Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 18:03

General

  • Target

    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

  • Size

    21KB

  • MD5

    6fe3fb85216045fdf8186429c27458a7

  • SHA1

    ef2c68d0b3edf3def5d90f1525fe87c2142e5710

  • SHA256

    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

  • SHA512

    d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

  • SSDEEP

    384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • RevengeRat Executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Drops file in System32 directory 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
    "C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Windows\system32\MSSCS.exe
      "C:\Windows\system32\MSSCS.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:32
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-yrkmypm.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D3A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43335889C9674D778AE8C2602BA9E92E.TMP"
          4⤵
            PID:3492
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ugpsdaci.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3452
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E14.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc114C8F9558164FDABEDEF82E6EDE7229.TMP"
            4⤵
              PID:2316
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\clun-vd8.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4456
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EDF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc862FF5E915DA4938A3E6BDBEC8EA50E.TMP"
              4⤵
                PID:2068
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fjbjrlap.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1680
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F4D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDCEDCE7A1FF145A9A04194BB82A5C7.TMP"
                4⤵
                  PID:3104
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_yjl-yja.cmdline"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1896
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FBA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC0F271D59934C47BA8EAC406FE722C4.TMP"
                  4⤵
                    PID:4748
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iqelrd7v.cmdline"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3576
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8028.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDF5B67C25C1B44A5885FBEE0C26CCE8.TMP"
                    4⤵
                      PID:924
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d3uguhnj.cmdline"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:724
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8085.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7443DA153424266AB82D50A734B7C0.TMP"
                      4⤵
                        PID:2032
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u49ryubc.cmdline"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4160
                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8102.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc554A2D35D50F49FE9934E286FCCB7AB2.TMP"
                        4⤵
                          PID:4844
                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kfgmrvui.cmdline"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2396
                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8170.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE0F648E43FF64BCBBA53B5F3767C83E.TMP"
                          4⤵
                            PID:3984
                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rru3lgcy.cmdline"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3412
                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81ED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1D5BEE8CBD64FB5802D562E1675AF2.TMP"
                            4⤵
                              PID:4976

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\-yrkmypm.0.vb

                        Filesize

                        256B

                        MD5

                        076803692ac8c38d8ee02672a9d49778

                        SHA1

                        45d2287f33f3358661c3d6a884d2a526fc6a0a46

                        SHA256

                        5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3

                        SHA512

                        cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d

                      • C:\Users\Admin\AppData\Local\Temp\-yrkmypm.cmdline

                        Filesize

                        156B

                        MD5

                        5ef9584fd54ccd15c5cab733e071e9bc

                        SHA1

                        abaddf7b95e5124ccf5b3e626c2f7ec58fcaca26

                        SHA256

                        62f980a2a6ba2be397436fb3d327c4e0cee1a9eede7151fc9b97b54cab991a7c

                        SHA512

                        6c9c989ae63903dba973e3faf26a0fb98d42fe4c4c1a8f1739201d7e84634b3855176f38cb8d1a661a25681802a64e628b5addf9f0f32872589ceb7fee5933a6

                      • C:\Users\Admin\AppData\Local\Temp\RES7D3A.tmp

                        Filesize

                        1KB

                        MD5

                        96023c9915e2fe1f1554aed9c8fd5ba0

                        SHA1

                        23b7bca3b52a7236692de0484c2583e9dfe3c50f

                        SHA256

                        42b3a7b278cfad73f9fc8b5b48475b9488dd0bbc8dfbf7c53d10604257394b00

                        SHA512

                        aa3deb053c3aa2005d167326aa577dc00963ecfc7ea8e73c5ac1497f129cd7b813c2756b5bc069b589eaa29af5fe29c2272b5ee1f2284a2b37ae29e291c61990

                      • C:\Users\Admin\AppData\Local\Temp\RES7E14.tmp

                        Filesize

                        1KB

                        MD5

                        5cc54cd5655534165bd5bf01485c9f19

                        SHA1

                        9a4d16221c8c9f57bd3927b3c714e9e7f82d5c27

                        SHA256

                        b75d1ed495f064596be9d2b0a1babf14b8a6a465d0ab19a913a474dd5a2cfb0a

                        SHA512

                        9e1d7516f56e96745124de7cc660e4cf878772dac4584d53d31dfab54187625e190dd3e2e5620e87f1fa901b0b51ae3a6e65380cb29c1593a949dc1818be5ef6

                      • C:\Users\Admin\AppData\Local\Temp\RES7EDF.tmp

                        Filesize

                        1KB

                        MD5

                        e898a755200f7cf64e5088bd14e84c4d

                        SHA1

                        6853b7491bfa1650af0f2a78ac6492686e66d1d9

                        SHA256

                        5f363a22153146800dd85cecb85c651c43693aa4f4a7fa8ab886f701b626e95a

                        SHA512

                        5aa27f7ca9438e657dab1bd58f4aad37daba1a6e4030120ec3f90398034736c76a99b0510a8a59c57df7ffa9f806464daf3f0f12b0ad22c83cb3d6f41c740c62

                      • C:\Users\Admin\AppData\Local\Temp\RES7F4D.tmp

                        Filesize

                        1KB

                        MD5

                        eb34f93b96b4054071117935ddcb000b

                        SHA1

                        948107ab0a7f7caf46b925280a7d90ce9370f641

                        SHA256

                        00d4c17d91419824614a6aaf8cf8836c74f0bf8817cbefc5b123c1207ff874c6

                        SHA512

                        a83ab2277323cbea094ef790026c852ce09a72c843495c152513b979afc259055bda4541aa58a2f2473429246a2924459497fbab9a02e4acdf809abe67a66c27

                      • C:\Users\Admin\AppData\Local\Temp\RES7FBA.tmp

                        Filesize

                        1KB

                        MD5

                        7d72e937969d8f0ce7ffa5d3d9f4ee2a

                        SHA1

                        5e399c1470929efde753b43f4b5688bc36e38432

                        SHA256

                        25c02130d5157becd1fb0dec061f14034d0c7beca48fcf647511194fd326575a

                        SHA512

                        988b2b0ef5d985370f67487a113d1f7e472c3d4f489e1c8f39e07949d944a69ac10dd05d122810eb495a7e054cd9b6b9c1319f8b410808c388d4bbef65e9af87

                      • C:\Users\Admin\AppData\Local\Temp\RES8028.tmp

                        Filesize

                        1KB

                        MD5

                        061bd5d468a3c5d7ca79b23dcfd0dab0

                        SHA1

                        88667a8a299ac7f99eafaa8f8a7bd569beb76105

                        SHA256

                        be2282b1b640003cc38f659a8641273153edd1453ba5ab0967ac04c012d690eb

                        SHA512

                        625f5908e2ac0fcb76f54dcf4331e99553e2846108fa2c362ad49484ffcbb6806093fb938d383fccd401642991c701df976709390e204b32fffa59adb87e7092

                      • C:\Users\Admin\AppData\Local\Temp\RES8085.tmp

                        Filesize

                        1KB

                        MD5

                        fee6a7a0ec3210f8d349e475a76a26f9

                        SHA1

                        0ab8a515e80bc152ba92aaff2cd701eba23ecb5c

                        SHA256

                        6d431d9e35d63135a2d3df2e8ba5a90fd028e79b16d4dd331fc4edbdb84d42e3

                        SHA512

                        39fd934810e492af72ff56b12369c530199e5570b178c15a8a438c7c8b0711c75c9d6d0b886985e593f4ad248b904dfd58ccf54b2969e9c47412c68944dc65ac

                      • C:\Users\Admin\AppData\Local\Temp\RES8102.tmp

                        Filesize

                        1KB

                        MD5

                        a1c5dbb1a877ee4229e017476ef83c5e

                        SHA1

                        ad29fff98389747e3f8b325fda11cd4d121df562

                        SHA256

                        880cea1a6caed0160fd71e7b77261da4824579bbb021f7e2596a0e0813e1df32

                        SHA512

                        48cd380a77c6e73c487039185c5df50b9b53cf04ed34637d34f1fc1fdd969fc4aa3b78ba76904be1fa7589571e9c931230f1620a1c91ec522bf594332d0fcfa5

                      • C:\Users\Admin\AppData\Local\Temp\RES8170.tmp

                        Filesize

                        1KB

                        MD5

                        a529ec30961482409ce77064b5d5bd2f

                        SHA1

                        7628898079054a61f171f1d3288e5b2ae1d8ffe6

                        SHA256

                        55e335ae5f56fcc03e87132de0e9fa40cb2312295619ea9c467f99f06f3d0e6a

                        SHA512

                        57097e89a207fb5f398458699af010f286f435743f5ca1a6ff8982f70e5863d4fc836de10cb0e2d28ef4c4207187933c8ab3ac134d6a81b36633d0e89c60eb03

                      • C:\Users\Admin\AppData\Local\Temp\RES81ED.tmp

                        Filesize

                        1KB

                        MD5

                        7b68773a07b04952a13caa981f78e387

                        SHA1

                        8f029796d05aa7b5859579768430eadec4262c12

                        SHA256

                        3bf096e0bfe511fdfff90dd65176fa011d53fbab9a69a91a09f599462fbe8400

                        SHA512

                        beacc4b1312f005dc46b00bdf44052b5e5f8cd2383f44ecf6d74a2e5c9447019de2408391a6d66fcad36215dd3f57a8a1dce31a257eff50456f5f52a9c5c6169

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jgl5503k.gff.ps1

                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      • C:\Users\Admin\AppData\Local\Temp\_yjl-yja.0.vb

                        Filesize

                        272B

                        MD5

                        2b3aac520562a93ebef6a5905d4765c9

                        SHA1

                        10ab45c5d73934b16fac5e30bf22f17d3e0810c8

                        SHA256

                        b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89

                        SHA512

                        9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446

                      • C:\Users\Admin\AppData\Local\Temp\_yjl-yja.cmdline

                        Filesize

                        172B

                        MD5

                        a23bb515d3f83ad0f69b117298504a51

                        SHA1

                        06244347cbf5302bc503aefa348f5998dcf31c81

                        SHA256

                        4d964bd1b21fced4301afdd87577852bed1ac005a4ce8b6af657504c435c9079

                        SHA512

                        fda5ced3e9bb4ddda52450b78d3eed3c3fbeae359d8ca5ca4fdb2dbb7dbcdd9a0214c9df6581d1da378cabfa942bfa978622726bdbd98991f100beb854a1c12a

                      • C:\Users\Admin\AppData\Local\Temp\clun-vd8.0.vb

                        Filesize

                        263B

                        MD5

                        d1110a95f1e40f726584bd99eca52fe7

                        SHA1

                        97fac683e1116ab31a9cc9c3dcfd9fe9e53505c3

                        SHA256

                        00f373eb310beace70146b6e0fd188aa2f437efb2e5a2714a11d4d58e27d3142

                        SHA512

                        f15b5b310ace82a0106b551d71ad3d48e1c75085aa78b8bb3374a2334ceb073bd4d1bf4cd0b4e39034c39f01b6bcd76e8be30198e4872f5641a7d29b255154b4

                      • C:\Users\Admin\AppData\Local\Temp\clun-vd8.cmdline

                        Filesize

                        163B

                        MD5

                        3ac7b4ef44cbb04f56d489caf2e14829

                        SHA1

                        1b5f11457ac81f45fd181e262c1999f13109ce42

                        SHA256

                        5f4b9d89c4dfa3f9194060dd990d18a91a299cbfb9402b48d3290713360316c5

                        SHA512

                        36e55db2ab4a278bbcedfe9251087fb8abd31fb4a64a5c1f00290f9e7b1e12019cb5d120566ad39616273a656e6d28df97fb358b6b2037226d474cb34b1834a4

                      • C:\Users\Admin\AppData\Local\Temp\d3uguhnj.0.vb

                        Filesize

                        274B

                        MD5

                        539683c4ca4ee4dc46b412c5651f20f5

                        SHA1

                        564f25837ce382f1534b088cf2ca1b8c4b078aed

                        SHA256

                        ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e

                        SHA512

                        df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac

                      • C:\Users\Admin\AppData\Local\Temp\d3uguhnj.cmdline

                        Filesize

                        174B

                        MD5

                        9d7316365a868c17b039a9bfaf748657

                        SHA1

                        c20ecabb410de1caa1cbbdf7c1e2eb1887937711

                        SHA256

                        5c667a2ad7c20bc7061153758f7081387679c33192f843a382ddb6e49f967c9e

                        SHA512

                        18e978cd52ecf7c81f818db199bc076955de8ddb21733d17d28bdefe6682c9efd3b88afcba2b694c9bc3f174ba3d41af70b9e1aa73fc637d2fdbd7046b8bdabe

                      • C:\Users\Admin\AppData\Local\Temp\fjbjrlap.0.vb

                        Filesize

                        271B

                        MD5

                        ac972015bef75b540eb33503d6e28cc2

                        SHA1

                        5c1d09fcf4c719711532dcfd0544dfc6f2b90260

                        SHA256

                        fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7

                        SHA512

                        36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83

                      • C:\Users\Admin\AppData\Local\Temp\fjbjrlap.cmdline

                        Filesize

                        171B

                        MD5

                        2518caf15cfea0ae2907c16aab04dea5

                        SHA1

                        910cb65ca4112cefbee79128531e0bd43207351e

                        SHA256

                        7821818fe1ec4985758c88f66bb2d4bebb945933983f6fa8bf3d0d67ea3d8520

                        SHA512

                        7c8988976fe0b2422590b12b005efb896d103fe3527ee21f4d73fd8252d473093db8314b26533799616742dc700b58905babaff4e89ff488c480be19ef12907b

                      • C:\Users\Admin\AppData\Local\Temp\iqelrd7v.0.vb

                        Filesize

                        271B

                        MD5

                        325f27ef75bebe8b3f80680add1943d3

                        SHA1

                        1c48e211258f8887946afb063e9315b7609b4ee3

                        SHA256

                        034c75813491d628a1a740b45888fc0c301b915456aaa7ba6433b4f1368cda35

                        SHA512

                        e2165b425558872897990953c26e48776f45751a53da035f1ad86ac062ec23a2923b984d84f992de5c0170f6e192feb155ffff25f51bc76ab273b996daacb804

                      • C:\Users\Admin\AppData\Local\Temp\iqelrd7v.cmdline

                        Filesize

                        171B

                        MD5

                        eae47aebbaa61c952f0a3b74f6d9edd5

                        SHA1

                        0d2f9ebebf08ddf0260d2e3d0642c691a11ead9c

                        SHA256

                        ad9733377818c9130b747d450ddf55d0c4d31a84eb1a972208e06db6fbd5976d

                        SHA512

                        88b7fc7f75a2007cd4206ef511e278b83a900675bc2d13150b828078aa036fa54db0faf1612885d4e0ff15664836ad00d2a067cc6c161542b0f83c09b244b01d

                      • C:\Users\Admin\AppData\Local\Temp\kfgmrvui.0.vb

                        Filesize

                        270B

                        MD5

                        658573fde2bebc77c740da7ddaa4634b

                        SHA1

                        073da76c50b4033fcfdfb37ba6176afd77b0ea55

                        SHA256

                        c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607

                        SHA512

                        f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf

                      • C:\Users\Admin\AppData\Local\Temp\kfgmrvui.cmdline

                        Filesize

                        170B

                        MD5

                        e490079d1802271d5ceab69bddb087e7

                        SHA1

                        83ca6fc633e58dda1cb709e598e76da0239caa30

                        SHA256

                        9ab6ea5e6906f005a3299f9c678fabaee7c8e2aa044b0a36fe8ef355e5b545d3

                        SHA512

                        5c6bccd53a4601ec8f381f3982150ece39d30497df589ba39093bcc3b97cb96e1505a3783b9da13f566f3367b897a4068ff4cb7fb997789a4a41b1f8459bef35

                      • C:\Users\Admin\AppData\Local\Temp\rru3lgcy.0.vb

                        Filesize

                        273B

                        MD5

                        3c3d3136aa9f1b87290839a1d26ad07a

                        SHA1

                        005a23a138be5d7a98bdd4a6cc7fab8bdca962f4

                        SHA256

                        5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd

                        SHA512

                        fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60

                      • C:\Users\Admin\AppData\Local\Temp\rru3lgcy.cmdline

                        Filesize

                        173B

                        MD5

                        d04679684ae763c3714f77c4b3d41a13

                        SHA1

                        8b6a6f730f6aa9351201a3e598b9cb09ec817096

                        SHA256

                        ad463687bdf8c5245441f3adfbbcfebd83640a25cc84da783367a97943757231

                        SHA512

                        80bdbfcd46d47e88858ffabe95f0f06214f880071e679fbc873490fbd2e02a6fd474e5eb9e30e23894b1d45e10f38c5b91e263f9b810ab8153af68962d7df3ec

                      • C:\Users\Admin\AppData\Local\Temp\u49ryubc.0.vb

                        Filesize

                        264B

                        MD5

                        5ce3977a153152978fa71f8aa96909e9

                        SHA1

                        52af143c553c92afc257f0e0d556908eaa8919cb

                        SHA256

                        e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed

                        SHA512

                        eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77

                      • C:\Users\Admin\AppData\Local\Temp\u49ryubc.cmdline

                        Filesize

                        164B

                        MD5

                        71ca43348426a69d37c3b05b986a8e95

                        SHA1

                        7bd9ee0a955105de6631de6a980deb7a7c956009

                        SHA256

                        30153b3a400d3c293918be70fea29c54eb187eadc2b9a86926a9b7c09815a2fd

                        SHA512

                        3b0ae0d80e9ffee5eb75ab3d160623cfd80452e9e679409572a51c2536145e04f6ce4940df73d70fe359c5dcdf8db2a2bb0b3fafc640300f148b72b8b9c0236a

                      • C:\Users\Admin\AppData\Local\Temp\ugpsdaci.0.vb

                        Filesize

                        262B

                        MD5

                        88cc385da858aaa7057b54eaeb0df718

                        SHA1

                        b108224d4686b5ca3faaeb1c728dfba8740a6eca

                        SHA256

                        08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020

                        SHA512

                        4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7

                      • C:\Users\Admin\AppData\Local\Temp\ugpsdaci.cmdline

                        Filesize

                        162B

                        MD5

                        d9a01b5e2d8427b87136106eb46fe1c7

                        SHA1

                        60ea6fbf4efff009928969eb628594bf0a235e91

                        SHA256

                        ce79970288ad5f44c6399f5b10f847ef03765021cdbc952a3a94e385864f7e7e

                        SHA512

                        d303ed38624be1a14107732002efc6407463fd2e6eadd99af9e601dba8311097ede3455c4fe10ccdef99c77f17e4d21ff0f42c2089d7aacc68c69a77581f4810

                      • C:\Users\Admin\AppData\Local\Temp\vbc114C8F9558164FDABEDEF82E6EDE7229.TMP

                        Filesize

                        668B

                        MD5

                        3906bddee0286f09007add3cffcaa5d5

                        SHA1

                        0e7ec4da19db060ab3c90b19070d39699561aae2

                        SHA256

                        0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                        SHA512

                        0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                      • C:\Users\Admin\AppData\Local\Temp\vbc1D5BEE8CBD64FB5802D562E1675AF2.TMP

                        Filesize

                        684B

                        MD5

                        7a707b422baa7ca0bc8883cbe68961e7

                        SHA1

                        addf3158670a318c3e8e6fdd6d560244b9e8860e

                        SHA256

                        453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

                        SHA512

                        81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

                      • C:\Users\Admin\AppData\Local\Temp\vbc43335889C9674D778AE8C2602BA9E92E.TMP

                        Filesize

                        644B

                        MD5

                        dac60af34e6b37e2ce48ac2551aee4e7

                        SHA1

                        968c21d77c1f80b3e962d928c35893dbc8f12c09

                        SHA256

                        2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

                        SHA512

                        1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

                      • C:\Users\Admin\AppData\Local\Temp\vbc7443DA153424266AB82D50A734B7C0.TMP

                        Filesize

                        684B

                        MD5

                        8135713eeb0cf1521c80ad8f3e7aad22

                        SHA1

                        1628969dc6256816b2ab9b1c0163fcff0971c154

                        SHA256

                        e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

                        SHA512

                        a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

                      • C:\Users\Admin\AppData\Local\Temp\vbc862FF5E915DA4938A3E6BDBEC8EA50E.TMP

                        Filesize

                        676B

                        MD5

                        85c61c03055878407f9433e0cc278eb7

                        SHA1

                        15a60f1519aefb81cb63c5993400dd7d31b1202f

                        SHA256

                        f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

                        SHA512

                        7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

                      • C:\Windows\System32\MSSCS.exe

                        Filesize

                        21KB

                        MD5

                        6fe3fb85216045fdf8186429c27458a7

                        SHA1

                        ef2c68d0b3edf3def5d90f1525fe87c2142e5710

                        SHA256

                        905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

                        SHA512

                        d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

                      • memory/32-39-0x00000188B7530000-0x00000188B7552000-memory.dmp

                        Filesize

                        136KB

                      • memory/1892-18-0x00007FFE70590000-0x00007FFE70F31000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/1892-17-0x00007FFE70590000-0x00007FFE70F31000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/1892-21-0x00007FFE70590000-0x00007FFE70F31000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/4508-5-0x00007FFE70590000-0x00007FFE70F31000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/4508-4-0x000000001C420000-0x000000001C482000-memory.dmp

                        Filesize

                        392KB

                      • memory/4508-0-0x00007FFE70845000-0x00007FFE70846000-memory.dmp

                        Filesize

                        4KB

                      • memory/4508-6-0x000000001CC80000-0x000000001CD1C000-memory.dmp

                        Filesize

                        624KB

                      • memory/4508-3-0x00007FFE70590000-0x00007FFE70F31000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/4508-7-0x00007FFE70845000-0x00007FFE70846000-memory.dmp

                        Filesize

                        4KB

                      • memory/4508-8-0x00007FFE70590000-0x00007FFE70F31000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/4508-2-0x000000001C2B0000-0x000000001C356000-memory.dmp

                        Filesize

                        664KB

                      • memory/4508-20-0x00007FFE70590000-0x00007FFE70F31000-memory.dmp

                        Filesize

                        9.6MB

                      • memory/4508-1-0x000000001BD30000-0x000000001C1FE000-memory.dmp

                        Filesize

                        4.8MB