Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01-07-2024 18:03

General

  • Target

    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

  • Size

    21KB

  • MD5

    6fe3fb85216045fdf8186429c27458a7

  • SHA1

    ef2c68d0b3edf3def5d90f1525fe87c2142e5710

  • SHA256

    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

  • SHA512

    d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

  • SSDEEP

    384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1

Malware Config

Extracted

Family

revengerat

Botnet

XDSDDD

C2

84.91.119.105:333

Mutex

RV_MUTEX-wtZlNApdygPh

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • RevengeRat Executable 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Drops file in System32 directory 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
    "C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\system32\MSSCS.exe
      "C:\Windows\system32\MSSCS.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lyjsyjs5.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1092
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52F1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc52F0.tmp"
          4⤵
            PID:936
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-i-be9o8.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:808
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES533F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc533E.tmp"
            4⤵
              PID:1728
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u-jhaoty.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1056
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc53AC.tmp"
              4⤵
                PID:1112
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ypyqhhvv.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:608
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5477.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5476.tmp"
                4⤵
                  PID:1236
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lskkex_0.cmdline"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2988
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc54D4.tmp"
                  4⤵
                    PID:2092
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1zamja9f.cmdline"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1992
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5513.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5512.tmp"
                    4⤵
                      PID:1772
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f5bmxxzd.cmdline"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2016
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5561.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5560.tmp"
                      4⤵
                        PID:980
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cwjbhch0.cmdline"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1972
                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc559F.tmp"
                        4⤵
                          PID:1076
                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\soen1n2f.cmdline"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1568
                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55EE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc55ED.tmp"
                          4⤵
                            PID:1340
                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tldpj8co.cmdline"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:860
                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES561D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc561C.tmp"
                            4⤵
                              PID:884

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\-i-be9o8.0.vb

                        Filesize

                        266B

                        MD5

                        debab8fb1bbcbf74ca2ac313d4d5aa7d

                        SHA1

                        2a4058378b3df8ef9aa547d1511a425ef043d848

                        SHA256

                        0f1d45b4fd6c36693c7d96bda036a41dccffa4313b92940df6ad180982607744

                        SHA512

                        8beaad01c2f7541532842aca72324eeee7c582d50db2454bab3288dcb2922fdc1f2a0a3e2347a74e744e92c9f8304916c0f52a18754d2e3a5eb2fe6f9fbf6567

                      • C:\Users\Admin\AppData\Local\Temp\-i-be9o8.cmdline

                        Filesize

                        166B

                        MD5

                        1034deabd99cf304a7163e423b77b86e

                        SHA1

                        e2670353cd948eca348cca94eacc78dc864738a8

                        SHA256

                        f0e3bdb3145c0695235093df830cb76d1274cec4a95fc26b7058a04d07da3849

                        SHA512

                        d7e204e2098c25707fc0dd32c84cf24643e55c53d4290ddc3f10cbbed63e1503d1525668c4d6cc0a47e6a6d7ff3537aae7391eaa4bcff35e6ee25b7dbb24d84a

                      • C:\Users\Admin\AppData\Local\Temp\1zamja9f.0.vb

                        Filesize

                        290B

                        MD5

                        ce1182df38f7b4c7a89d1e4d1886b0d8

                        SHA1

                        ba5cdc6e13b761912d14ec042639566eebc23eca

                        SHA256

                        e87616f590de6878e0a1051e52bb968d39bad4c7b086cdaecc064c6aa9582e3a

                        SHA512

                        7be8358cbcefde4b1e1a28480eaea0daf5bbbd25aba3d1bd8c589bad3adb63a90551830efabc6e0d2b01a406e41e44c5797502abc88566694fbff7c2091e05a0

                      • C:\Users\Admin\AppData\Local\Temp\1zamja9f.cmdline

                        Filesize

                        190B

                        MD5

                        93242973ed8e4242539699e7c598524e

                        SHA1

                        883954155e8a41772dc467ea73751ab0d0ea75f2

                        SHA256

                        4a88b76b3efb677cd61e7ea38f7a552a435392b452a25e44fd18f776f8dd2f6d

                        SHA512

                        bad855014f06e9cd2f5b52c211c471d6212b08b9307b2fa21f4eee46e4c729a2e659a4770a9eb316990322e3513da8673f7d7c10e5418bfd2a8aa6d6566e24b9

                      • C:\Users\Admin\AppData\Local\Temp\RES52F1.tmp

                        Filesize

                        1KB

                        MD5

                        b2a2a0f99b79361354ca369261aa1429

                        SHA1

                        6ff5739c5b40295086493e4f6718bd1191bf6535

                        SHA256

                        b03c9277b108e7add17363a6665fc67a6351201b7051d0618db620fa6d13b4bb

                        SHA512

                        c23a6a8758ba9165f5b35c750aecd734fb71a20c2a80c505e8fe9bc3ec97037792c1473105a7dbf15b98b716bea189650d0b30f5cb45463db8f47e889f320877

                      • C:\Users\Admin\AppData\Local\Temp\RES533F.tmp

                        Filesize

                        1KB

                        MD5

                        53f75cbdf21a223f18a874029c7b3b60

                        SHA1

                        27f6b3b56fe60d86e40f3c0a8603105c4f4ecf35

                        SHA256

                        635e8b1e9703f9e94629e4fa2e865ca675c2f5d484d8057ac9e4b6eeba94cb56

                        SHA512

                        967dd0c018a73b5615a6c7e562cf489f15b42d9e8bd2a6cbfe01a8288a3703f3f6eaf24c632439fd0344913cc3bddd9e53e0d9d0fef74fd8e6a942b573f62bcc

                      • C:\Users\Admin\AppData\Local\Temp\RES53AD.tmp

                        Filesize

                        1KB

                        MD5

                        b0273b61700af533c95a33bf778dff59

                        SHA1

                        feb5e856575bb7f4e5adc7069936c9114a6b8f32

                        SHA256

                        5fb517c827d12d3d26842ffd81f57a065b4bc037b8f69abd9fbabe569c259dde

                        SHA512

                        ab7785fd6a12fdb7e457af4a1dd864d103e873cf9a51b96be48b8f92548e74904523a6415c82e8926c53fc2000425e8447faaf12dbfe4b71fca128b013965e04

                      • C:\Users\Admin\AppData\Local\Temp\RES5477.tmp

                        Filesize

                        1KB

                        MD5

                        293563a6dae14c4b6e5bd1171bb891ab

                        SHA1

                        b43921fdb7c25c27ff2cdf843b6070cb1a45bdd2

                        SHA256

                        da35c2679e11745ea8203a0c7c08e55734e94724b026ac9dac751afba740715f

                        SHA512

                        27df081a218ac575c2c69d7c1626c8da5adc1424b55c3a61f1de07bd573f18d39b4afffdbfef038d49c68c11c81e7672d6cf5ff2643b3fb199444eedb8eb8be4

                      • C:\Users\Admin\AppData\Local\Temp\RES54D5.tmp

                        Filesize

                        1KB

                        MD5

                        c62b3e8d4aff548e9080cbea88124337

                        SHA1

                        47624eb90c740864dbb7b56305fc1468572ede81

                        SHA256

                        82aad6a42b228fb48b3e52e3ddaf477425afc6f52e79cd41c5c98f3138654d26

                        SHA512

                        b462e00bac8ecc710c87f7a3bdb935896900074b97538df6af87bfa0b2b3e0d019c9c9139f80f881e9f53a72914d06fca381d510d1f3cf5e5cf35df2af17f245

                      • C:\Users\Admin\AppData\Local\Temp\RES5513.tmp

                        Filesize

                        1KB

                        MD5

                        4db782285b51297c865ea5de48976090

                        SHA1

                        f83df90adaacaeea6b3844f422f7bac55cc5e997

                        SHA256

                        b4e28423b53453812c685c5fbe5452adf22f3bc0c3d4037a5e2174e703fbef5c

                        SHA512

                        b7a8a2a2db29cf2cd145138ef06647c2b63b0dbf906840637f4da7077c463b358518dd36e4651e471c717197adb78e87102c60461b56b64799e2ef6332defbca

                      • C:\Users\Admin\AppData\Local\Temp\RES5561.tmp

                        Filesize

                        1KB

                        MD5

                        542d44aa9f1f2dc7d4b952a845185a02

                        SHA1

                        41fea6a31b259b600c1e1db3f203c836b1a8c731

                        SHA256

                        49f0f389cb7ad954994a6225d90d38f529cae8db8d2d083bf5f8ce919aeaf773

                        SHA512

                        a8b53a7dfef156fd4ead160b8bd7ee72b0cbda87acaf16158d6f224a2f0af8aa1adaa1b9d4a078c75b51ca73d481ee9c6dc2085cbb78f246b983240c3c8954c1

                      • C:\Users\Admin\AppData\Local\Temp\RES55A0.tmp

                        Filesize

                        1KB

                        MD5

                        132b79cfb5aa4c11168d3b83e4a61e08

                        SHA1

                        a2e766a3712475463923baab8c17176143eacfb3

                        SHA256

                        09a637a6fe82d74325e502996f4b8c7ee265e23acaeb18afc6f7d8b8ba2ce71a

                        SHA512

                        469b3f663acde7d482e922ce079b1a84257dc111538e779d71b5ec9cadcb96859b80d891a5df107bd963b9be0d94daec78fff2342964193c3d621e17df61257f

                      • C:\Users\Admin\AppData\Local\Temp\RES55EE.tmp

                        Filesize

                        1KB

                        MD5

                        eac527779bdc6f3ebc6d37340a2de774

                        SHA1

                        88ac71a66b6111579f8e49820094906707f97052

                        SHA256

                        bccfd09a926583c5fa515cf6fdfd5393bdd2cb60c4198c3c172db21624c0a1c3

                        SHA512

                        3ef364b1d3cc26da066b7ed42e0b690c88e499769ad0fae3bfb8be52bdb3beddaab24979d93f4f9e54a431ee4bd87605e140e2e3e3a54517f5016b52e40470b8

                      • C:\Users\Admin\AppData\Local\Temp\RES561D.tmp

                        Filesize

                        1KB

                        MD5

                        5791b8ee9f7b8c10d51eeb5e14c8ad9d

                        SHA1

                        c8bd4802f92f45fabaf3e20494d198ece0d3aa3e

                        SHA256

                        781325368c8f9df877432e7f9ed3f2fd7527fe39bdd1465f66960f8738d400c9

                        SHA512

                        8f4d4302ab0e50e4ca4c048aace8d9e6410e9c4b3378187bb740dce98de5825caf6bc71226490bf2fadc70586670dbc38e6ca274442aaec6670be636727e74da

                      • C:\Users\Admin\AppData\Local\Temp\cwjbhch0.0.vb

                        Filesize

                        264B

                        MD5

                        5ce3977a153152978fa71f8aa96909e9

                        SHA1

                        52af143c553c92afc257f0e0d556908eaa8919cb

                        SHA256

                        e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed

                        SHA512

                        eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77

                      • C:\Users\Admin\AppData\Local\Temp\cwjbhch0.cmdline

                        Filesize

                        164B

                        MD5

                        37ab6cc02bcb935e211c534d410cc0eb

                        SHA1

                        d72eca9e3027908115a5b03872b8ce1b41d2174a

                        SHA256

                        6b0f7f22724eefb42b275502b4fda43bebff5e9d309cd7e94a9f249c29b3f2b2

                        SHA512

                        fa2c71f13f1f20ddb1901a0997e6bbaa07bb9e575235de771809fc5c31b335100c8f46d4e759264e1705215491dbe5bbe1ba74901ab24a3f4b0154c9691ce3c2

                      • C:\Users\Admin\AppData\Local\Temp\f5bmxxzd.0.vb

                        Filesize

                        271B

                        MD5

                        b19384e98248a2c238e2360d2fecf049

                        SHA1

                        25f5ab6303d0a81f4ef3cc44c0bb53dd3e564fad

                        SHA256

                        296feb4019e37af5174b813d3ac19fa1b17c4db9ad91b06eba610939983e3262

                        SHA512

                        e9e4dd4a302d643fd1d0dd46d058ca7a45c8e6d8b299c129e1a412d1d3309cfe4d4da6f9d893460dde7e96c40414d65e02dbab9c1411dd945581e749ae8438e4

                      • C:\Users\Admin\AppData\Local\Temp\f5bmxxzd.cmdline

                        Filesize

                        171B

                        MD5

                        8b6236edabbc53d845f0fd7f6aadcf8e

                        SHA1

                        0390588d477de9c1002c411a44b22991a93ff2c3

                        SHA256

                        475f84ae4d87fdf664e5966a4edfa52b1b3aa8cbaf79b1bf10575e18887defca

                        SHA512

                        c6561692f33273272a0d5dd7c4f99b239bd32d6d29e1a6ca14d6f070847ee235fc2fe508d6edb79f5b0499e6b9638889c856a3a1dc31999b990a6e83ca4edf85

                      • C:\Users\Admin\AppData\Local\Temp\lskkex_0.0.vb

                        Filesize

                        271B

                        MD5

                        ac972015bef75b540eb33503d6e28cc2

                        SHA1

                        5c1d09fcf4c719711532dcfd0544dfc6f2b90260

                        SHA256

                        fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7

                        SHA512

                        36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83

                      • C:\Users\Admin\AppData\Local\Temp\lskkex_0.cmdline

                        Filesize

                        171B

                        MD5

                        56861257055a37adb6be35b76f0d7457

                        SHA1

                        4fc3feaaee637e68ad859ae29a3624b1e6e89f70

                        SHA256

                        6bd6caf989ba5883ac6dd41560ae3432267da75bf9d64e04ab93ae027ee7ae32

                        SHA512

                        2e5cc40475d7da343957be93c3bd1ddcc4b7d862a3e103aa02f560917b32ba2fda805176bab1d2f3fc5f5fcb4a45a8b6e5ab86da26fb9379b9e896002a4fa4c1

                      • C:\Users\Admin\AppData\Local\Temp\lyjsyjs5.0.vb

                        Filesize

                        262B

                        MD5

                        88cc385da858aaa7057b54eaeb0df718

                        SHA1

                        b108224d4686b5ca3faaeb1c728dfba8740a6eca

                        SHA256

                        08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020

                        SHA512

                        4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7

                      • C:\Users\Admin\AppData\Local\Temp\lyjsyjs5.cmdline

                        Filesize

                        162B

                        MD5

                        050ed15481f8218fd59545fb908b1ee1

                        SHA1

                        5967e7c1ab024aa4bdfd35e73d00a8a59c3c0a65

                        SHA256

                        89d8f6505cf625877fea82e7f7b6f5309aa4366e415bebe8625a617073360e9f

                        SHA512

                        51f461935ca76b341feda3d59a9fd6838306cc2cf97c440de53d756063c94519b2ecdf7c85b93b7b3c4ffcda256b32f8aa10f22d563a5353d2a87ddad7ea6c02

                      • C:\Users\Admin\AppData\Local\Temp\soen1n2f.0.vb

                        Filesize

                        270B

                        MD5

                        658573fde2bebc77c740da7ddaa4634b

                        SHA1

                        073da76c50b4033fcfdfb37ba6176afd77b0ea55

                        SHA256

                        c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607

                        SHA512

                        f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf

                      • C:\Users\Admin\AppData\Local\Temp\soen1n2f.cmdline

                        Filesize

                        170B

                        MD5

                        2189166c97dd63b94f15b36b47556ba1

                        SHA1

                        d16c5d259f23f5668370c507cd30047b00563af4

                        SHA256

                        87e453f916a268d05892b2de40d891eafecf73e7b3021eba5f8af76f91ce3af1

                        SHA512

                        3cea55801dfb647f8141e9723fcee24499582a713b9666256b5ca41a1bb65e0bf7a74e7ed75f5aa196bbdc4b47ba402abad33e7cd563d328883bef1939256c8c

                      • C:\Users\Admin\AppData\Local\Temp\tldpj8co.0.vb

                        Filesize

                        273B

                        MD5

                        3c3d3136aa9f1b87290839a1d26ad07a

                        SHA1

                        005a23a138be5d7a98bdd4a6cc7fab8bdca962f4

                        SHA256

                        5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd

                        SHA512

                        fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60

                      • C:\Users\Admin\AppData\Local\Temp\tldpj8co.cmdline

                        Filesize

                        173B

                        MD5

                        6c80ae09b0cd2dcba5ab879641ea0fba

                        SHA1

                        140726684e12ff0a5dcb32bb72083552ea793770

                        SHA256

                        38e01aecade681fe7e213ee1eb60583f76ea5bdb4dfbdd0cc7980c8e736fa59a

                        SHA512

                        69d58341df54456066ddb429fadf480543ae47abaaf493433a9f11405dfc62eaff422b5c6eed53de458bc1db6b9cf09fdd71f0cb07497243cf3ebec6f11b16a1

                      • C:\Users\Admin\AppData\Local\Temp\u-jhaoty.0.vb

                        Filesize

                        265B

                        MD5

                        cbdf61e7858f1274d58258756e185765

                        SHA1

                        15f0d177b5924a5176ff82f0b79bfa3db558145c

                        SHA256

                        d0aa53536d1316c420848db8bb089b24f9669f1baf3be092a7e0f0a0bc1b997d

                        SHA512

                        ab21cbb170e38a2600db2587ce92b74499107e361d55bbcd5e6281568307ffb1c087aba905c042e2e8960e2e554c84057a197dc4c03121b682868def94c5a038

                      • C:\Users\Admin\AppData\Local\Temp\u-jhaoty.cmdline

                        Filesize

                        165B

                        MD5

                        de8da3492a0f0696070dcb85b0f94e47

                        SHA1

                        f0cfb7e211fb5e4bd1ab9c608f45845da98c3229

                        SHA256

                        8f9a890ca7b7e38808648055b9cf788ac6710808f52e1990db522d4ada64607e

                        SHA512

                        e554efeec595e0c5816fc456660be8425bd0648ba12e7d5d044465995333ae1e261a8a70c24b58acd9e850b652cb15d0236ceaa7a3210fb96cea66a1bc2d01de

                      • C:\Users\Admin\AppData\Local\Temp\vbc52F0.tmp

                        Filesize

                        668B

                        MD5

                        3906bddee0286f09007add3cffcaa5d5

                        SHA1

                        0e7ec4da19db060ab3c90b19070d39699561aae2

                        SHA256

                        0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                        SHA512

                        0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                      • C:\Users\Admin\AppData\Local\Temp\vbc533E.tmp

                        Filesize

                        684B

                        MD5

                        41857ef7e71c255abd4d5d2a9174e1a6

                        SHA1

                        95051d6ae43ff1bd9e5ebc95aa2e7b7c3165cb6c

                        SHA256

                        dfcdf12316f3b523895ec611d8e8d9fdc189ab8dde4e86fb962541aeac54e302

                        SHA512

                        ec6c5a7729d273be3ff194ffe47056731ab4100e298b7f50108a2599be59c84bd1953a90c4d7390c477257986a18d336d951f590b782f1aa983de7bd4c86e6ac

                      • C:\Users\Admin\AppData\Local\Temp\vbc53AC.tmp

                        Filesize

                        684B

                        MD5

                        453916f7e3952d736a473b0e2eea5430

                        SHA1

                        b79ccb2b555a81b8db470ec9fcaea26d42ef1c8b

                        SHA256

                        b0f8b94a35a12060c70e9f81641be22cbf1f1794c73260f48a2e6e46608623fe

                        SHA512

                        86d32a03cf04ef8640075c82e5fecb23034413a41b80b81c900a423b03f44589f774f68f83561465e7c9ce46512c818eef5a90e5ed9f7b3f86b592be34fa367f

                      • C:\Users\Admin\AppData\Local\Temp\vbc5476.tmp

                        Filesize

                        700B

                        MD5

                        6ed26221ebae0c285cdced27b4e4dbac

                        SHA1

                        452e9440a9c5b47a4f54aefdde36c08592e17a38

                        SHA256

                        aacdfb10fa949c74577bb1778fe2f3bab88b3e587c07cfffb003e059097e9e6c

                        SHA512

                        c604368a7b4adfbec5b6898c8880ea684bd085d967c1ebd087c9bed065fe3e2575c8298a9ccaa454d68496386667db998e2a04248dda2ab35905c8a9b1135cce

                      • C:\Users\Admin\AppData\Local\Temp\vbc5512.tmp

                        Filesize

                        748B

                        MD5

                        b548259248343e12d417d6c938cf8968

                        SHA1

                        19703c388a51a7ff81a3deb6a665212be2e6589a

                        SHA256

                        ab2ce0a14c78f836d2b134a37183b6d89a78b964ea5607940fa5d940d32a0366

                        SHA512

                        73a3902f000a042a448446f6851d6ad61a30bfdfed7d7903b5dad0f368ee43cd6da3b8ba817ac95be1a7427902aba0642af8ccddc4d442867465f1f1f5bf6f81

                      • C:\Users\Admin\AppData\Local\Temp\vbc5560.tmp

                        Filesize

                        676B

                        MD5

                        ba2c43095c1c82b8024e968d16bee036

                        SHA1

                        41ea006dbc9f0f6e80941d7547a980a1dde868e0

                        SHA256

                        1209067183104b41f03a5be0f377dc1865155cc84bdb509b871b7ce3366aae72

                        SHA512

                        00dc93cdb8c4cb0a681f99d24c59216a721bce963d76bad972e29cf92aafd74e4af46632c00f5aef4ce3160927db9df8aa9a8926ea4a5cb6974b499785569e61

                      • C:\Users\Admin\AppData\Local\Temp\vbc559F.tmp

                        Filesize

                        644B

                        MD5

                        dac60af34e6b37e2ce48ac2551aee4e7

                        SHA1

                        968c21d77c1f80b3e962d928c35893dbc8f12c09

                        SHA256

                        2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

                        SHA512

                        1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

                      • C:\Users\Admin\AppData\Local\Temp\vbc561C.tmp

                        Filesize

                        684B

                        MD5

                        7a707b422baa7ca0bc8883cbe68961e7

                        SHA1

                        addf3158670a318c3e8e6fdd6d560244b9e8860e

                        SHA256

                        453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

                        SHA512

                        81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

                      • C:\Users\Admin\AppData\Local\Temp\ypyqhhvv.0.vb

                        Filesize

                        269B

                        MD5

                        d8ec3923c7b4bf7ae4ba2dd32ba5174f

                        SHA1

                        bd232f852b5428b0360c9708604793deb513c36e

                        SHA256

                        316f5f33d99324745cbdad4dfe3ece93321e270a177f3646d78d72d1f7a1d648

                        SHA512

                        062694e7951b534e5c93d4d2e65c65cc59b9be7f3f1e469b1679d61e03f1770246222009461c6e2a8ddfe41fa367ed6ebd83f53e0a1c3f24db5e97932558ce11

                      • C:\Users\Admin\AppData\Local\Temp\ypyqhhvv.cmdline

                        Filesize

                        169B

                        MD5

                        fecde7c334913c7d8624de6f428d0ee0

                        SHA1

                        c2650a674189f3013743ff7d5b16e00238577f25

                        SHA256

                        dcf3d089cad705d1deb2a1d3502c5de515ac5baf9d1fbf6ae5de115e8e4141ee

                        SHA512

                        56387363dc3c31958701fecc9d755fb776981dcb28b804bdb803d5f866aa74fb9b537a196d7f234160d771ec36059b4f79d46d66da2ae710d13a03777bfe49af

                      • C:\Windows\System32\MSSCS.exe

                        Filesize

                        21KB

                        MD5

                        6fe3fb85216045fdf8186429c27458a7

                        SHA1

                        ef2c68d0b3edf3def5d90f1525fe87c2142e5710

                        SHA256

                        905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

                        SHA512

                        d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

                      • memory/1936-0-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

                        Filesize

                        4KB

                      • memory/1936-1-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/1936-3-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/1936-2-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/1936-12-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/2740-11-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/2740-13-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/2800-25-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

                        Filesize

                        2.9MB

                      • memory/2800-26-0x0000000002810000-0x0000000002818000-memory.dmp

                        Filesize

                        32KB