Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    29-07-2024 02:47

General

  • Target

    6663483929f325b3fe2f8a351787aebf.exe

  • Size

    5.0MB

  • MD5

    6663483929f325b3fe2f8a351787aebf

  • SHA1

    eaef70212f2f361a3167340d7c76e07246f1e427

  • SHA256

    cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

  • SHA512

    12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

  • SSDEEP

    3072:iEQ5B9LypBTl57/zzTx+feymDt9SYzOP+:iupBvLzTIf4Df7zOP+

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.eu.ngrok.io:8848

Mutex

RV_MUTEX

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6663483929f325b3fe2f8a351787aebf.exe
    "C:\Users\Admin\AppData\Local\Temp\6663483929f325b3fe2f8a351787aebf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        3⤵
          PID:2720
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mxl0ello.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAF3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFAF2.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1396
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9h338zb_.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:808
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC1B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC1A.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2996
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\csihgfwb.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1580
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD63.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFD62.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2896
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9dgzgivi.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2092
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE4D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFE3C.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1752
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gdjqrrbs.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2272
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF08.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFF07.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2180
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b56vijqi.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2248
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFC3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFFB3.tmp"
            4⤵
              PID:988
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t8wlc2jf.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2584
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAC.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2892
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sgjulejf.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1736
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES243.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc242.tmp"
              4⤵
                PID:1880
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\baws217c.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1472
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc34B.tmp"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1012
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qu4_ayd1.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2136
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES475.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc464.tmp"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1576
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zuas6fxt.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:688
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc56D.tmp"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1428
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xqtxeq4u.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2284
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc619.tmp"
                4⤵
                  PID:1520
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ng7d7khr.cmdline"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2812
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES742.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc732.tmp"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2612
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qo7kmsy7.cmdline"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2792
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc80C.tmp"
                  4⤵
                    PID:2968
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h-imw-mh.cmdline"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2600
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES945.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc944.tmp"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2456
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oklregjj.cmdline"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1492
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA10.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA0F.tmp"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2264
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\srkfypk-.cmdline"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1788
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB09.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB08.tmp"
                    4⤵
                      PID:2484
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bbjaeiti.cmdline"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:264
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCAF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCAE.tmp"
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2504
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wku7ow2m.cmdline"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3024
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD4A.tmp"
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3008
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g-oyipdt.cmdline"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2340
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE73.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE72.tmp"
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1572
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qlpl0hmf.cmdline"
                    3⤵
                      PID:2916
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF5D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF5C.tmp"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:648
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3y_xlqfy.cmdline"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:912
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1037.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1036.tmp"
                        4⤵
                          PID:2980
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qdz4zb4g.cmdline"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2520
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1102.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1101.tmp"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2440
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\odfol4hf.cmdline"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2088
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES116F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc116E.tmp"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2280
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iz7gqoji.cmdline"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2248
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES122B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc122A.tmp"
                          4⤵
                            PID:448
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:884
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                            4⤵
                            • Drops startup file
                            • Adds Run key to start application
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1884
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1736
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k8vznyps.cmdline"
                              5⤵
                              • Drops startup file
                              • System Location Discovery: System Language Discovery
                              PID:1844
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABAB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcABAA.tmp"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:2732
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /sc minute /mo 1 /tn "Client" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:1868
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0rfz0u7t.cmdline"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:2196
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC28.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAC27.tmp"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:2120
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x-4wdsbj.cmdline"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:2848
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACA5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcACA4.tmp"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:2616
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\njmknxzj.cmdline"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1252
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD22.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAD21.tmp"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:2664
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-rxonmpp.cmdline"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:2568
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADBE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcADBD.tmp"
                                6⤵
                                  PID:1592
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fklj0wb-.cmdline"
                                5⤵
                                  PID:2388
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE69.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAE68.tmp"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2564
                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q_f98jso.cmdline"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2876
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF15.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAF14.tmp"
                                    6⤵
                                      PID:2988
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\26cbq13s.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3024
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFB1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAFB0.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3000
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sljfch2v.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:848
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB06C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB06B.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1932
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dojewcoe.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2900
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB146.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB145.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:484
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9tmipog5.cmdline"
                                    5⤵
                                      PID:2588
                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1E2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB1E1.tmp"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2372
                            • C:\Windows\system32\taskeng.exe
                              taskeng.exe {F75C3B47-4E4A-4C63-9914-14113B25896F} S-1-5-21-3450744190-3404161390-554719085-1000:PDIZKVQX\Admin:Interactive:[1]
                              1⤵
                                PID:884

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Index\vcredist2010_x64.log-MSI_vc_red.msi.ico

                                Filesize

                                4KB

                                MD5

                                c398ae0c9782f218c0068cd155cb676c

                                SHA1

                                7c5bb00a34d55518a401cd3c60c8821ed58eb433

                                SHA256

                                9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3

                                SHA512

                                85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

                              • C:\ProgramData\Index\vcredist2010_x64.log.ico

                                Filesize

                                4KB

                                MD5

                                cef770e695edef796b197ce9b5842167

                                SHA1

                                b0ef9613270fe46cd789134c332b622e1fbf505b

                                SHA256

                                a14f7534dcd9eac876831c5c1416cee3ab0f9027cf20185c1c9965df91dea063

                                SHA512

                                95c7392ffcf91eaa02c41c70a577f9f66aff4e6a83e4d0c80dbd3a2725f89f90de7ab6484497bf6e0a0802fd8ced042647b67c5ea4bee09e1b2be30b0db1f12f

                              • C:\Users\Admin\AppData\Local\Temp\9dgzgivi.0.vb

                                Filesize

                                350B

                                MD5

                                55baa1a9cc195fdeb239fd42886466ed

                                SHA1

                                21d56bd00b7bdefb6fd1f2735f2249cde0812132

                                SHA256

                                483fae1036126f05605dff2447307d8e840ff775f5cf7574fb5b0256beb95766

                                SHA512

                                8dc014a020e6ecda766b1f58928b1d10a20c5ea2e3973e94d8c339ea772044e3898004b753b9ff4020b436c543206f4ab46468b789d08466136baf0812e81daf

                              • C:\Users\Admin\AppData\Local\Temp\9dgzgivi.cmdline

                                Filesize

                                222B

                                MD5

                                33fb15459c00baa28c02d50a526480bd

                                SHA1

                                24d7070077dc9ce27780735a5d55c0eeba799c00

                                SHA256

                                d5c99a00ccaf03d931ec370e4da4e965862bd23cd5a58b66c5d3cd040e8d395e

                                SHA512

                                6bc1297717fc1c92fb759d6d4f524ff966504aff8f1fb8d4c76a2e291a26781f6c9a3f227b5c21319bde8d6d6bc569bc5b4765fa8b72256e2543276b8fbc26f1

                              • C:\Users\Admin\AppData\Local\Temp\9h338zb_.0.vb

                                Filesize

                                350B

                                MD5

                                3fa7c020766873f8b58d109177c7d7a1

                                SHA1

                                716be689ba29ba1493a617920c24fa6ef036ed5d

                                SHA256

                                dfcfb090d3b80c08c34aa55028773778a8a745c2eef48d8c572b043fb421e3e7

                                SHA512

                                1657d79d5bd7768984df780f71e9609c69fa58c7370eb5ee8122c97daf1a2c47fb0217f3f69e07f8fd0c51c8f8e078a00f8275eed3bbb02ec23ba092c47ec196

                              • C:\Users\Admin\AppData\Local\Temp\9h338zb_.cmdline

                                Filesize

                                222B

                                MD5

                                f3cdf08c7dc4cdf5f1c4a3a34ac196d4

                                SHA1

                                c55e90c6d96ce425c8331c8e62ff61cea9f39678

                                SHA256

                                02ee305716ce6dfff84b56d7b7f765d521f0a22ddc04d6caeb6c3f650b20d877

                                SHA512

                                c99d08dcb68156b9b7e7273e36dcef4c1d5d07210374103b97f9d28e6542235bb33cb1ffc5826b6a77d441edc70a086f0af7ffa3c3cdf2ec4461eb282e6e51b5

                              • C:\Users\Admin\AppData\Local\Temp\RES243.tmp

                                Filesize

                                5KB

                                MD5

                                a54f02d7382bff4e952f9fd38e178a2c

                                SHA1

                                3e1dcaf1c6cce2c40578eb1e6808e7da794a2839

                                SHA256

                                45c8299a6ed3625d77e592a079ab5a487e0aa70af1568a3d9869aced5e037c59

                                SHA512

                                66141e2da2d5284b572194aa89104411ef80b3789d57b2ac713921768129602e909350a2e52095eab8d29c642c94d0c504491fbd53badd43d740e84976b23699

                              • C:\Users\Admin\AppData\Local\Temp\RES34C.tmp

                                Filesize

                                5KB

                                MD5

                                a2b43770abb02db2c44f1b944aee65a4

                                SHA1

                                3d688b9430e6c84c210ba22dad925b550049b1c2

                                SHA256

                                3cde4b5f1586b60546aad0c3d9cea3ed40b418dd5459cee25e5b3ce34292eacd

                                SHA512

                                5a881a54966fef02d1d21cbb2de136d738feda1673828a4c08ae7774cf142170a7c85f268ee20604ceef019fcad157f69f879ea37ed3f51cfa223d0e75c08713

                              • C:\Users\Admin\AppData\Local\Temp\RES475.tmp

                                Filesize

                                5KB

                                MD5

                                a4987b0e385f10434c9e5a187eea8f93

                                SHA1

                                773f5fd1af90debc6b7c9ee17ed43196555f039b

                                SHA256

                                e0f53e2b47b9fa36fa96b77c79d1035154375d19ef863e7166dbf1182a745b23

                                SHA512

                                24b5fab08cb6bfd7ec3b1f665d5c5f6597bdb03bd39ebc718f0e136c67bcaf2687b4ac4b79490da2baaf8a07137272c1f12474be5fbb76511c5eb34d00e8032e

                              • C:\Users\Admin\AppData\Local\Temp\RES56E.tmp

                                Filesize

                                5KB

                                MD5

                                16386aa92e597fa9af0d1bf2c5615bb4

                                SHA1

                                72a49771961ff16b05944b21da8c8d57941d742b

                                SHA256

                                8d885ee8fd3863ac92547ca66a0c4510a7ad1b37de46676da2f818d8ebbc4dbb

                                SHA512

                                480d774956c7d36b4381cfdcc888bb5f6eb6d3c9e9c9a64168c7c03339b13a3892f9f274a26fd9c2a8dde73628b8a50cd4978cce384896534a8212e3f925be01

                              • C:\Users\Admin\AppData\Local\Temp\RES61A.tmp

                                Filesize

                                5KB

                                MD5

                                bc6eaa42a582a9b25d0ffba56820e9dc

                                SHA1

                                8c904c785a8db2f8086fd022cc2906ce3ce4c53e

                                SHA256

                                68a9d2be4eaaf29f8a90cf1b8775096bea6588f978f939e24214552007784889

                                SHA512

                                266edadd5c1e37727ce5ea924d48c54ad43e70ea7f7e68d3b173ba425c22dfa666226b56cdd6e2d10fe5b4f254da8f7b4547fddacd957901bedd7aad532fe571

                              • C:\Users\Admin\AppData\Local\Temp\RESAD.tmp

                                Filesize

                                5KB

                                MD5

                                f6b8e95fb6c638bd89f0a58521aa8048

                                SHA1

                                4b7f9bb6ef5deaa09c355330264dcc9667d7f203

                                SHA256

                                76db967eed7db4dbfa959a41ab89846a834f8439784e9be2bc885a94a4da5b00

                                SHA512

                                8f69317d5dfe3c6445074fc1e7504e4f9464af2020291808eaee3edd5c954f8e7a23cebe62dccbcd6c949775ae2cecfef948caa4c45b498e182eabb88539e8ed

                              • C:\Users\Admin\AppData\Local\Temp\RESFAF3.tmp

                                Filesize

                                5KB

                                MD5

                                6155d6c0e7db9ff1b28ea8c91dce1cf8

                                SHA1

                                ef929e2b64c0c8c62234e118ddb2e41599a462c9

                                SHA256

                                8f3139d2ae7f993f0850158b68351f413e82ae864fe21c38ae35501160819491

                                SHA512

                                b979900a014c8b742de2cb71629b11bbe8b8ac3dc975a810b06ef61a819352ca0d1e0cdba466b9be16468c4874901ecd325918d5a4975d28aecb1f92e0d5b87c

                              • C:\Users\Admin\AppData\Local\Temp\RESFC1B.tmp

                                Filesize

                                5KB

                                MD5

                                53ff4e090a4d71c0bde80f272a0fc38e

                                SHA1

                                f127fee37c4f480b03a4ad60b98803a836401a2c

                                SHA256

                                90500e5e9c217951c049389ea270f19d443ea18cafdc57c5e2cebed3d3d0245d

                                SHA512

                                0c2838119cec14733ff81c981159c42d595b6c065804e229678a65910d577ff1441e3c12b3b849b536d0ce7366602384ee69f2a1fdd8b2a8d0247fa2d514dbbf

                              • C:\Users\Admin\AppData\Local\Temp\RESFD63.tmp

                                Filesize

                                5KB

                                MD5

                                1761fe2c1661404a362b703f476753b1

                                SHA1

                                d06d982c4423a423d1ce0b65b1e4d316a5b16990

                                SHA256

                                d561b836e71e1d85ba147b67e9b6fb68fce9905d7e9d26de1c0b24fd12d3767e

                                SHA512

                                57dff52863d825417654aaf29a7016d374765348b8fdaf792001a6d5ba7f50ff7b4970b942b6d465c4c2089dbbb6365c9b423a18b7f93d000c0fa981993d5c1c

                              • C:\Users\Admin\AppData\Local\Temp\RESFE4D.tmp

                                Filesize

                                5KB

                                MD5

                                a25394cc0164145bded4cd7c5607fd5f

                                SHA1

                                b4ad41c2e16ee684ae133fdb097323128ca9306d

                                SHA256

                                467d8392387358793f48e1a0f580cf899609c4669b7c1aefdeb088bbc354c87a

                                SHA512

                                4ca6c94214d4a6abf6658113946e92c1e186ada9d67f5f61d908ca3e97a14e1555bf3c357c330bcf2b69de87b674e1b15e0773820e10b8a98b71b1a277c5ba5d

                              • C:\Users\Admin\AppData\Local\Temp\RESFF08.tmp

                                Filesize

                                5KB

                                MD5

                                746bf802ba52b6f7a2499bb92413f053

                                SHA1

                                5ce4cbde59ec51f7d3c43cc7860750231bf481a3

                                SHA256

                                f1cfeffcb36ef64417e401f43e33af26e9adba9eaf8f8f3432bf3e592704c90a

                                SHA512

                                e646fadf8cce89fbc1f2e56405dc196d0ede49a6f3cdfb5823b9d0fc87e93f0424b666b7edd3e0ba557ab72faf0d11f74a78940d454b2c940afb4d01fc54113b

                              • C:\Users\Admin\AppData\Local\Temp\RESFFC3.tmp

                                Filesize

                                5KB

                                MD5

                                5736e9f45f0d9cd9ec3c3d4efb757f62

                                SHA1

                                f250d2ae8316bdcd93ad92e360f1e1832332e080

                                SHA256

                                5e6a122d317e6bf1dc8b72166972d201f820f4764402243dcbdb06d0448361fd

                                SHA512

                                3015c6db54782b04e52f2da54982449d9a3f9b0939eb0b970cd76a3f74aeb46afc3d89858b258cc48719e1cb56542508103a4be6af078ced385f7f93464b9546

                              • C:\Users\Admin\AppData\Local\Temp\b56vijqi.0.vb

                                Filesize

                                371B

                                MD5

                                846365ec5052d6dabd406c35fb9393cd

                                SHA1

                                9abf408ca3938f0acbfc6eab9fccd33b4cfc43b0

                                SHA256

                                f1c039830bf9f701f465510cf16ae094214fcfc23a3c311adee9e6f4c18851b3

                                SHA512

                                cf3a29a98a1a53982bd6afbc8dc61b954c26138f9b85473b8a3297ca7ee3c3b782a3b6edde8b0dbbe406bd26e52d72c40a0c1d58dbdfb40c8f9e461bd6542b2d

                              • C:\Users\Admin\AppData\Local\Temp\b56vijqi.cmdline

                                Filesize

                                265B

                                MD5

                                30e002c86879f6369bc1abadaaa45c6f

                                SHA1

                                26358fb2f28a4343d9a27d16f7382ee09c8ff67f

                                SHA256

                                86d331282881ad96e2ed8c61f5ef258e069617d3f9fe2d65ea0bb7a848a6b213

                                SHA512

                                e6a7f25fe59bd001de090cb06f6e7e85f6ae58d360db49fbc16521d4dce49a9fb9df920a25aeb270ff605074bcc6b4bc8ced40341b4f1409531331a9acfd310c

                              • C:\Users\Admin\AppData\Local\Temp\baws217c.0.vb

                                Filesize

                                345B

                                MD5

                                1f417cddc94c64fd41d1b03233e3d717

                                SHA1

                                a975afc240e01942f2cb9291b330a54978478676

                                SHA256

                                f357af7974b441bd08fa7681276f3881b79a707bf06473cf3ed83e6fdcfb7dc6

                                SHA512

                                1cecfcda35fd60e407d990523c09c082426e692b8967588b4c5d7a8e8b62cd19dcb5aa1a9b0f1a648d578506009bccda57b4748fa4698922d001cf8dafb7de92

                              • C:\Users\Admin\AppData\Local\Temp\baws217c.cmdline

                                Filesize

                                213B

                                MD5

                                5c6f8a0cfa8dd6564bfef3b66d403158

                                SHA1

                                c811c3c19db9e10924ba76f09a4b487eb465b44d

                                SHA256

                                06f308ad985d95dcaf59435980281456cbecf1565e8be6fe80756b6101e37463

                                SHA512

                                9a26bcdcb81ccfb3660432ad3732ba043e35175c68b4524c0f2c94fbc23edbb61c6520fc4f3f695af7bd7fb49552b44a04e2b2432adf77a8435dd123dd59e9eb

                              • C:\Users\Admin\AppData\Local\Temp\csihgfwb.0.vb

                                Filesize

                                364B

                                MD5

                                a44396dac48f30ef8c8608531567fb83

                                SHA1

                                905391559e0577fbc6cefd0d13eb10f9dbcd63c3

                                SHA256

                                1ba098682cded71da604d1c99018e43622cf0bd8a609c0c6e2752e9ff1944b4f

                                SHA512

                                168ef2aa0bcc07f4e1a1f6652c8d459cd6c3c31ee579702e06977733da856419c9ebd1f2da06fdd185655dc464cd40183ddb32cfe0e960bc6104c64fdc9976fc

                              • C:\Users\Admin\AppData\Local\Temp\csihgfwb.cmdline

                                Filesize

                                251B

                                MD5

                                ac82fbf0702050eb86b8590929219bed

                                SHA1

                                29030b44df8b3ecfc59f91f3c57e236e484ce269

                                SHA256

                                c5ba14845e5b7763407dc482266a0a384e792e9e7b6fcd0ad1335c4664463554

                                SHA512

                                bfe90539ef9b0c0f98c07f2a04a5290c65235fb0f0b048f7430e4a02fac86881a3da5a5d4fb60877b8f2ed69ad60e23107e361b3f6dd623370242b406f512fc1

                              • C:\Users\Admin\AppData\Local\Temp\gdjqrrbs.0.vb

                                Filesize

                                368B

                                MD5

                                4a447b73c91023eb6c863a34742dbfdd

                                SHA1

                                68fbb85cab50aaeaa9abedff254efba01892310a

                                SHA256

                                b9d69dba98cd1d12c4a0ed06def7734936270924cb3847807f6f04f3d0fac242

                                SHA512

                                dfc531d34abadc872b5db88a087784181970d8cb5b958fe979e431dd2bd135c6699c738a61e26e7fd9674af90449fbcbf810b42e765b0add5d9d66ad6e83299d

                              • C:\Users\Admin\AppData\Local\Temp\gdjqrrbs.cmdline

                                Filesize

                                259B

                                MD5

                                c6d23542b873da09470559d598239404

                                SHA1

                                9369a6f8f46787e4cb34d7d676247c19dc3628cf

                                SHA256

                                32cc1acf806c67598865922fc33ba1c27cc6b1ce5443749af0915593bf3dea5a

                                SHA512

                                0986b2fd65831257ecb883003370184f05c051696fc957774f39f9d6e80b255b82897cd384289dd0704028d4c53b830b5e4ef5fec0ca9a498158d894794e740d

                              • C:\Users\Admin\AppData\Local\Temp\mxl0ello.0.vb

                                Filesize

                                364B

                                MD5

                                3c88d0389da097789f854d19e5a6851c

                                SHA1

                                9e0f6bb3a576bb0eaf7fa1384018e57b50401adf

                                SHA256

                                b0c7beac256055e2a91713ef20ab4bc9eb5785e2a7cd30f64ab95fe37ff4d60c

                                SHA512

                                92799b8e42dd602cb9686820bc75136e26f2f356a731c23e3a3c5d9f65ff0b2325666aebd1f34f4ebf240eb047a11e9a37751f3fa3e30264738e6c113f8d9ead

                              • C:\Users\Admin\AppData\Local\Temp\mxl0ello.cmdline

                                Filesize

                                251B

                                MD5

                                f89f170abb133de528bcc0aa5aad6f18

                                SHA1

                                f848f36b176395defeb912e92b05b028dbd8541f

                                SHA256

                                8ae79a59ab41bb3057be1936a801d7b275fbad651a6153b06b8b210ed95d3459

                                SHA512

                                8957ef72d2c314c79955c232a61b554bd484ec69135e45d5e962c1a8f8d7016e1a220f76ff22c9f7c32b843bf7b42b0d01caf11cfddb5d3840ed5a9f40deccd5

                              • C:\Users\Admin\AppData\Local\Temp\ng7d7khr.0.vb

                                Filesize

                                373B

                                MD5

                                adaa061d082a7b86bc1f959594a01eff

                                SHA1

                                9398852f8cfe36144a64ccded6b7775acdce59a9

                                SHA256

                                99391f66edd6bcddcc4c1f156572f4d193538b6e42793cf0694c97f02d6efc9c

                                SHA512

                                fc51f77ad8634b2a7512b76eac8cea3be9e04c5ff59b1fdedb6c0e99c71b7d4a5128b6f72fb217a8e7925371b98e0c94bc228c504125ae08cd3bb9daa26e6186

                              • C:\Users\Admin\AppData\Local\Temp\ng7d7khr.cmdline

                                Filesize

                                269B

                                MD5

                                da3a1d923cbdfd7f8312c025d312b737

                                SHA1

                                040c5ea1d41d47a55e863d385e57ee7989c15afb

                                SHA256

                                7bb17e5cfaf83ae220c9aa7f15ff1b6d5f6fe7834cddbae4cee1f10fd1fa4a33

                                SHA512

                                cd8f37d04e93076ca4255df9356cd8433be99fab856843f67353ba1009cc4f8d5e58f5d437ccd311d3756db1da05cab4b9f29b03483f8e366f53d38a90a5be44

                              • C:\Users\Admin\AppData\Local\Temp\qu4_ayd1.0.vb

                                Filesize

                                370B

                                MD5

                                31fc52bfcb5cf9a12d52b79c7dceaf11

                                SHA1

                                ec19379305a8404d3c86adb65782467d1c9c3b38

                                SHA256

                                2b2c31fe62190c52b62ece3e29a19af2309832922d627abd7b2900eab548c19e

                                SHA512

                                38679030edebf6272eb04b0ef9b0b432eef26b23e7c6a517518db3a15ba40bd33eba33835a5cafba2a9fbe73c90ba964cb6bcf375ae6a84dc75693008a8da627

                              • C:\Users\Admin\AppData\Local\Temp\qu4_ayd1.cmdline

                                Filesize

                                263B

                                MD5

                                6fadad7e737b319faab7add39ca2fa82

                                SHA1

                                b7150f302b289d723921947a9599da828aac5837

                                SHA256

                                353b8200610b9af9791ab457e884ac7ced72ffec8c794937990f484c43375fdf

                                SHA512

                                8750c7e65fe273a6afa32a0c25ac6643410dedeb7786efd1d9ee50495b1af528c5e43390f84408a8b54636f2f79d0aee54d755903f5aad9d97c633f28673ca2f

                              • C:\Users\Admin\AppData\Local\Temp\sgjulejf.0.vb

                                Filesize

                                371B

                                MD5

                                556472f96ba0a829d9cd7592411c2347

                                SHA1

                                a2fae1bb654469d975926c75b9635a169a80c76b

                                SHA256

                                6589cfed04466d3dc448361f54572309a731aa8d54aacf50aade28c0f9225679

                                SHA512

                                a938b6b875dd8be3e942cb4c9939f7718ef930d1feddba516070fc5a308065e8c7ebe7ebd606e3fcf61d25a06d9197b3285043f85dd7c69b072cd9daf90f414a

                              • C:\Users\Admin\AppData\Local\Temp\sgjulejf.cmdline

                                Filesize

                                265B

                                MD5

                                a19b9794c33bf57e786105b8d7f0990e

                                SHA1

                                50237f6f63871eeed7ad50a28ac0d9971f034d42

                                SHA256

                                89bc274ed736f8c6cd736e3cd2e5118ef6dc223bbc2610c35852fc1ac4aae0d8

                                SHA512

                                196b2f9f6e74a6c03680a35bc5f3d6d6ca9259a5830dc2ffb47fd27b12426deef2ebbdb33bc2e3fb56c3c6dfbe3202501ad8bc12bbe9497722bab8278291c8cc

                              • C:\Users\Admin\AppData\Local\Temp\t8wlc2jf.0.vb

                                Filesize

                                368B

                                MD5

                                847182193015fc5d88f0c98c81c630ee

                                SHA1

                                7811018c8b8e5d6d01fb62972a426541635f7cf4

                                SHA256

                                08ebdceaef531c894727e6332a804ff5bead32831c6744ea1b52b22d420060a2

                                SHA512

                                1de1f111195e1f8d492c8ecd884d04fbb3b39f4781849c2d4d56085555844f34c2b6f6af15ea7a234fb6ed3b21f08deb19fc0238fd57f58df2b0cf1c59d0047c

                              • C:\Users\Admin\AppData\Local\Temp\t8wlc2jf.cmdline

                                Filesize

                                259B

                                MD5

                                4fb23c26780ac8216e73261100958508

                                SHA1

                                74b96db575b9b698feeee8673a0b20c68ade0146

                                SHA256

                                a5cee1f36cc4bdb54b85e1509b06338cd6aa0ffd08ff037e76d92ec858ed6e14

                                SHA512

                                b496dd99da57d29541ea42e11303b01f1646b17ff7593eebdc026da6b1e5b9f3ffbe71edc8fba983484e4832d07ae1a49bc89b532cf16edd57fba71418dc13a7

                              • C:\Users\Admin\AppData\Local\Temp\vbc242.tmp

                                Filesize

                                5KB

                                MD5

                                3ea71f08d9ecaad5d91ef675c333e68d

                                SHA1

                                fc7b47ccdee042f88ce0b83188a65dbfe14403b5

                                SHA256

                                19b095eec85ee85b484bee4630f38f2a0966e289761fe2773be9f24ec67dd5cb

                                SHA512

                                99111f95e59e03cf379f49e63035b81f0402ad080c1a7ff21f4fff4aa3e1b8102a623e8ce02c75e8ac9c9884c558ce3ac9174e6fa680c57f92d47de3f143f4ec

                              • C:\Users\Admin\AppData\Local\Temp\vbc34B.tmp

                                Filesize

                                4KB

                                MD5

                                0d0d6ed11d344375bb5f36f73d7e7d13

                                SHA1

                                e98e0cac9032acfc45b0b198d6d49d04a0fcefad

                                SHA256

                                896cfead95deca64f70e1f6d2c14dc7d36b8ece6a3cf715ccc09cd27797a2a86

                                SHA512

                                3111490956a85b21e161eeee31ab7f7fe37e8c1981576b70952ffd5e176b1c51bf1e7da8499bf9bf475f3bc8d94ee8ca461e4d449e4b07ffc879c5c0fe43eb4c

                              • C:\Users\Admin\AppData\Local\Temp\vbc464.tmp

                                Filesize

                                5KB

                                MD5

                                e6c60ba9b4fd13ac52f6b57ead9650a0

                                SHA1

                                d21772c045803b49002066829c675c5be2e37dcc

                                SHA256

                                473f21d49c26b2a13798ba62741c565f0f32c25e49fc3b38244d303d01f946bc

                                SHA512

                                af86bf7105190630729f567362a93c34625b91af7844d6df27670beac7be6f948e462d88e3438a0ce467a62a8375eacdc455f13e201fc9db1dabe3cf413c1da7

                              • C:\Users\Admin\AppData\Local\Temp\vbc56D.tmp

                                Filesize

                                5KB

                                MD5

                                3c6dff42b6144277ccd0f823e1792790

                                SHA1

                                261efd8b74fe00e4630f52b3273f412ded3428d6

                                SHA256

                                a6d25d650e3cc9ee7c407b971a9e5d3d02583e955d58422721dc9354d33fe47f

                                SHA512

                                7ee1aa029ba06c93f06cc8f99f569a18d53b8569fcc57c8aa170ed185a82ed5cf1ec9052b6060c5302a62a20ac8a54ec11b4479002d2bacff41cdacdcb4f87ba

                              • C:\Users\Admin\AppData\Local\Temp\vbc619.tmp

                                Filesize

                                5KB

                                MD5

                                cc9595f1554e79f85e023a31a6bb98bc

                                SHA1

                                d8ab7ff6fe9ae1daceb434627bb4e7a88f169cf8

                                SHA256

                                8d884a110f5e0763ca8cc798d1e5c16d61bc2f7610ccefc9d60aa63931ccce71

                                SHA512

                                d03881577ca1144bcfb7bfe66794068984beca6e9af893ef3093fca860fa415f43ceb9529a6db1b46fd99e61db43f62cfe897caac0a2319bcb1f9826f2b54096

                              • C:\Users\Admin\AppData\Local\Temp\vbcAC.tmp

                                Filesize

                                5KB

                                MD5

                                3843a53d7e2dbfa4c232bdeadd21c357

                                SHA1

                                3940e541bde859a4f090303c16731a24dca505fc

                                SHA256

                                0bb59ed84a49d712878598b06ad05f0c26f5f7a155509554ccf96c14ab6e29f9

                                SHA512

                                1d9ae65cd4f765e04c5ec1d717c15df13d4c92b32624e7a5772b4068ae3c74e8159e32552bbaa18cf34b656b788971e21b1d37801d3accc567bd7e2dfddaa111

                              • C:\Users\Admin\AppData\Local\Temp\vbcAE68.tmp

                                Filesize

                                668B

                                MD5

                                3906bddee0286f09007add3cffcaa5d5

                                SHA1

                                0e7ec4da19db060ab3c90b19070d39699561aae2

                                SHA256

                                0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                                SHA512

                                0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                              • C:\Users\Admin\AppData\Local\Temp\vbcFAF2.tmp

                                Filesize

                                5KB

                                MD5

                                6cefaf397ee40eb5c3df27193a26e399

                                SHA1

                                ab6097301a83d831b6b63acbaaec0285126f4ae5

                                SHA256

                                43a6fa373945bde88b7cc7a083aa81c18e959815f79c4b304afcded5230789df

                                SHA512

                                30f4fadab57fbcd25e58c842a98583dc607c52c6a21ef346f63d4035c2d34243a11ce572cd401e6958262509bf91b71e02f56236c69f3c1f606f5720210cb9de

                              • C:\Users\Admin\AppData\Local\Temp\vbcFC1A.tmp

                                Filesize

                                5KB

                                MD5

                                1925b323c24d5e44f273b65bdf58f85e

                                SHA1

                                704e92b27adad5266b25a84b66491065e6a8e077

                                SHA256

                                f1109f98dcf21ba90f165c3062b89f8f730850c75cbb1ced23b75c7ea1443f63

                                SHA512

                                c3c03be1d12b8c3dd33fa234d60d0328bfc0ea2bfad160d825d5ebf8ef1511f66cd85c9b0d419e83b2ced52fe99ef0df992fea35b2cb912b60ef5635ac25e969

                              • C:\Users\Admin\AppData\Local\Temp\vbcFD62.tmp

                                Filesize

                                5KB

                                MD5

                                2aa7b07c157877ad67f7d79b15da9ff6

                                SHA1

                                451dad641b7b329378d0238e1d0c9a27d47a3f40

                                SHA256

                                9f5688e5525be99764b3e610afa58af84e43191d524c99a196ffca8118e4f950

                                SHA512

                                5a358cd9b6003a867c5c94e3ee0ec49a8cf04c313995fb3999f7cd5fbfc6dc2fdf52da181054aeeb6b05025e603110bda1f2440bbeb2c848698da412c7a695d3

                              • C:\Users\Admin\AppData\Local\Temp\vbcFE3C.tmp

                                Filesize

                                5KB

                                MD5

                                552cdad34f767fe9ceba407cfeaaa5f2

                                SHA1

                                95291c8d45589e53428a2895b17c8c0f9d398eb4

                                SHA256

                                69d9a6c71053bfda400ee50b358b31346621457181ba94ec8645f4df87f82f49

                                SHA512

                                b5e66fc5e7c782da773228e79872590354d39baadb57ae32b25d816d612d580056c8cb9b7a5dd07c0a82230e69f5672dd3329b04028ffec3e5a7c2a5ebea0ad0

                              • C:\Users\Admin\AppData\Local\Temp\vbcFF07.tmp

                                Filesize

                                5KB

                                MD5

                                3ccbd45c6b0f194811118d4b7323362a

                                SHA1

                                4e1376f6cf4d183f7b29496e1419f9fbb3f9786a

                                SHA256

                                77d234f1c365f565425c5af9873bdc915bd6a81d69fee1fad8ddf01217bb32ee

                                SHA512

                                ae3dbeea13020c3a68c53b0818a84973dea9d33e787675d0e2a42aa3988fe54e893a6eb113fe4bf7349ed7a9d2315adef1412d2f31f483df1dba65f1b5685968

                              • C:\Users\Admin\AppData\Local\Temp\vbcFFB3.tmp

                                Filesize

                                5KB

                                MD5

                                4367a7371c6b4a0684704d101371b319

                                SHA1

                                017269e6b19d459626d4809ebd7f0679ea69b0ec

                                SHA256

                                8ca899b5a49a42920615d57d571ed2f74c7513175d5a5fd3de81cc13ab87b1b0

                                SHA512

                                ea0dc5cfe5deb08cb192eee62ea9855a76317169d0bd0238a8707748e8c942f2ab14b182f6b3b65d1ea5905e5f1e62bbf33aef02cdf4476a97e871b19c05f225

                              • C:\Users\Admin\AppData\Local\Temp\vwfRtNH.txt

                                Filesize

                                70B

                                MD5

                                ee67e73252c29160f738f28771118fae

                                SHA1

                                969bfe134c3fb11ad04db32e594b6634c56a72b9

                                SHA256

                                0b36fab6078c10c82cb54f10ec68cb35cbd2c219534145ffd3fc7bc84649bb2d

                                SHA512

                                19c5b6fc0379c0310f7387933ed7e22e2ef9a3c01076518408da9472fcc5f2bc4026d894a8c35e52eaac1b5f227a69f443b210f7cb74737ee829f6d56f21f03d

                              • C:\Users\Admin\AppData\Local\Temp\xqtxeq4u.0.vb

                                Filesize

                                370B

                                MD5

                                70829c1a9fba55df73e0bb03cc02dfba

                                SHA1

                                e0eb831dfee7c9daf3856af584d62c4cb202e852

                                SHA256

                                70274ebc993bc093082ff93802e33a7107df02aee8d392fe723459d31bba7fe0

                                SHA512

                                47eeac79275c292076c22348179543e3e3aa26c51c759d72c42362799437a761dc7707640b3634572b0c1e80b64fd82feae271ed45e06794976278a51252433a

                              • C:\Users\Admin\AppData\Local\Temp\xqtxeq4u.cmdline

                                Filesize

                                263B

                                MD5

                                35d72145d4946aebfb0265f3107e12d3

                                SHA1

                                0c4bb213e384e758d8f33424e7990054ec52e5ce

                                SHA256

                                4d40b8068aaccdc4aec18cf3c2be4eb85b5059cb3d2c425513850aa175e22008

                                SHA512

                                1ab7bacf913dc027b383d023b81c6c1fa143d406eefb39d4f633123935cc5a3ed4242df8ed313723bd4a2d9648ba96358161ed4d288f1c1e4631baf16cd013cd

                              • C:\Users\Admin\AppData\Local\Temp\zuas6fxt.0.vb

                                Filesize

                                373B

                                MD5

                                1d051ff4cd0a27121e93aeb23d1df6ef

                                SHA1

                                4c66c8113b537573b9e54193605009ef612d0ee9

                                SHA256

                                c052ad284c34c0af73d878521251ca7bad9a390e5e7e3b2422dc0f5ca86f4b82

                                SHA512

                                501b5eb718214634c3386ad9a6df7dd48d9a75d4ecbdc2217d1e785e04e725d899a173b06354b21abb16e976e98a1869792cfa1618069090005425bf9472bb38

                              • C:\Users\Admin\AppData\Local\Temp\zuas6fxt.cmdline

                                Filesize

                                269B

                                MD5

                                4b74b3604058bf574def2ef4aa52913e

                                SHA1

                                de31424e904b47eb84cbd82700bcc86d907fea78

                                SHA256

                                5be09322d97fb190b13edbf9944bbce965f1f30ca68292d2678d70cd28440d31

                                SHA512

                                1df863374111eb68ecece45e82f50b428f79f2e6ca44e16e420a57f8e355dc54febee46cda0133be32cecfbde3b0a03915fda99add9706ce114f026235c3955f

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe

                                Filesize

                                5.0MB

                                MD5

                                6663483929f325b3fe2f8a351787aebf

                                SHA1

                                eaef70212f2f361a3167340d7c76e07246f1e427

                                SHA256

                                cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

                                SHA512

                                12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

                              • memory/1736-372-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                Filesize

                                4KB

                              • memory/2096-0-0x000007FEF5DDE000-0x000007FEF5DDF000-memory.dmp

                                Filesize

                                4KB

                              • memory/2096-15-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2096-2-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2096-3-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2720-31-0x0000000000400000-0x000000000040C000-memory.dmp

                                Filesize

                                48KB

                              • memory/2720-20-0x0000000000400000-0x000000000040C000-memory.dmp

                                Filesize

                                48KB

                              • memory/2720-18-0x0000000000400000-0x000000000040C000-memory.dmp

                                Filesize

                                48KB

                              • memory/2720-33-0x0000000000400000-0x000000000040C000-memory.dmp

                                Filesize

                                48KB

                              • memory/2720-28-0x0000000000400000-0x000000000040C000-memory.dmp

                                Filesize

                                48KB

                              • memory/2720-35-0x0000000074230000-0x00000000747DB000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2720-24-0x0000000000400000-0x000000000040C000-memory.dmp

                                Filesize

                                48KB

                              • memory/2720-22-0x0000000000400000-0x000000000040C000-memory.dmp

                                Filesize

                                48KB

                              • memory/2720-34-0x0000000074230000-0x00000000747DB000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2752-13-0x0000000000400000-0x0000000000422000-memory.dmp

                                Filesize

                                136KB

                              • memory/2752-14-0x0000000074231000-0x0000000074232000-memory.dmp

                                Filesize

                                4KB

                              • memory/2752-9-0x0000000000400000-0x0000000000422000-memory.dmp

                                Filesize

                                136KB

                              • memory/2752-7-0x0000000000400000-0x0000000000422000-memory.dmp

                                Filesize

                                136KB

                              • memory/2752-16-0x0000000074230000-0x00000000747DB000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2752-11-0x0000000000400000-0x0000000000422000-memory.dmp

                                Filesize

                                136KB

                              • memory/2752-4-0x0000000000400000-0x0000000000422000-memory.dmp

                                Filesize

                                136KB

                              • memory/2752-5-0x0000000000400000-0x0000000000422000-memory.dmp

                                Filesize

                                136KB

                              • memory/2752-6-0x0000000000400000-0x0000000000422000-memory.dmp

                                Filesize

                                136KB

                              • memory/2752-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                Filesize

                                4KB

                              • memory/2752-17-0x0000000074230000-0x00000000747DB000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2752-350-0x00000000708D0000-0x0000000070CDB000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/2752-376-0x00000000704C0000-0x00000000708CF000-memory.dmp

                                Filesize

                                4.1MB

                              • memory/2752-377-0x000000006FC50000-0x00000000704B4000-memory.dmp

                                Filesize

                                8.4MB

                              • memory/2752-378-0x0000000074230000-0x00000000747DB000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2752-36-0x0000000074230000-0x00000000747DB000-memory.dmp

                                Filesize

                                5.7MB