Analysis

  • max time kernel
    148s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-07-2024 02:47

General

  • Target

    6663483929f325b3fe2f8a351787aebf.exe

  • Size

    5.0MB

  • MD5

    6663483929f325b3fe2f8a351787aebf

  • SHA1

    eaef70212f2f361a3167340d7c76e07246f1e427

  • SHA256

    cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

  • SHA512

    12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

  • SSDEEP

    3072:iEQ5B9LypBTl57/zzTx+feymDt9SYzOP+:iupBvLzTIf4Df7zOP+

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.eu.ngrok.io:8848

Mutex

RV_MUTEX

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6663483929f325b3fe2f8a351787aebf.exe
    "C:\Users\Admin\AppData\Local\Temp\6663483929f325b3fe2f8a351787aebf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        3⤵
          PID:4984
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b2-nld4c.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES317B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDD7AB08615EB4ADCABA96D2DDAF7EAC.TMP"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3764
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pc1w0wp-.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3828
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3350.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B6EC76131F64763B0D12D206B6C59F3.TMP"
            4⤵
              PID:1696
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1w2qbmnn.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4944
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3534.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE725E161F1CD4A5B8FCB825ABBA4BF6.TMP"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4176
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kpbkdbmu.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4112
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3709.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc84C2882321124A3DABFA53F12044AB60.TMP"
              4⤵
                PID:2508
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\svzrl46r.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3992
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3841.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8B41247C813B4358A6D197D794C6B66.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2968
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ierwr8gv.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1416
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES391C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBE7150794B1940609725410E3EF819.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3996
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\21igad1k.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2388
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AA3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc28CD100A7E524B478E30503EAD38A1DD.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:8
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m2y-ltgj.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1112
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C68.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D4B693AA95748C586E45AF285414629.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2560
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gompkqz3.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:408
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E1D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBE99B89A347E46B7B98EA0EB3F11DD27.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1256
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mht1dgqp.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2576
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FA4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA714752B29F84D44852F59E47792DB84.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:396
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3-vqazz9.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2068
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES411B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc18948C7D8B5D4D21BE3F8A368BF9466.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4168
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bmoiywih.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2972
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4282.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEF3A375DBE8140C08B1E716928769419.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4488
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ppkddeba.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4316
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4457.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEA3406FE7D0742DDA87975516E11573.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4884
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-a-pc0qt.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4864
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES45AF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc75B2BCAE3BDA4FD88FD77022ECCC21E9.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3672
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2uwjffhm.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2004
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4755.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc41C049695FFC4C8EB617781B3C8CB040.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1204
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ugzqa2vr.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2904
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49A6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc45EB53A7E5F439BACF735A96CF164ED.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1864
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j8sm945k.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4996
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CD3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6B82695E1AED49E89A7A1E3BF16BDB1E.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4848
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uvka9nb8.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2592
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E3A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6D20B76C3DDA450AB5AC3FCE5B187D74.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3116
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sjgjvi2h.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1292
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FB1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5758EA6F44E94B878CA5BCEBF537CF80.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:644
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\22zgzoxh.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3028
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5196.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc550788CBBCD64100A5758FFB5E5502.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1676
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d8rjtw-b.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2340
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES536A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9F92F6A2A700495F92244D1D24F1ECC6.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1688
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a1eibwja.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5068
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES558D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc50BF2C1DCC4244C992CBF38C3DB9B5DC.TMP"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4412
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:1604
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                4⤵
                • Drops startup file
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2348
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2284
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wa6nad9d.cmdline"
                  5⤵
                  • Drops startup file
                  • System Location Discovery: System Language Discovery
                  PID:552
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC4F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBC9F98485F404C48878730EDBC726C25.TMP"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:1720
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "Client" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:692
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e1mf3dkm.cmdline"
                  5⤵
                    PID:4896
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE14.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6EDF9363A5EF43439190F24F731AF6.TMP"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:876
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ru0dfb6r.cmdline"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1292
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF4D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB652275E1AF34C2A8719AE836FD36DFD.TMP"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3020
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-fmnwt9y.cmdline"
                    5⤵
                      PID:3632
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF056.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc422123B1305C4942A893BD196E94BF63.TMP"
                        6⤵
                          PID:3424
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\guiibvam.cmdline"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:2652
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF18F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB39BD9E9FB0E4DBABA9B8E38C27F60.TMP"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:1304
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n1s5kzuv.cmdline"
                        5⤵
                          PID:4176
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF2B8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBBE80DBC2E954D68BA91ED173DC6E7C9.TMP"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:1104
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eoc0lyrr.cmdline"
                          5⤵
                            PID:4196
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3E1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc480ED55BB27341F69B7A7965445E31E4.TMP"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4884
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0xmoxs9z.cmdline"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:548
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF548.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1334FDA1F2FA4E6698CEF66FA07311BF.TMP"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4376
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kqtghfx7.cmdline"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4548
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF661.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD58F4E3AB95541F6A49581AF6C87AA51.TMP"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:2296
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q1mhosfq.cmdline"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:2852
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF79A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE02DCF43F8F843B692EF824267AEA590.TMP"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:1232
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gzq18nbc.cmdline"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4244
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF911.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEA915926939B4262B7116E355041861.TMP"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:3036
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:816
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                      2⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4356
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3128

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\Index\vcredist2010_x64.log-MSI_vc_red.msi.ico

                    Filesize

                    4KB

                    MD5

                    fde1b01ca49aa70922404cdfcf32a643

                    SHA1

                    b0a2002c39a37a0ccaf219d42f1075471fd8b481

                    SHA256

                    741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

                    SHA512

                    b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

                  • C:\ProgramData\Index\vcredist2010_x64.log.ico

                    Filesize

                    4KB

                    MD5

                    bb4ff6746434c51de221387a31a00910

                    SHA1

                    43e764b72dc8de4f65d8cf15164fc7868aa76998

                    SHA256

                    546c4eeccca3320558d30eac5dc3d4726846bdc54af33aa63ac8f3e6fc128506

                    SHA512

                    1e4c405eca8d1b02147271095545434697d3d672310b4ea2ecca8715eaa9689be3f25c3d4898e7a4b42c413f258eda729a70f5ad8bc314a742082b5a6a8e9ff1

                  • C:\Users\Admin\AppData\Local\Temp\1w2qbmnn.0.vb

                    Filesize

                    364B

                    MD5

                    a44396dac48f30ef8c8608531567fb83

                    SHA1

                    905391559e0577fbc6cefd0d13eb10f9dbcd63c3

                    SHA256

                    1ba098682cded71da604d1c99018e43622cf0bd8a609c0c6e2752e9ff1944b4f

                    SHA512

                    168ef2aa0bcc07f4e1a1f6652c8d459cd6c3c31ee579702e06977733da856419c9ebd1f2da06fdd185655dc464cd40183ddb32cfe0e960bc6104c64fdc9976fc

                  • C:\Users\Admin\AppData\Local\Temp\1w2qbmnn.cmdline

                    Filesize

                    251B

                    MD5

                    aa3a0301a11df5052966c34ee4c65fc3

                    SHA1

                    ad5c0ff8878527dc72ac1bb239e573f46a0eb341

                    SHA256

                    2111605100a36e43cd16a5ba3333794e5d91a95ece0b6e1d1c97292a34834279

                    SHA512

                    a64dca0e07b916457959f7ea92bb1483d0b60be44fdf653b28ec01c38206e3b82f4e5ff5fca20edc4cfb2a8c8a80a832ad4490b30839311664aa3ab69f394ebf

                  • C:\Users\Admin\AppData\Local\Temp\21igad1k.0.vb

                    Filesize

                    368B

                    MD5

                    847182193015fc5d88f0c98c81c630ee

                    SHA1

                    7811018c8b8e5d6d01fb62972a426541635f7cf4

                    SHA256

                    08ebdceaef531c894727e6332a804ff5bead32831c6744ea1b52b22d420060a2

                    SHA512

                    1de1f111195e1f8d492c8ecd884d04fbb3b39f4781849c2d4d56085555844f34c2b6f6af15ea7a234fb6ed3b21f08deb19fc0238fd57f58df2b0cf1c59d0047c

                  • C:\Users\Admin\AppData\Local\Temp\21igad1k.cmdline

                    Filesize

                    259B

                    MD5

                    0b73f3bf15f4f87dc5930682c87b8d59

                    SHA1

                    bb7bf0d8622e5f717f540589d52d87eeebb28f93

                    SHA256

                    96adb94235ef6867ba6ee0c17203b72dca647af0bbc70b35a23b174a72457363

                    SHA512

                    8b91161b97e31b9ce306af356998ce40b82065ad0ef0080f0fa82f859c1ad51e194e98c3e7d777cd3b74d479bf61128471a7b6f5626d79d293a282c769eb1e98

                  • C:\Users\Admin\AppData\Local\Temp\3-vqazz9.0.vb

                    Filesize

                    370B

                    MD5

                    70829c1a9fba55df73e0bb03cc02dfba

                    SHA1

                    e0eb831dfee7c9daf3856af584d62c4cb202e852

                    SHA256

                    70274ebc993bc093082ff93802e33a7107df02aee8d392fe723459d31bba7fe0

                    SHA512

                    47eeac79275c292076c22348179543e3e3aa26c51c759d72c42362799437a761dc7707640b3634572b0c1e80b64fd82feae271ed45e06794976278a51252433a

                  • C:\Users\Admin\AppData\Local\Temp\3-vqazz9.cmdline

                    Filesize

                    263B

                    MD5

                    ce0f908c46fbf046a4324305870c699c

                    SHA1

                    7f93c54bd699289e52a662229ac885f33bb990e9

                    SHA256

                    88c60feca5301bd152c2fd73ed685595315efa03ba9621e9ec985524d7a31ff3

                    SHA512

                    663c98b2a112eb879cbfd2b5bdf33037df9413d8614e7dc35e81116a3c3a8b7563dbab12db4917dd5e9306ab97c86ee975baa35f68cb5aa5f29b23f085fe2ea3

                  • C:\Users\Admin\AppData\Local\Temp\RES317B.tmp

                    Filesize

                    5KB

                    MD5

                    c40c173230e34043755dd631c2aadfef

                    SHA1

                    ca4f7046115b5431ea5ade03a2ae9d5ee24cf348

                    SHA256

                    9c2ffa13a6bef6e746d2d75b7748f9ce4f06c819cd3e41ed4ae850369eaf3fcb

                    SHA512

                    94c85337009ba73f7cc411ede8e51e38fe05f6b78d3c5cc4c548ca0d3803d7c2a0f0bd5f49f82fd2003d382179d914b93d75a094186423995351cbb758416dad

                  • C:\Users\Admin\AppData\Local\Temp\RES3350.tmp

                    Filesize

                    5KB

                    MD5

                    3b8307cfc20795d878dd4bbdc67f60c7

                    SHA1

                    b26d329f0c4a265ce658b01bf1edd2fe09fde767

                    SHA256

                    1980aac3342a765aea961816216a042b8e478a7b79d4efc4c9e8ec793ca40d04

                    SHA512

                    d71e7e2d6a5fe6e97ea9dc8140101421fa5c8d882e2966cd028a3cff4d0a9ba9c40601a074d3f21319f5f396ea9250341bd18d42fd5f37e226005aaba53a9e89

                  • C:\Users\Admin\AppData\Local\Temp\RES3709.tmp

                    Filesize

                    5KB

                    MD5

                    4868d61d9aa25322cb56014228fd19d7

                    SHA1

                    0944a17831e0476da0a1a32df7376ffd83592353

                    SHA256

                    fb61c7e735bc0bbcc75c9782e99f34b19126ed95a1d815e1b721ee449995c839

                    SHA512

                    06a2165bff7859bed9a4c545a8c7e40b84a54982adb100841dc149ae15de94824bba4635215698e57f73a955591b0913600ce365e308e27b9c7b0e4474ed191e

                  • C:\Users\Admin\AppData\Local\Temp\RES3841.tmp

                    Filesize

                    5KB

                    MD5

                    f7a0ea9f0c1d918bd531ce908cd67362

                    SHA1

                    5029043df24f158d57b50f62eca0d1e6768c9d36

                    SHA256

                    86681b329910d27b5665ee2baa645aad5867642681205fa1ada667ddd56f376b

                    SHA512

                    38aae435aaf9531b588e54f89d2e85d0760ddfb14ae30313f8cae80c6c523fc12368d06c0b75bc28041d1e4091ca8a4fa029444e75200ee0c77f6d4fd664bffa

                  • C:\Users\Admin\AppData\Local\Temp\RES391C.tmp

                    Filesize

                    5KB

                    MD5

                    6732ae8ae1c272d3dd4fe284873d011b

                    SHA1

                    f4d2f0b8fe4d1bffbb23f22a819d972dc2254c97

                    SHA256

                    87ada87f2cf54d684ed3defec8909faec59f4fbb59c7994cd5a0a329ab47d130

                    SHA512

                    3eecbb6db568c12d1e336e7590af49b1e43cfcfc4e17209f91a159f97a766f5fcb760cb6e037177eeea24ae38895f1448c5cf92c8c02c54852543262d7b309e8

                  • C:\Users\Admin\AppData\Local\Temp\RES3AA3.tmp

                    Filesize

                    5KB

                    MD5

                    2ae141022fb898a9b35d462a841c7ec0

                    SHA1

                    a6bbda076597079a01743196bca8e36e0a6674d5

                    SHA256

                    2c2260d5fd2454ca944c6f16dac11d0be9c8c4f06108477fe16aac3f64cfdb1a

                    SHA512

                    1c7dced5614acf4a861e222aed6ec5f46d12f05c531fa4794fec12ecbcdc794cd18a41dc83a916d6868054b166767cabae15cdcc13ff8b0dfa37f7f317fd9f6b

                  • C:\Users\Admin\AppData\Local\Temp\RES3C68.tmp

                    Filesize

                    5KB

                    MD5

                    eeed6008ba6f8edd0f704b1ff32e73f2

                    SHA1

                    8fad7b24ce5f9a0d1933f08a52f814602d8345e6

                    SHA256

                    59b516a3979ad36fabdff561a106365324f0b3ec7666608419a7a69a53abf3fb

                    SHA512

                    2a39ea4d5fb98a081be0f7b01962d72c5e4f0c50fd3825a21710d1abe777abd766b719ffc76099e490c0ab5f98a4fca57ce31876a0655ab0e28a44159dace6e6

                  • C:\Users\Admin\AppData\Local\Temp\RES3E1D.tmp

                    Filesize

                    5KB

                    MD5

                    327ae080ebc89796e68cc491ba7cb7a6

                    SHA1

                    b8123f8f8fb78785a3a4b2be033ca82c34c6595a

                    SHA256

                    7e2aef8b98c6512e9566e8ace29f044a3c00a58e145d2248630f2ad1e80e31b0

                    SHA512

                    b54b38c520780e9a51d93f85f31eaa1393c264a63ca7199a7a41ab999d41ce2758afbd30f040d2a5e961721b51bf1a51387e597b787ce91d2493b2bfb67989f3

                  • C:\Users\Admin\AppData\Local\Temp\RES3FA4.tmp

                    Filesize

                    5KB

                    MD5

                    d9ec5c6ef52ee3e878c2cf0c64e672f2

                    SHA1

                    a68c9e7225d770de21f85a8a2230d30271d9f3fd

                    SHA256

                    a31a1bcdafc8b335fc3489da18593b33571616a6a17ff3c14978164d4d71d3ef

                    SHA512

                    de2d115d0e25684e69b1457e6418e33b28f6cdd31a1a3616fb3d7db1e33afaa60aed1e725a91af6c587ecd0c89afa723ebf68eebaa607b15ee4adec1914a6e7b

                  • C:\Users\Admin\AppData\Local\Temp\RES411B.tmp

                    Filesize

                    5KB

                    MD5

                    0642443bc607703ef5cc76e52ca50f16

                    SHA1

                    a3e2eca44dba186bdeadff4749295da5c41ffcd6

                    SHA256

                    2ffb05680eb841527092d315b87431f8f49eb47b38e3df9bebc65d5ea90eaa9c

                    SHA512

                    e2384adc7a7964307c2eb02bc76454bd57bef2fbe6992f2682bcd2fc1f06435a8a9bf64c9ff2367ec773165bdd816a8ea937a70f7f91313a2aade98d209ee8d9

                  • C:\Users\Admin\AppData\Local\Temp\RES4282.tmp

                    Filesize

                    5KB

                    MD5

                    bf46463baf1fd78148f79583980317b9

                    SHA1

                    2e2ad08409af77af6562fa5c4aad267f377b17e9

                    SHA256

                    c8b1b3f1f16a1bcbf958767ffe2ee79160be9a81651f71b495b8014b530fd598

                    SHA512

                    72fbf300e7b4a67c961b39d2c98e634d7aa00fa62171089e0614e5bb1481306b47bc01eb4800dc42bbbbf3719ae0bbec0dee2e71f260a38f86f87ab06a020184

                  • C:\Users\Admin\AppData\Local\Temp\RES4457.tmp

                    Filesize

                    5KB

                    MD5

                    b353c236d48b8f62b9c288df8f1875a4

                    SHA1

                    1efbf6fd597f6df2caf9ef8c5dfafb17b0db6fb2

                    SHA256

                    c613baa046d0acc34427c756b1dc7780bb6e6e60b36b5fc2280c8882504d01b3

                    SHA512

                    6fe2e2c894571df97e63e12a6a481d731d6d69596b488313739fffaaee0101ed5bda7a98b170b8f2cf2018e182015bd9b2319a4a0793f73edbadddf5647bf862

                  • C:\Users\Admin\AppData\Local\Temp\b2-nld4c.0.vb

                    Filesize

                    364B

                    MD5

                    3c88d0389da097789f854d19e5a6851c

                    SHA1

                    9e0f6bb3a576bb0eaf7fa1384018e57b50401adf

                    SHA256

                    b0c7beac256055e2a91713ef20ab4bc9eb5785e2a7cd30f64ab95fe37ff4d60c

                    SHA512

                    92799b8e42dd602cb9686820bc75136e26f2f356a731c23e3a3c5d9f65ff0b2325666aebd1f34f4ebf240eb047a11e9a37751f3fa3e30264738e6c113f8d9ead

                  • C:\Users\Admin\AppData\Local\Temp\b2-nld4c.cmdline

                    Filesize

                    251B

                    MD5

                    1b2198438742067feeb2c48897612a42

                    SHA1

                    1acc81a42271072ee092cca0ee5d957164a09d55

                    SHA256

                    9308584adf798d7eccd62d46744913c9b4d0e88bea29337367c95e5aaf29f08d

                    SHA512

                    7a9c98e403b1ce446fd0e7a8005df7b2c392ce28e973e87607c1fd82a845d21f8efcf43951d71247307c061595bf6edf5504b013134ab461d28f280123165b68

                  • C:\Users\Admin\AppData\Local\Temp\bmoiywih.0.vb

                    Filesize

                    373B

                    MD5

                    adaa061d082a7b86bc1f959594a01eff

                    SHA1

                    9398852f8cfe36144a64ccded6b7775acdce59a9

                    SHA256

                    99391f66edd6bcddcc4c1f156572f4d193538b6e42793cf0694c97f02d6efc9c

                    SHA512

                    fc51f77ad8634b2a7512b76eac8cea3be9e04c5ff59b1fdedb6c0e99c71b7d4a5128b6f72fb217a8e7925371b98e0c94bc228c504125ae08cd3bb9daa26e6186

                  • C:\Users\Admin\AppData\Local\Temp\bmoiywih.cmdline

                    Filesize

                    269B

                    MD5

                    23e94740d0acac4aba262734328eb40f

                    SHA1

                    7e34d53f6dfc7778a89c276dfa3c24c3c6432a09

                    SHA256

                    83d0087f43925d500955fb31f01359013773d7a7f9c6ca6577c4058c71aec62c

                    SHA512

                    2b6a61a6b233e65272f2b3f485f3754e7d71a60f247625bcd51d5946741347b6a52727f2d0eb9c0c4888ff257c028a11370fd7e213301f7c59d8120e4f51f290

                  • C:\Users\Admin\AppData\Local\Temp\gompkqz3.0.vb

                    Filesize

                    370B

                    MD5

                    31fc52bfcb5cf9a12d52b79c7dceaf11

                    SHA1

                    ec19379305a8404d3c86adb65782467d1c9c3b38

                    SHA256

                    2b2c31fe62190c52b62ece3e29a19af2309832922d627abd7b2900eab548c19e

                    SHA512

                    38679030edebf6272eb04b0ef9b0b432eef26b23e7c6a517518db3a15ba40bd33eba33835a5cafba2a9fbe73c90ba964cb6bcf375ae6a84dc75693008a8da627

                  • C:\Users\Admin\AppData\Local\Temp\gompkqz3.cmdline

                    Filesize

                    263B

                    MD5

                    89941ab9a0da44427ceffb56533409ba

                    SHA1

                    b12857603186c1d29d1d697b10d77087101719b5

                    SHA256

                    d8cb8dcb0fee30327df5b605128e9e44965f01b44ec60cd1923c86a2c9be1a74

                    SHA512

                    2352cf389a2d323f0b47e872960971002ed655814e7d80f8a07c4888422f768c3f71b15f87f15cf947863eb276b30b15b88409d59f3748698308f6aaaaf885f8

                  • C:\Users\Admin\AppData\Local\Temp\ierwr8gv.0.vb

                    Filesize

                    371B

                    MD5

                    846365ec5052d6dabd406c35fb9393cd

                    SHA1

                    9abf408ca3938f0acbfc6eab9fccd33b4cfc43b0

                    SHA256

                    f1c039830bf9f701f465510cf16ae094214fcfc23a3c311adee9e6f4c18851b3

                    SHA512

                    cf3a29a98a1a53982bd6afbc8dc61b954c26138f9b85473b8a3297ca7ee3c3b782a3b6edde8b0dbbe406bd26e52d72c40a0c1d58dbdfb40c8f9e461bd6542b2d

                  • C:\Users\Admin\AppData\Local\Temp\ierwr8gv.cmdline

                    Filesize

                    265B

                    MD5

                    00e54c5203ae10852db86eece074aecf

                    SHA1

                    2e040418bb7be2f2e87c1de2eb4a828ef9ae1794

                    SHA256

                    f18b374cf6722d23aa9b4b13b421870ff1e5f767ca3ffc313bdfb57810fceafb

                    SHA512

                    4ff91bc1fb630d367127cb27db58e5799ee918eb7888ba93de8911a6be96f0fd60cd089b68a192c4f49331af6d4ac01304d95e7d4e7d95a3e1b49cc5ca5bcb17

                  • C:\Users\Admin\AppData\Local\Temp\kpbkdbmu.0.vb

                    Filesize

                    350B

                    MD5

                    55baa1a9cc195fdeb239fd42886466ed

                    SHA1

                    21d56bd00b7bdefb6fd1f2735f2249cde0812132

                    SHA256

                    483fae1036126f05605dff2447307d8e840ff775f5cf7574fb5b0256beb95766

                    SHA512

                    8dc014a020e6ecda766b1f58928b1d10a20c5ea2e3973e94d8c339ea772044e3898004b753b9ff4020b436c543206f4ab46468b789d08466136baf0812e81daf

                  • C:\Users\Admin\AppData\Local\Temp\kpbkdbmu.cmdline

                    Filesize

                    222B

                    MD5

                    f556c24073d5c813f56c6cdda4a7654c

                    SHA1

                    29f5388d1d387230a64876a78ad004e76f0d0184

                    SHA256

                    c9b506dcf3b02fc98e816e905840e5576cab5d6d9278e34e07280165fbdfd2db

                    SHA512

                    0d23bdfde493eaf5bc387a100d92ea63215be9773adcd81dcbd4d1ff0bc8302b8481d871c1e2ff243945fb48f74ed86afc8e78319285f22e8b9c9bf92fc5da15

                  • C:\Users\Admin\AppData\Local\Temp\m2y-ltgj.0.vb

                    Filesize

                    371B

                    MD5

                    556472f96ba0a829d9cd7592411c2347

                    SHA1

                    a2fae1bb654469d975926c75b9635a169a80c76b

                    SHA256

                    6589cfed04466d3dc448361f54572309a731aa8d54aacf50aade28c0f9225679

                    SHA512

                    a938b6b875dd8be3e942cb4c9939f7718ef930d1feddba516070fc5a308065e8c7ebe7ebd606e3fcf61d25a06d9197b3285043f85dd7c69b072cd9daf90f414a

                  • C:\Users\Admin\AppData\Local\Temp\m2y-ltgj.cmdline

                    Filesize

                    265B

                    MD5

                    d4b6732c149a7184808f72ab6cba1c82

                    SHA1

                    905a4baae24310510949d95bcf9ca1059d16610e

                    SHA256

                    2d5ee9faccd447cf065f0519c53ed5035a03bb05b78b1c085ea0c1ec2e514b50

                    SHA512

                    62ea05f77b4faad83a3cc7c16b5327b9245452fce2bf72daf779987b29ea90f9831b4db4159841ed307452d0675eee827ab7a7936bb10e0a7dcff3e56aff24b1

                  • C:\Users\Admin\AppData\Local\Temp\mht1dgqp.0.vb

                    Filesize

                    373B

                    MD5

                    1d051ff4cd0a27121e93aeb23d1df6ef

                    SHA1

                    4c66c8113b537573b9e54193605009ef612d0ee9

                    SHA256

                    c052ad284c34c0af73d878521251ca7bad9a390e5e7e3b2422dc0f5ca86f4b82

                    SHA512

                    501b5eb718214634c3386ad9a6df7dd48d9a75d4ecbdc2217d1e785e04e725d899a173b06354b21abb16e976e98a1869792cfa1618069090005425bf9472bb38

                  • C:\Users\Admin\AppData\Local\Temp\mht1dgqp.cmdline

                    Filesize

                    269B

                    MD5

                    a96c9c4fa4895e33d811e6f79900ff81

                    SHA1

                    3ac06cf5df0c8aeae5afedada801ed11627c866a

                    SHA256

                    0e528709650ce276596d92f30aedd7157d7eb7732902ba462aa3397beeead77c

                    SHA512

                    f037320c21944e3f2b9fbfbf50d6b7821449c1204b3e9013c6e5d6408766d48dfe81980a635e5c9ea5e6fd5f64b6d44feb8867a61664eb1ae396862a553dc5a5

                  • C:\Users\Admin\AppData\Local\Temp\pc1w0wp-.0.vb

                    Filesize

                    350B

                    MD5

                    3fa7c020766873f8b58d109177c7d7a1

                    SHA1

                    716be689ba29ba1493a617920c24fa6ef036ed5d

                    SHA256

                    dfcfb090d3b80c08c34aa55028773778a8a745c2eef48d8c572b043fb421e3e7

                    SHA512

                    1657d79d5bd7768984df780f71e9609c69fa58c7370eb5ee8122c97daf1a2c47fb0217f3f69e07f8fd0c51c8f8e078a00f8275eed3bbb02ec23ba092c47ec196

                  • C:\Users\Admin\AppData\Local\Temp\pc1w0wp-.cmdline

                    Filesize

                    222B

                    MD5

                    ed2e1cc24b894f6593ee7c3928e5eea5

                    SHA1

                    cc7f6a07e496f7d477ee1b0a66d8fd849cd1507f

                    SHA256

                    98c480b31065ab04fd2805314e17de67bc678b77fe2bfd2226168d9a21bf8b52

                    SHA512

                    1e774461356a486612a318d58eeb43db5096e2db3c9527753d885c7bb1c1642415525a35288281948d57ffd987f3eb301bfc58c1ec6cfcee720731c4aeeafd60

                  • C:\Users\Admin\AppData\Local\Temp\ppkddeba.0.vb

                    Filesize

                    370B

                    MD5

                    f1f4b97a4a7ccacf00d680ed41092d6b

                    SHA1

                    f8b32a0d52cb9a1f1d87752f9f3883c56eee16aa

                    SHA256

                    4050ab47352c7d9e885aec0f16054cfab523d854b4f4956027b82277379e1e80

                    SHA512

                    2b3ba9c1250e5c56267a99e79c155927c3b353734c485b31b0537c50a3cde35ca0d75a5bb8e1d230be8a3685dfe41bf3238263d03566ec6889bec6ffb233d210

                  • C:\Users\Admin\AppData\Local\Temp\ppkddeba.cmdline

                    Filesize

                    263B

                    MD5

                    7873984290ecf3b04ae9c0c8d8fb04aa

                    SHA1

                    09db75873ce407d99cb38322df918b84f0ff3b11

                    SHA256

                    c3672823f3bc1315cb55b9941133da0b1deff7a642c0af8ee0a891817572a409

                    SHA512

                    3e96d5e414b205bc7b0badc68c6f249ae8b0fcf2f8bf32141d96058d752c803f75680300e415cdb8ddc24e45ced91755c8cebc38f1c4e10eacb1b2b529c2b525

                  • C:\Users\Admin\AppData\Local\Temp\svzrl46r.0.vb

                    Filesize

                    368B

                    MD5

                    4a447b73c91023eb6c863a34742dbfdd

                    SHA1

                    68fbb85cab50aaeaa9abedff254efba01892310a

                    SHA256

                    b9d69dba98cd1d12c4a0ed06def7734936270924cb3847807f6f04f3d0fac242

                    SHA512

                    dfc531d34abadc872b5db88a087784181970d8cb5b958fe979e431dd2bd135c6699c738a61e26e7fd9674af90449fbcbf810b42e765b0add5d9d66ad6e83299d

                  • C:\Users\Admin\AppData\Local\Temp\svzrl46r.cmdline

                    Filesize

                    259B

                    MD5

                    5f4f55709fc02aa8a204f13ac7a07779

                    SHA1

                    f9cfabfa3a02d6aa8a0239ede09dd768ad203815

                    SHA256

                    1d08758381e961c36fc5120047edfe22a2681891c7b948f94472063481740ff3

                    SHA512

                    21548b2953b05575376f89a52aecc280bf837ceb109289200e03f10ebd6c1adad15174f75eb6c80bb508cd6a3661e5b503719866de58d15e69611cbf82bbc426

                  • C:\Users\Admin\AppData\Local\Temp\vbc18948C7D8B5D4D21BE3F8A368BF9466.TMP

                    Filesize

                    5KB

                    MD5

                    e5e552a63bec43aafd93067052091b70

                    SHA1

                    65d27ec9696e4eab2e9c9f03ce6a91330d194230

                    SHA256

                    19333143ba21e54fbaab635b061f7166a0db918057804cefd54e46586a0ccffb

                    SHA512

                    8703b20ea2ea148882430c4a13643978b9eb68212e74f257a8cf9d0cf56a1a7d285fe05663f8e43556ad2e802c27c8324751974cbb984dc5e7e54cb96b6063f6

                  • C:\Users\Admin\AppData\Local\Temp\vbc28CD100A7E524B478E30503EAD38A1DD.TMP

                    Filesize

                    5KB

                    MD5

                    cdb46c68f63ef379787c06e589936cbd

                    SHA1

                    0afcacbc9dbafe5ece918d2abd7e8c359a850c93

                    SHA256

                    e8afb68368eaff8356b363fb296aef4e2da063cddcf08e0b4a0e9d580fa9c84b

                    SHA512

                    083ba0fa6e8d08dd851be5671c50382a169416e1b8e623ace0cb6b9f98f1b02008947882509f19e646139d3129ab9cedf53b8bab5bf1bbc72f4377aad4ebf189

                  • C:\Users\Admin\AppData\Local\Temp\vbc3D4B693AA95748C586E45AF285414629.TMP

                    Filesize

                    5KB

                    MD5

                    c3f8ad47348d4dc388b98c82291c4e3e

                    SHA1

                    f92b80d1a9467d4b6ef9604d82dbdc43d15bfe38

                    SHA256

                    609c321fc1bbce8a03476a1fd09100ad0148c33646804d58f9a1efd5e73e3b85

                    SHA512

                    74508a1cf26b23376d7e006786887f0057a970a17e9644871bbc6c642aeb799d86b71aa25ecfc986854c154ebe7db088270bf3b766cdfb71d1145cf67eea4c54

                  • C:\Users\Admin\AppData\Local\Temp\vbc480ED55BB27341F69B7A7965445E31E4.TMP

                    Filesize

                    676B

                    MD5

                    85c61c03055878407f9433e0cc278eb7

                    SHA1

                    15a60f1519aefb81cb63c5993400dd7d31b1202f

                    SHA256

                    f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

                    SHA512

                    7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

                  • C:\Users\Admin\AppData\Local\Temp\vbc84C2882321124A3DABFA53F12044AB60.TMP

                    Filesize

                    5KB

                    MD5

                    707ccd65076784de34fd01c4aed82881

                    SHA1

                    3db7612956960ebb19ff7e1d9268506b639dc7c9

                    SHA256

                    945e1ccbc8e84b145d73102432bccf8040f77795424b1f7f0bfadb9add78d786

                    SHA512

                    767db8f7683c6256ef155f147fbd2202d22b2f91f2769e34de0ca5c8d525f04d9739647bb0e6f312d6f634366b6529fb83e2cafe153c727c861a9b6212d0dd34

                  • C:\Users\Admin\AppData\Local\Temp\vbc8B41247C813B4358A6D197D794C6B66.TMP

                    Filesize

                    5KB

                    MD5

                    161e68e923d56e4253270ef3afecb8ab

                    SHA1

                    7fd1bb35f3fd39f23a033861a4b92f4171545c69

                    SHA256

                    429dabd3474e79f2f7b456166e975c3f8760201b06f13b42bc4843f3b4dde419

                    SHA512

                    2f47d87471710b90b91d20eae71b666aa9dc124e42f39c5a63ab2df9131f9799133e5ed8c03d9385f5ba55988c62a99b96b7e056d61fb3e484e47de308f2a3b8

                  • C:\Users\Admin\AppData\Local\Temp\vbc9B6EC76131F64763B0D12D206B6C59F3.TMP

                    Filesize

                    5KB

                    MD5

                    b07f007145f01b56abdfb53b487f0458

                    SHA1

                    9923c81f68e73be76b5f4964bdc4044334a415ae

                    SHA256

                    5c84e2e6f556654e4f4c0805c5a6a507fb9c1bbe02cc04fc05c2e8ee32e40c4e

                    SHA512

                    f635f804e1fd38b63bf5c128b711315e8da9bae51c0a906fcc6ace60d980dc23ab4cbe8613496771da23915359ce8bc2ae4e6a2261f039a46cd24e3ab9d78eab

                  • C:\Users\Admin\AppData\Local\Temp\vbcA714752B29F84D44852F59E47792DB84.TMP

                    Filesize

                    5KB

                    MD5

                    5ae046a15bea3386071f0c63192ba29f

                    SHA1

                    94d51e6f2711362ade4879a29dba8f5abccdf884

                    SHA256

                    3b7d80821582922f747077294e51e2936cf3bc7dcf6ab999e83795a306e4b378

                    SHA512

                    29cb86aa3b76c1d1c2812baec48a036923050314450451b8fca317c2dd8dc3bbaffbd776cdb9d1f038aab703b5bfd91c8153e41a330dbba2671fc33ec7df2a03

                  • C:\Users\Admin\AppData\Local\Temp\vbcB39BD9E9FB0E4DBABA9B8E38C27F60.TMP

                    Filesize

                    668B

                    MD5

                    3906bddee0286f09007add3cffcaa5d5

                    SHA1

                    0e7ec4da19db060ab3c90b19070d39699561aae2

                    SHA256

                    0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                    SHA512

                    0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                  • C:\Users\Admin\AppData\Local\Temp\vbcBE7150794B1940609725410E3EF819.TMP

                    Filesize

                    5KB

                    MD5

                    0951a669ef19737038b5a334186f1708

                    SHA1

                    53bbfbc282621ad57e7b091da3ae6a4ec0121596

                    SHA256

                    b582bab6100c6e758e62306f36f2693bc9ec729a95b4ffb5f3f715979efb6811

                    SHA512

                    7fde5deb696c18e2d7b5a94ea3a2af7aff25c593a364c366b6b5f70aefb618f38bddf6c64235a73ceb1e29a5c73d4e643dfec6e2aadafa23935e33ad77165a5b

                  • C:\Users\Admin\AppData\Local\Temp\vbcBE99B89A347E46B7B98EA0EB3F11DD27.TMP

                    Filesize

                    5KB

                    MD5

                    8cb42e87bed9f4f5dddcfc0b4ed57515

                    SHA1

                    c5dadeac1347aedfb13eda2a7ec9040bead1147d

                    SHA256

                    968b017601126179c5c112428d2bb44b40ce26fa34ee82c34c363d5f582addbd

                    SHA512

                    bdcede0a75ea1f95aae11fab7755961cb27700b575cda72195511212567d8636f7feb9fb25b0b7b5ef03aca7b995d519839a761a579e58bda94fdba909fea2b4

                  • C:\Users\Admin\AppData\Local\Temp\vbcD58F4E3AB95541F6A49581AF6C87AA51.TMP

                    Filesize

                    644B

                    MD5

                    dac60af34e6b37e2ce48ac2551aee4e7

                    SHA1

                    968c21d77c1f80b3e962d928c35893dbc8f12c09

                    SHA256

                    2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

                    SHA512

                    1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

                  • C:\Users\Admin\AppData\Local\Temp\vbcDD7AB08615EB4ADCABA96D2DDAF7EAC.TMP

                    Filesize

                    5KB

                    MD5

                    dae0bcef83564fd019409964995440a3

                    SHA1

                    72227ef8d352f83128124d59abced5453981017f

                    SHA256

                    bb59c081158d18030c797fe785ab434d2c7b512891b111a4cbabaeccfe43297d

                    SHA512

                    e88ce22701c011cd522f04bc4d81ae8515d5f1ddab762adbcd827a058fac7207a07b546876321184f36899768c6a2f13e3845eae258882748c544fde5a1b2558

                  • C:\Users\Admin\AppData\Local\Temp\vbcEA3406FE7D0742DDA87975516E11573.TMP

                    Filesize

                    5KB

                    MD5

                    88f358395e0d0e3eb364f270c2cab9ed

                    SHA1

                    702d676a051d435112bedb3acbd627c09e9dd6f8

                    SHA256

                    6f636608da5f6af0655cdab5e25fd7e59b6fb0bc1c4686cdec1060cdbf7fcfac

                    SHA512

                    dfe6920434fcda8bac7c4301324afda0f75ea34130a212ffc0feb84dd387134e2de4003fcbd48d8a386a4602d97e49978a78a9a7302ff129bc092203bcd08a0d

                  • C:\Users\Admin\AppData\Local\Temp\vbcEF3A375DBE8140C08B1E716928769419.TMP

                    Filesize

                    5KB

                    MD5

                    387784f57a2f90edee143411c749a86f

                    SHA1

                    fa730a840a2caf64f612d65634f6940af8bc73f5

                    SHA256

                    2a6c05b939a7b9fe43b8f936c7deddf4d096e54ac2eeb7bd1aa022ebf5b69a63

                    SHA512

                    5d71d66db1278e7316a42d6dda97b04669ba137d371fa4798eaf311b9d9d78a4c441cbe404dde93569baf64403d2054d0e4834640d6c80dbf5b82602b2c80ea6

                  • C:\Users\Admin\AppData\Local\Temp\vwfRtNH.txt

                    Filesize

                    70B

                    MD5

                    ee67e73252c29160f738f28771118fae

                    SHA1

                    969bfe134c3fb11ad04db32e594b6634c56a72b9

                    SHA256

                    0b36fab6078c10c82cb54f10ec68cb35cbd2c219534145ffd3fc7bc84649bb2d

                    SHA512

                    19c5b6fc0379c0310f7387933ed7e22e2ef9a3c01076518408da9472fcc5f2bc4026d894a8c35e52eaac1b5f227a69f443b210f7cb74737ee829f6d56f21f03d

                  • F:\Index\Client.exe

                    Filesize

                    5.0MB

                    MD5

                    6663483929f325b3fe2f8a351787aebf

                    SHA1

                    eaef70212f2f361a3167340d7c76e07246f1e427

                    SHA256

                    cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

                    SHA512

                    12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

                  • memory/3036-4-0x000000001C400000-0x000000001C462000-memory.dmp

                    Filesize

                    392KB

                  • memory/3036-7-0x00007FFBBF5C0000-0x00007FFBBFF61000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/3036-1-0x00007FFBBF5C0000-0x00007FFBBFF61000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/3036-3-0x000000001C250000-0x000000001C2F6000-memory.dmp

                    Filesize

                    664KB

                  • memory/3036-0-0x00007FFBBF875000-0x00007FFBBF876000-memory.dmp

                    Filesize

                    4KB

                  • memory/3036-2-0x000000001BD80000-0x000000001C24E000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4984-14-0x0000000075330000-0x00000000758E1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4984-16-0x0000000075330000-0x00000000758E1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4984-13-0x0000000075330000-0x00000000758E1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4984-17-0x0000000075330000-0x00000000758E1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4984-11-0x0000000000400000-0x000000000040C000-memory.dmp

                    Filesize

                    48KB

                  • memory/5040-18-0x0000000075332000-0x0000000075333000-memory.dmp

                    Filesize

                    4KB

                  • memory/5040-6-0x0000000000400000-0x0000000000422000-memory.dmp

                    Filesize

                    136KB

                  • memory/5040-8-0x0000000075332000-0x0000000075333000-memory.dmp

                    Filesize

                    4KB

                  • memory/5040-308-0x0000000075330000-0x00000000758E1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/5040-9-0x0000000075330000-0x00000000758E1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/5040-10-0x0000000075330000-0x00000000758E1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/5040-19-0x0000000075330000-0x00000000758E1000-memory.dmp

                    Filesize

                    5.7MB