1d5267e35bd6b3b9d77c8ba1aca7088ad240e2b9

SHA256
ff30b5f19155f512e7122d8ab9964e9edb148d39c0a8eb09f4b39234001f5a6e

SHA512
08c7f1400f1a3cd4e1442152ef239a18dda7daac61f4c0b0ff461c2264949b3dcd6227cbca39ff3eef39345e001f89c1ca6702065d1b9bb1659f2cf48b299a9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc65AE38A3C616458DAF3DDD286DDA4FBB.TMP

Filesize
5KB

MD5
38a9e24f8661491e6866071855864527

SHA1
395825876cd7edda12f2b4fda4cdb72b22238ba7

SHA256
a0dba3d6dd5111359fcaeea236f388b09fe23c4f8ec15417d5de1abf84958e96

SHA512
998fb6143141262e98dd6109bd43e1fc7389728a047d819b4a176b39bb1594e5f36c1e38cbbe41023bb91a32a33b0aa9901da1dda82513882ade7f8bd4196755

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc6A086572AE244D0B91F8F7C581C89D68.TMP

Filesize
5KB

MD5
7092dd0251b89b4da60443571b16fa89

SHA1
08cb42f192e0a02730edf0dfa90f08500ea05dd2

SHA256
2aa88b69c033bd712f9752eefa5624f534b915bb5dada74133d2ac0c67beebf7

SHA512
7067f485062be4fea3d52815e4dbdad50b1c53c30b5b354d64ddf4d5126788d169b90bba26dec25ecbf40e23ea59991d149e12859838e6b10028be0c86c5af7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc6D913BE52179433FB0AAE1ECF44DDD3.TMP

Filesize
5KB

MD5
9874538991433131fb3158b7b1f83d46

SHA1
9e9efd410b28be52f091ceab335eb1e6ed8e001c

SHA256
2d5286b5a40631602fb0c35d2b9da6236434a22f3dfc1b98239987d72ae8d04c

SHA512
9ee53b9dccdc5418870ffee74e692b01c0d78305bebbb360d01aa628957914a4ed8f36afa83cbc016ee8694b8da8d08fec4de4b227b6429b5f1f48b13a3efb42

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc6F1A695C71F540D7AE5DD99B2392F56C.TMP

Filesize
5KB

MD5
97ea389eab9a08a887b598570e5bcb45

SHA1
9a29367be624bb4500b331c8dcc7dadd6113ff7e

SHA256
ab2e9e4fa0ade3a234fb691e1043822f23b6642a03bf355e8a94bbe648acd402

SHA512
42ab57f66062848ed8ed5384f3e3beca0d446fa1889f2960e349271ccd72f80632b7c372d11a7cf3e9da8c1119668bc748ac663def652b044101f2f31e398a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc70C3FE59FC30405A89F4DCCE9B2A9FFA.TMP

Filesize
5KB

MD5
83005fc79370bb0de922b43562fee8e6

SHA1
d57a6f69b62339ddadf45c8bd5dc0b91041ea5dc

SHA256
9d8d4560bcacb245b05e776a3f2352e6dbecd1c80ac6be4ce9d6c16bc066cd9c

SHA512
9888bf670df3d58880c36d6d83cb55746111c60e3949ec8a6b6f773a08c96d7d79305192c5ad9d7c6689e93770880a5be56968bd12868b8b5d354bf5b39bee05

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc7AD09316C55B4032B0D924F613997ED1.TMP

Filesize
5KB

MD5
0fe8a8eff02f77e315885b53503483a8

SHA1
953a58a0ff6736967270494a986aca7b5c490824

SHA256
2d2c202dfa06961e1fad395fe08f9caa4b1004f71a0c37457581fa095229afba

SHA512
e0fbfcb9a2db833bea58e5ed923f93689ee598c76f27fb57e19d9a7f110369035f00c3d0d4f229997aeb7b3dd38a24a5a76d55f66f35040fe986f31d8f79a7af

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc9F4A0B47B4E34796A7C81C83C3D6F8.TMP

Filesize
5KB

MD5
40106f913688ab0f9bcbe873333d3dbd

SHA1
bbe7cd918242a4ddc48bdcd394621cccf5a15d91

SHA256
1d1a8ff68478aed22714dab15691996d196dc975a18f656261417dfdd85dcf47

SHA512
67052405e9a8bdf9d836af9fdb13f0a4f57e7e90f0d2c3c5fd10830423e1401193699ff3b195e0cdcb2a89a3582f623ec9e5ebbef899300cf354c0ae89b765d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcB54B5E289AC84054A3DE3E4AF85D23F0.TMP

Filesize
5KB

MD5
b751c6d2b6e47c4ca34e85791d8d82ff

SHA1
e9e7402eece094b237e1be170fecc62b33ffb250

SHA256
c66789b3014305976b263fa7bbb629bcf543d07f0c2bfa11cde4a2aa957b26d4

SHA512
d9f7a8a1ffffcf13c6fa35a8a76f9adbde49ebfe1de6a4fa0e3e0cfcd3a28e035a0ba5a6e5d9a4c5fc9cad2adf1f93fecff036f1540f3f623fdafa226f2ded0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcBA457F373E384D899E255B80FAA75E6.TMP

Filesize
5KB

MD5
694fb05871caccdce836dd0f109c4f86

SHA1
0cfa12096a38ce2aa0304937589afc24589ff39a

SHA256
bc1513ac66cd5adf438ed32370cf1bb219e07e602cc796525b822b0bd78b12fe

SHA512
50944dfe4013054ddf1529e6fe4d23af42aada5164dfea1316fbf18846e38006ba3cc8ef03dd6ab7ceb810ccf25dafc0fb790e2a6a0b0f3b2197b640d65cacd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vnphape9.0.vb

Filesize
383B

MD5
e8615295f45d210bf3b7d023e3688b9f

SHA1
e33be2e3faddd8e48f62e0f30ad3cdc08bae7e33

SHA256
c81a9b36d60cc8d54374337bf1b116165c41be0cd2460ac35223fb790f5f94fc

SHA512
b48fa683711c9cd16f6e4e007145a508b617bbf9847efc1d81cdea75dda43bf88a3d094fc93fe8ef7c4b55e3dd1c4e687a6044b504b106262b2566c4ab944919

Download Submit
C:\Users\Admin\AppData\Local\Temp\vnphape9.cmdline

Filesize
270B

MD5
617003261bd68dad3978ca179350350d

SHA1
1e93c5c92c7aaa452bceb52cf0f6b6767292cd85

SHA256
72d8d0ef57e8ccd0f2a27084b9e8242e6d557c462eb94a745c5ed4bc78608518

SHA512
11a6d7f9d28ede40ebb826255b0ba57765164305c47bd5db11cce8b81f4a3f0f24c32757bcf8621d520bd24fafc80fbad8d2129422b9bd04d3918e688cf41890

Download Submit
memory/1324-26-0x00007FFADC0F0000-0x00007FFADCA91000-memory.dmp

Filesize
9.6MB

Download
memory/1324-17-0x00007FFADC0F0000-0x00007FFADCA91000-memory.dmp

Filesize
9.6MB

Download
memory/2904-10-0x000000001D600000-0x000000001D69C000-memory.dmp

Filesize
624KB

Download
memory/2904-5-0x00007FFADC0F0000-0x00007FFADCA91000-memory.dmp

Filesize
9.6MB

Download
memory/2904-6-0x00007FFADC3A5000-0x00007FFADC3A6000-memory.dmp

Filesize
4KB

Download
memory/2904-4-0x000000001C410000-0x000000001C472000-memory.dmp

Filesize
392KB

Download
memory/2904-3-0x000000001C2A0000-0x000000001C346000-memory.dmp

Filesize
664KB

Download
memory/2904-2-0x00007FFADC0F0000-0x00007FFADCA91000-memory.dmp

Filesize
9.6MB

Download
memory/2904-7-0x00007FFADC0F0000-0x00007FFADCA91000-memory.dmp

Filesize
9.6MB

Download
memory/2904-1-0x000000001BD20000-0x000000001C1EE000-memory.dmp

Filesize
4.8MB

Download
memory/2904-0-0x00007FFADC3A5000-0x00007FFADC3A6000-memory.dmp

Filesize
4KB

Download
memory/3108-43-0x00007FFADC0F0000-0x00007FFADCA91000-memory.dmp

Filesize
9.6MB

Download
memory/3108-38-0x00007FFADC0F0000-0x00007FFADCA91000-memory.dmp

Filesize
9.6MB

Download