Overview

overview

10

Static

static

3

a303abeb45...c8.exe

windows7-x64

10

a303abeb45...c8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-12-2024 23:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a303abeb45c17496d1134401d5f1e4e6804e6bf0ce192b28ec73951d1ee361c8.exe

  • Size

    959KB

  • MD5

    2873ffc6801b6f646d9f14f339e7e550

  • SHA1

    23329c57d5e345e5f5d5aff41164168e6e3228a6

  • SHA256

    a303abeb45c17496d1134401d5f1e4e6804e6bf0ce192b28ec73951d1ee361c8

  • SHA512

    16fdd7a22e01b5b5eb39b92c1ee96df0aa355a3a47d14f08ce887f3684cef65250d7675c035dab6de79054a0d39237746aa4aa67d055872643edb9753a9458cb

  • SSDEEP

    12288:j6oLLoS60/K7yh0necHIgCIzoLLZefb06B+lHDBb+qL2pG3N8XNC834U:j6oLAehgCpgfb0W+x4GQ74U

Score
10/10
revengeratdownloaderdiscoverytrojan

Malware Config

Extracted

Family

revengerat

Botnet

Downloader

C2

79.134.225.46:6606

borah22.accesscam.org:6606
Mutex

RV_MUTEX-RYBGldGoFYEKgHD

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • Revengerat family
    revengerat
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a303abeb45c17496d1134401d5f1e4e6804e6bf0ce192b28ec73951d1ee361c8.exe
    "C:\Users\Admin\AppData\Local\Temp\a303abeb45c17496d1134401d5f1e4e6804e6bf0ce192b28ec73951d1ee361c8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uikeySIwHrUi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D82.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2924
    • C:\Users\Admin\AppData\Local\Temp\a303abeb45c17496d1134401d5f1e4e6804e6bf0ce192b28ec73951d1ee361c8.exe
      "{path}"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cjbit0ey\cjbit0ey.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD124.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE75BA2F88C1543FAB42DB6DED99A8BDB.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:640
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3rj22f3q\3rj22f3q.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1996
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1C0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB16B5FDC41E4471CB417C47DE9B4F8B.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1948
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lm4kpzf2\lm4kpzf2.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD22E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCC894939EB4B4C5098E7BC21B51E929.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2688
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d4lxjacz\d4lxjacz.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD28B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFEE15796A0A8414DBBB354994C4D28E0.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2128
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hs4yaudi\hs4yaudi.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD308.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFF9F38855174A9D99F19B55CDA1BCD7.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:400
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0nczjdvb\0nczjdvb.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD366.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9E58623B178545F8904D488F64122AA.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1384
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5tzzsbmz\5tzzsbmz.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1232
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3B4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCF0FD6E64CA1400E8AF239FC6D6032E.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1552
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dh05zkpf\dh05zkpf.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1656
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD402.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE8ECC8E3B0254C7F99365D924464322B.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:888
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\byh05bav\byh05bav.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2076
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD45F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc800ED05E6FEA4372AA6816ABA9648DD7.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2504
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ezxvaqpe\ezxvaqpe.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:884
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD49E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1CFDC1B8F4914166BAB8DCBAFEF774CB.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2056
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nrjpkfhw\nrjpkfhw.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:788
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4FB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc60AEB4CDC1E1436D9C177066D83D59A8.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2580
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4xrigvu1\4xrigvu1.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1864
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD559.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc494CDA4BD29F4730A1D34CADDE3955DD.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2152
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5k12pgyw\5k12pgyw.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2876
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD597.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3713D69C32394B968E4B68DE7B6A3AA.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2780
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bmopvakl\bmopvakl.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2652
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5E5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A2FB421A2D64EACA97F94F147D4B2B7.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2920
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jt0h04p4\jt0h04p4.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2340
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD643.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDB6EC958772A4279B6B3ECEBFF0CDE3.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2668
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h4hqcn1n\h4hqcn1n.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2224
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD681.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc48FDAAC5B1F443A8991092516F7E1FB.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:940
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3acxsuz1\3acxsuz1.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2060
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6DF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBB87B49BB8154CDEB22FC2C1B7DDC7E9.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2352
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bj3gqjan\bj3gqjan.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1488
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD74C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc93A91D58DC564DB489A3485E6615F8.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1344
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vb3cuzyh\vb3cuzyh.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1292
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD7AA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2554BA9895EB417DB487D98D448B72.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:540
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kfrg0d4b\kfrg0d4b.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:620
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD807.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9007C17865694EDD93D83A73D4BA719.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2852
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5s24sjia\5s24sjia.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1444
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD874.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDEAF85B682A45DE81F6B9B10DFF7F9.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2980
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\aun125g4\aun125g4.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2952
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8B3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7076ACF08EB44F5AA3F8AE2D9D22682F.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2464
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pspmdn1l\pspmdn1l.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1052
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD910.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6758DB34CC0450C8728143D889CAB47.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:772
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qmfimeyl\qmfimeyl.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2596
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD96E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc910396E56A21447F938A2AC521EF8846.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1384
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bqsllvah\bqsllvah.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1760
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD9EB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc714187D18F343E9B3C5189151F1C9B5.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2028
      • C:\Users\Admin\AppData\Roaming\msword.exe
        "C:\Users\Admin\AppData\Roaming\msword.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:956
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uikeySIwHrUi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C5F.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2552
        • C:\Users\Admin\AppData\Roaming\msword.exe
          "{path}"
          4⤵
          • Executes dropped EXE
          PID:2096
        • C:\Users\Admin\AppData\Roaming\msword.exe
          "{path}"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\mswords\vcredist2010_x64.log-MSI_vc_red.msi.ico
    Filesize

    4KB

    MD5

    c398ae0c9782f218c0068cd155cb676c

    SHA1

    7c5bb00a34d55518a401cd3c60c8821ed58eb433

    SHA256

    9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3

    SHA512

    85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

    Download Submit

  • C:\ProgramData\mswords\vcredist2010_x64.log.ico
    Filesize

    4KB

    MD5

    cef770e695edef796b197ce9b5842167

    SHA1

    b0ef9613270fe46cd789134c332b622e1fbf505b

    SHA256

    a14f7534dcd9eac876831c5c1416cee3ab0f9027cf20185c1c9965df91dea063

    SHA512

    95c7392ffcf91eaa02c41c70a577f9f66aff4e6a83e4d0c80dbd3a2725f89f90de7ab6484497bf6e0a0802fd8ced042647b67c5ea4bee09e1b2be30b0db1f12f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\0nczjdvb\0nczjdvb.0.vb
    Filesize

    375B

    MD5

    39b0e02d661815460aae25f7807fa6e0

    SHA1

    6f459f82430e400de734c147d30ab1fc0e8fb031

    SHA256

    93edba831b445b727c57c3ce9b5d21a2c48e850f63854dc6403a806edcf05ac1

    SHA512

    3ba009d4d3d44e1961db16035f1fb7e54fa1304815166d0bfc8e64979364fc5f8495ed1765cbd168226f3564b0829215c914c9972fa3b8bcb8176f5342bce04a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\0nczjdvb\0nczjdvb.cmdline
    Filesize

    276B

    MD5

    d7ef3eafde440b801d9ee34b1a6ef9ba

    SHA1

    a74acf5290ac1f1f6e6bb510eb20267060d72f5d

    SHA256

    e39698f5358682aae764e65e8d1b9bc827d4c381b41d6c9441e6bf649369eb06

    SHA512

    d86ec490ac4792aa83e34203006b1f292dd36336b9b0bfe7ed3d8eb91d75b61c7767e5ca0580ed42729101cea117aea3d555e4ae441528c5b8c15563cee24534

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3rj22f3q\3rj22f3q.0.vb
    Filesize

    354B

    MD5

    b7ba083aee5ce555ef5f9b543796a61e

    SHA1

    5edf35afa0de83196c6fed083b76785f490a7a04

    SHA256

    4e28965b9652b063edf63bbe490e3542dfe6a54b5d31de6d73b650b1a814a802

    SHA512

    57e654261583f935c7490957043099c2a0f78ddf3daa85ef8a9dd4fa3a268173b16f24978a191afa2fde829a85f1a76a532d9bccb366d33e1783636c220f37c3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3rj22f3q\3rj22f3q.cmdline
    Filesize

    233B

    MD5

    e36e6e94207021fabad4c132f67cf8a0

    SHA1

    bff1ca48a9ab0440fe8ce5303293b8585a94d7e2

    SHA256

    a5e60c34ad5a1518c2c6491f486fc05cbd3748fdc69f7dc5f2d97bb8c6740cd2

    SHA512

    9b33b8338eee71506ff4478b608b098a2da5b38d04b82e9b4ed1c786b5d2e2ee741c7f2a97a9c5a3df8989fc6729f536d1369b206cd11a43c1fe71e41684cab1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4xrigvu1\4xrigvu1.0.vb
    Filesize

    374B

    MD5

    973ee0fba60af8ba4b1338fc3a6008aa

    SHA1

    7cf8ea39c82a2df29768796a22c90bb278c9c3d8

    SHA256

    55f85ead5672725c654e50c2c053ffd65dd599488dabd11268b5468d008d13be

    SHA512

    788053825bb1241daca33a0b9a451f4235db9dff2d279b592e25ea680ea1a74f2fc3e09157776ad323b5f229244ad3f54c35bedbf1220199e47a88796175f5b4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4xrigvu1\4xrigvu1.cmdline
    Filesize

    274B

    MD5

    2835788950128823e53ab4b1fab2cb60

    SHA1

    954e97bb83962804eb32d0f4c6d671862595e292

    SHA256

    a1fb2b91100e44e22219692333d12cf1392fb393e0454b4cd0953e7be97fd26d

    SHA512

    df690d892340e3500fe556338aa2c6a1a402642e0847a0bcb5f1ae1b204cef595ae536c53a7517b497e09daf4037bd692be9343aa5914ad7c8ece3fbbdafa34c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\5k12pgyw\5k12pgyw.0.vb
    Filesize

    377B

    MD5

    ddb58bf98ebb773c2a3fa6b84616acd1

    SHA1

    2e1c946bc3ff36e7e0019947c3ca3ea6cfb1f29b

    SHA256

    5b2ba53c9c014bd65aabd8c30255d679efa5c0585726076bec9e243f826f6df6

    SHA512

    489d55e227db08c81e26a851bdd0197429baaeb457ef1926782c360086bf73a569c7f51d74c1ff9a73d5e89b5e22a998ae011b45fc8b84aa2ab298ec38be3ac0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\5k12pgyw\5k12pgyw.cmdline
    Filesize

    280B

    MD5

    83c5e6e61fe21d81233774735063235f

    SHA1

    d8d8a0be930c6b9e91e6daddc6fca0dca9abc94e

    SHA256

    d78afcaa05329c0b60ef73b4121da880cd443549d7f29db8f27c043b305fb5a4

    SHA512

    b3b9cd42155621c9835fe3fc89d4445f30658a33be01dab743918a57d03b7b76b35358a645d615f22841a377989a04bb1051792370bcff072772ad3ba6e1a59a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\5tzzsbmz\5tzzsbmz.0.vb
    Filesize

    372B

    MD5

    eb8c611d99ee56cc01c46447174a89c2

    SHA1

    d7bfaf8ef2145cdefe43c1a73310ad99d1c43a97

    SHA256

    d601f2c5c080b0f2c5bf01b8516fdd83a1effd9b40ed4371ead7604a8008321f

    SHA512

    d5280505424f9689cabd21d7f227766ec8b59090544b04835e7d7f09fc826d54c29a9bfd7bbb78f832e029547c4c161e487d49a55873307ca796c5e3d282f748

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\5tzzsbmz\5tzzsbmz.cmdline
    Filesize

    270B

    MD5

    f37e354a244397acffb60dff7f7292e1

    SHA1

    e2cb3ce01a1ed6f6319c16b1791b6d272f1b6be9

    SHA256

    ae322adae96eddc23ab2b5f9450be7104fa7e6389bac393ee82a0958421e3ace

    SHA512

    40e4bd1e4e8e46baf337df75d6dd6d53f1f3f54bc2f47ef2d08c852637848a3dc75606b2b78cff93392dc37d9a6886916dc7cf273058eee9b795a9e036dfdf17

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD124.tmp
    Filesize

    6KB

    MD5

    ed6331d488e13dd31926fb0a04863805

    SHA1

    7f7e03ef9d2d5b04d5808f8e646c96055f5589a5

    SHA256

    ccc427fea7606b81d98bdab9494fd2ef233fa1875f784ef144b08541a3338ef0

    SHA512

    5b862cd7520847d64eed20f7e5063dd5ba1e98bee08f53fb1dc0e00d7b97f6cf7c854e6ae91d2ac07b148b3919d70877211774b4663fb8f4065c39c14bf1f265

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD1C0.tmp
    Filesize

    6KB

    MD5

    5d8b8f1a165d666651efa97e3623c8ce

    SHA1

    ae670055129c4570b6765177323771d014293719

    SHA256

    6d8c0a374fe70ce67f118bbf2514ad60f750a89236d4eec0a942565910b8c73b

    SHA512

    df89c777fa0a0a1e40e4c3a5415ea69041703dac2a28e64c4fb5a11756640b279624468364a272b56733cf63891cba2de03245457026a948c5c2ed9f37e8d8cb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD22E.tmp
    Filesize

    6KB

    MD5

    57bf0d9ad55fbea4151682d7adeb52f4

    SHA1

    d61b0ecf24af444c0d20841ec5f833048cf7316c

    SHA256

    9adc1be4bc1ac840032c079e0d46e04281f8b14a2d8650074a1e22b929930639

    SHA512

    bebbcf97192bd6540be2182e2ec93f62ed3a6a516832f49980631cf11a3d91f437ccc6f72c2a214c039260e974db422306e0064ebe0088efb2036624ce0671c7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD28B.tmp
    Filesize

    6KB

    MD5

    77b5822212872579fce190737595c8ff

    SHA1

    571e82c161159a2076d86800bd03d656756afd57

    SHA256

    2aace0915e848306404320f3b78f1f4c7ffbd0ae9fa5e3f73a6a2712160d47aa

    SHA512

    42ad8288780f90936f2d184d93d6c565078a55d46056d69f37735bb44bebf7ec9f58f35723b117c5b12ecf0616b8b7ecc2ef4574337a4dcfdfbd4ee7f8c3d8d4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD308.tmp
    Filesize

    6KB

    MD5

    b8f95a41d7e434b4477d751f944d44e5

    SHA1

    081891f06bdd29f0147c661f7718f9088d489f64

    SHA256

    5b8c4f5baa36237f905f3dcbf37ddfce4cbaadd5dea4e3b75562c913fa9ffa92

    SHA512

    dbcec87f318bb9b9187bd5bb4fb88c2126f845e3ef967ce9344249061cc627450e4dae2157e707c141587909b6c5f7f89552d6b11a085a85a270aa9a5b05370b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD366.tmp
    Filesize

    6KB

    MD5

    fbbb7f6650f51b7348561c3af6cd8214

    SHA1

    dacd9591a11fdaea6d2d153f8218510ba5bb9bfe

    SHA256

    070ab7ee57b6ab2b80c049f5f53bc137257392803f664624f04c961affb945c3

    SHA512

    2262dbaea6da835595ce645bd3f4e5d5aeffbf3d8f39b7d623095afb93b3889f7335589e91877c328f8eceac1735be997e45f35b6fe0808b405d65962730f822

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD3B4.tmp
    Filesize

    6KB

    MD5

    24ad8ead14d5f4c941eb9a6462c509bb

    SHA1

    7d28b09b2a3f8d5a4e2e60f3fdc3db11188ef8e5

    SHA256

    eb98069257b1e34ce265b453590ca28aa26ec42390637fe9dfc8b0e6fd851ae3

    SHA512

    3900519107d0001cd655201b642debde164617d028a691a6d0471179bfba36518fdd3d84789bceaaed5526048cb64478614eef96f5980ecf173bfb6f7fabc6be

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD402.tmp
    Filesize

    6KB

    MD5

    31640e5d189b4dce5852df79f20cf0ee

    SHA1

    16f3c2d2d78ff98417e7f8ce346c6e7bf8742da5

    SHA256

    fb3393ee61283352a8ebfe9b0312257544afa9245883dcde80ccdf9692687e47

    SHA512

    8e85ecbfa5cc6caee9c65be350f5a9b11621c7d1bc9bf9cd485eae8308969fd4ed7b11c0b09e815b28ec9e6bea91c9051b09d7bb5b47ab7162a0ba047221c171

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD45F.tmp
    Filesize

    6KB

    MD5

    91847483d7c8cd8af6fa4f23aad604dc

    SHA1

    699de3c67e52bcae70a2ada06c1cead16bf98416

    SHA256

    142254434dde43ef4071db342207156079544ec33c19a7d8ca57b633bb9d5637

    SHA512

    ca83aeae69134d6816b746e7c726f2096a51cd5273c20249e0c6531e85658bb6cb526481e262a77154657d1eabba100b90a731ccbe0f8980f614232b277e0211

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD49E.tmp
    Filesize

    6KB

    MD5

    b9e4eafb143d3dd04dece60c800ec92f

    SHA1

    7373b56717b45b027ddc61208b8ff6451e413e10

    SHA256

    9a1a3a40a003270e2156f29e6623aa6982a43d3dcd8839ebf265afa785ddcbce

    SHA512

    db05ddb6d7c6b09cc227c3c055866b2d2fb29f03345982d7b6762862030dfb04b94ab33e7e27eb869b3e0ecf67df49891c2e8899824b0f8bf565ea22a7de881c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD4FB.tmp
    Filesize

    6KB

    MD5

    5a1cf84b48207e5db272bc6fbf841855

    SHA1

    cac53c8bf01c45895018021bb85943cf82ce79f0

    SHA256

    7514f91b3a8a93e428b712dbe91ba187f4c34ea90bf7979723f32ca44b53aa2e

    SHA512

    e0013aad2a5928c405070d40705f58364cf0c68b340ded5b8b5f8994f7e447ef2682e662582c06e4ce740fdfbfdf595ea0ea46b9ff08f9c6d92d2d79124c9676

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESD559.tmp
    Filesize

    6KB

    MD5

    e57ca3959b698015ded42daee33fa4ab

    SHA1

    87c17295592f3e77fe6e108f1ecf2cb7b9fe1a34

    SHA256

    1e0396d56953b6a97e6349b59595c4bc2e228f70ce674b705c1835b7febd90b3

    SHA512

    36e7bbace0756bde9322214023c2107cd87975f791c79c85426575577bda2eaf58bbc8071c4961d45328683b5ae798db18a83400988f2e3dce6f91ec7034e66f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\byh05bav\byh05bav.0.vb
    Filesize

    349B

    MD5

    f7cc5c4548df84a4ba4ce359b798845a

    SHA1

    c1d4b3952405f24d1476a2481927395758dffb4d

    SHA256

    f6b39bd1cc9de8ba2f29c33db6d12708c892b7e6315d2bfa376d79160d3a91a6

    SHA512

    47add7b8348516328d688fe45244c8339404a9af8f3eda5fcf9683012cf20f70ace7d336f5b93f630c36b56e7035886fb799a840ea8a423c32de10dbb8d68ef7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\byh05bav\byh05bav.cmdline
    Filesize

    224B

    MD5

    933a26ba9670e9ecca401fc0d1a372fa

    SHA1

    440a1367a3ec49588ef00610470c8037f3f21223

    SHA256

    02403f3927eda28b422f7bca0d6f07911bda5b609735dd00fe2a0ddb216e2b4e

    SHA512

    dd9fd7dfa9928097bb910ab865551d95af641ea9eb440e509a674a0bc3b85e2aeca153c96020b096800505826a19d9ac4ae4bca8d49af858497633dda2996b87

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cjbit0ey\cjbit0ey.0.vb
    Filesize

    368B

    MD5

    ec1e749d09e29b39da3e49fb757d54c3

    SHA1

    64ea573813372400e484bd2a4938f5e18fc52bcf

    SHA256

    1e63296616323329eacbd1e3cc0fd6bb40c2a2d997f6bd38f391839a8257a249

    SHA512

    20fde5e913f0d7ec6440aca31a4da3ca1b310ed007ef7d59289911a2b5d24c9f4fc004a69922a02695f3655b4a66bff71c9641404bb8abaf1f43d05c6cb65ec3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cjbit0ey\cjbit0ey.cmdline
    Filesize

    262B

    MD5

    60c72942514b830fc4ab0fad9ab03dd2

    SHA1

    4a80910d7cc700e5836187f498dea1729d891fc9

    SHA256

    d15a3b33ca2c25e112ee0fd536dab19d416a0ce39460801898a233195df0b281

    SHA512

    e79f2140a0eb3de730e00ca231c8ad96a45a2850ee31c943d2c04175aa12214b44d4f5a5abe194dcc0c8871e357a9516c72c445c3f886930a516fa6c6ebc90f9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\d4lxjacz\d4lxjacz.0.vb
    Filesize

    354B

    MD5

    cbd19acde4ac544eac3527a58063aead

    SHA1

    c624df787a2e959374ef20fd45ba43d208b03a08

    SHA256

    8bb158c2882aed1697455d0c9c7d207f3459999859b75610297d562fc957248b

    SHA512

    c6f776fcd1c8d196a17c53c6602a4c5eafb08a3524ee6c880a01c2b44cbb3984bb324b0011378e3037759ab5eb52190542cc5d17e7e1657ab38307f2eb7a2e5e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\d4lxjacz\d4lxjacz.cmdline
    Filesize

    233B

    MD5

    b40c0d77d6f9acdbec5b62dac9733e4a

    SHA1

    ffb364abc07a0c6c4af5b92d2f878d545e114499

    SHA256

    ee2cfad4a0abaaaeff2507d87aab5af5e2fee039e82ad3b002b60e187cec6924

    SHA512

    57bfaa2b4a1aff13e24b1ca986edddbe7a1981144ab9e34b0851affedc65f60b42a07b061872ae24f7723a8ac9ddc38ebcec51fe3881606738acb8ee41aa0f53

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dh05zkpf\dh05zkpf.0.vb
    Filesize

    375B

    MD5

    555ff0d78fedaca065a7775b8a0f7a39

    SHA1

    9c7ec4e982bac8296d83418d190d25c0c6954ce6

    SHA256

    ec7ad573e26be1b1cfbf14fc08a7cb9d37a749b7d86b8c96f006dac160b7323d

    SHA512

    3af80720c1ccd7abb5ccfeb768c1554a380e875a5e7f752f8eb8dca34b83ad41ae293e3b7b3125ff73da36cede614f2eeb47cbf83004d52624c02e5aad0c331e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dh05zkpf\dh05zkpf.cmdline
    Filesize

    276B

    MD5

    88b790a034f42773dec7b68299ede8f2

    SHA1

    98624f2df45802ac8ec522449d4d77f468aa9452

    SHA256

    97d587b9c3917e2bd3615ceb1a1611f7ac856fc3b290e088781269c9451cbd5c

    SHA512

    fffce97bc62524bc41752dc13fea3448cbd67b13aecce46a5ffe94a7fbb9781d560521df22a6a0bace7492e0edb6263a161df94a97d9fac2610e1af4382d3ba1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ezxvaqpe\ezxvaqpe.0.vb
    Filesize

    374B

    MD5

    24e14059cb7f4e2a58dce1aa67672537

    SHA1

    56e5797141d987a2a88dbe63d950938905a68a1a

    SHA256

    a71494323e808a1283bf1632fb01d4c0076074ae1762530e2ed1dc4fc3cf0912

    SHA512

    7f684175a0f6f43d239bd668d7ebd824ea8fb257a0393ff65ee08d5379132276f36239a0fd5c70ed1eae4f88b8555aed1ce5e40cffe966fe77a839be6c8c907d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ezxvaqpe\ezxvaqpe.cmdline
    Filesize

    274B

    MD5

    3061c705005e9ae81475ded1748c796e

    SHA1

    961a361652acb42f7a108fe65de6445e11344ba3

    SHA256

    9ad4cfaef305630a763db5cfd3293192165dbc13c23656093dd13dadb9435947

    SHA512

    249d7ddd3574ed49d0a805e424175f7c8faf1d98004d402474cbc486a89bb2028881cf0b4b77c54a18acf9f7b5ccfb3702bd7e6d88704dadef01a3e8f88c2304

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\hs4yaudi\hs4yaudi.0.vb
    Filesize

    372B

    MD5

    d7c72f7614d8c855f494e6d8e7460063

    SHA1

    897d9251014fe09cab4b09b18a72a2169954bfde

    SHA256

    cd2a52f07be9aeb0daed60624eb60a0688d067686dd86d7b6b1ad451b19b8a95

    SHA512

    b61d582b5146305d4361861eeaff1761dd5ad81e21317387109c74907f8dcc7b385dab5b24b7b14d2eec2a9452325fb7e7e18bd3ce83e225d54eaa37127391ed

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\hs4yaudi\hs4yaudi.cmdline
    Filesize

    270B

    MD5

    11629a023f0ce73d2aa4d730ef11b408

    SHA1

    ba65216d6daa6b57e47cdd49f1094471367d1f8e

    SHA256

    99882e5c21892c84e85d677821d06359d40ba08e375149e561eab0524a2d5e79

    SHA512

    d497d3d74199da61ce80d490f95569073c45cb61b6f9caa72a1ffbc902fa278a56b6c9f40a8eff6a2d29ce07ca063bc0af7fb8a88f749f7fa6ab6b5e22cb6947

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lm4kpzf2\lm4kpzf2.0.vb
    Filesize

    368B

    MD5

    b1e9a082a09858e9dcecccdbc8f19a13

    SHA1

    80634dc925f1fca77af3505208e4a40b5e666f71

    SHA256

    f343014a1a810e6a348fab51c5ce7e7accf1ba3919556cf8e14567df9a5f2328

    SHA512

    333186d7fc88e452faa1075fe9e4e1ba5485f746ac5ecef020bf79cf07836fc949c5c07c72e64c7478f1d44a29d4985ce7a510f96b870abe418adc4a8bdc3236

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lm4kpzf2\lm4kpzf2.cmdline
    Filesize

    262B

    MD5

    70ad47d0b6d4e9bb8eaf7822f0c367f1

    SHA1

    44105e1e8cdafe11ce6dd511eaf2d9676cabaecf

    SHA256

    15953e8517824c4830bc656de4e5583d62b5000b7f9e19e6ec4d948da4e586ff

    SHA512

    a32329d99ca0ba0918377f9570291bbc75abfb8460608cce1ae597d90127eb07fc97468c4e84db26fa917aae0e15016c31ce3e5e1deaf52b19e9c93bf1d4a16d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nrjpkfhw\nrjpkfhw.0.vb
    Filesize

    377B

    MD5

    9c31313f9e8ab8198a3d244c804c672c

    SHA1

    93c549279ca36725f41beda1d9b3580f2b380180

    SHA256

    585fb32d37ab22de89f020e9e736b0ad1a81576231585abd3eb53477318b4261

    SHA512

    b84ea60e2ff21fde54b228c7358a039635250f250dfd6a3adc3a9e5b2984016a318c105ccec94bff6346033c52019dc7d0b1cf971c52e5b7e09e23296aa13fc1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nrjpkfhw\nrjpkfhw.cmdline
    Filesize

    280B

    MD5

    0605d575a34028af1568e6ff966e10e3

    SHA1

    36cd2b9bfd9d27c57691e5dce28c6cbd0d4dd537

    SHA256

    19e303346a21da9ed1f7bda1f12b958ad18c92d3af4bb247bfcf9981a3a6b810

    SHA512

    a688c24dedf134b809b87e7b1a7036d2a2d29fcfbf179354eeefc7300bf667153739229487527637903b35b301e11dba6f89c6193c276f05d9e43e74bc8a71d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp6D82.tmp
    Filesize

    1KB

    MD5

    c3f6d3b0f0b78fdb00a891d23ba799cf

    SHA1

    e37fdcc2cd2076542e8ef378e95fefb48d5bf6d8

    SHA256

    bad1df86742622d654bcace8c80f304b95587c52579fb4901c37a9d43a80655e

    SHA512

    e980f5772a5717d2149eee282f80291170bfa05c2437be399674bef933620d6d3806c756defa15e690fae1d49b91d639670d7341844f8aefb14412ee311a1ccc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbc1CFDC1B8F4914166BAB8DCBAFEF774CB.TMP
    Filesize

    5KB

    MD5

    42adcb7f48faf93eef4210ebc14fff40

    SHA1

    eb64b244de363e8dbee6b083fc2446028bbd9a47

    SHA256

    e832f87431ca4cce5cb273750937f4086642023c854eb133ff65f3a104865bb8

    SHA512

    9fe83d1913aa285efd740138acc28c214ecbe1a739357a76ce089e3a5bd87e85bb910ec15cdab4704c42bfcfb443bda903e5dd02fbeaffe7d292a4fd16facad3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbc494CDA4BD29F4730A1D34CADDE3955DD.TMP
    Filesize

    5KB

    MD5

    2cf223afee010f1030b6e9cd52bd4426

    SHA1

    461761b0d4053f69f62091951f4a9e2ceddc0bd6

    SHA256

    fb8a918b5b4a2ee40d3db20f7ecb72e1187b3051e71dfbdc2bebec733876ba61

    SHA512

    b50a986cc355510271cb3dc33dd705dca25ff4d182341b6c828157b48d158cbc1e865d91a2a8e3c92e2c9c8c22dc99d63cf1f06e69e7e605fb29d72dbb3c743a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbc60AEB4CDC1E1436D9C177066D83D59A8.TMP
    Filesize

    5KB

    MD5

    5c0f5c7b8355a706a16bb3b60a2f5b9c

    SHA1

    31d008784b7d3c9e8aa49e66f579036a500f18bd

    SHA256

    da5e44b80f1d4efe0680bccb3e7a236343bd77416c28ff13118a85bb4ea8ee53

    SHA512

    7d5141d084b9898df2940dca400802d5150d4f05c117de6361fc33deb2b90a018cb4580bf75e6df071004e73b671c7ef66c9c416af9a4bf2e2e9335e822177cd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbc800ED05E6FEA4372AA6816ABA9648DD7.TMP
    Filesize

    5KB

    MD5

    82ec96d13cf4b05dd95b11818565322e

    SHA1

    0d8194f0b47448f5b28268c67b948483e4c7e191

    SHA256

    6cb014d5c4d0b2ccc4b1b408849de32d03eb3f3d52bbe7d9423248b43d992ba0

    SHA512

    36c65a47a55b3d70d1e12cad59d60211c41df7da8e308f561dc6228f579810065883ef2c151b3a561e749b4d2dde16ce40392c180770d4839223f3cb672f6368

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbc9E58623B178545F8904D488F64122AA.TMP
    Filesize

    5KB

    MD5

    893b56696580986bbd72fc660583c88a

    SHA1

    08dead27e773589a1ef7f2d71f33de61d0001886

    SHA256

    bcf039b8c253b280dc696eb897ec65cf495bb2d1214bd12552271a33fc7d6f2f

    SHA512

    bd91678e0858816e145fa3c5ab6f7e716e2eadc0d5b00fbf5a98fa0f2ccfa5700252270ec38f0e50b6e7f08c81fb6e2693f25f3a5fdf991617530c46df7c1de1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbcB16B5FDC41E4471CB417C47DE9B4F8B.TMP
    Filesize

    5KB

    MD5

    162ba1bc9fe43ca03461b70601e8c20e

    SHA1

    d6c9555f5f88088575a1c98f21fd58e861a2cfb5

    SHA256

    19574acccf5f42edac6c6f805b4ea7da7dcf75d8df886a12be8dfb38ac9a4ecb

    SHA512

    25cee74e7780465071f61992f4c4a91ee768fa11030ac2d066f0cbae4fe431b843ea91a0601b42fe0d5db3d2a437f0970e51c298299d1129c8f419fd75545bcf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbcCC894939EB4B4C5098E7BC21B51E929.TMP
    Filesize

    5KB

    MD5

    258ced0a507e39553af7221e87cbc636

    SHA1

    0fd08c4b2a08afcd4b1f7f0f38773c4bbb2126b0

    SHA256

    dbf8bb7a1d36959fa1c118f375be3541e953dc9276f83409aaf481c2841cd203

    SHA512

    f0c6d2597d8d85603f1cbb1b58eacb7f3c771d2b6f363dea34bb20266aff295bfb3ab0d7b26a73fde220b6bba37e859b1203947bf192b52cb30249a02deffd62

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbcCF0FD6E64CA1400E8AF239FC6D6032E.TMP
    Filesize

    5KB

    MD5

    8663ba191bc52bb4524a58dd3b969240

    SHA1

    f37f91405ed085f6e01a8434de0c808bb0e2e7b1

    SHA256

    a4e1e0f2e83b9927612059575de3291dc93abca33e327591ad282a60b92b5e83

    SHA512

    c5bcb7cb28a048f8ffa365df60b767fb2bce95916f6042ffc7c275205f955c7aa2e26f87ba2e00ef17be8f178d7e17207663ca4afeb70a158cab0e23cc1bca65

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbcE75BA2F88C1543FAB42DB6DED99A8BDB.TMP
    Filesize

    5KB

    MD5

    9cab4648aadf6757ebd9fe168e6be5b9

    SHA1

    361e15dad34e87b1964c19675f83c82a2943e088

    SHA256

    3fdab6d5e73c469ac4b8356ef0d8a60c5d692233d3b6b8a37ee03eba4563999d

    SHA512

    a50ab0417b5e06608f5ae42aca0cc26b31d2805de8e601d4fcaa2a091284f7673e0f918533931eae024d1b94b8c4aa6fc516290776191b015b389f937d89a410

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbcE8ECC8E3B0254C7F99365D924464322B.TMP
    Filesize

    5KB

    MD5

    cc2d8abc84eacecbb3989a7fc3afa073

    SHA1

    27d86a8e7d80c218b60fb6cc7f0b294c98290feb

    SHA256

    ab06306fcccac94044f1feb8fe2f54e67b066aad3bcb4739387e109d497ab254

    SHA512

    760a8307354daf9df63aedf8917350e8b04f58324baeabe8b279f610f75da602aa312bbee3eef6e16656743db0968690c7dd8892d244690719eba6a9ca628305

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbcFEE15796A0A8414DBBB354994C4D28E0.TMP
    Filesize

    5KB

    MD5

    bfbc295245e30d86761194d7f46d9206

    SHA1

    15cc61b354f70f70934d98d9f4062763afd5f89c

    SHA256

    ccff9d2f689e8ebe5171198b20322b6f9123db27602fd8b2bb5a6779ef76dc50

    SHA512

    3720a5e1f9c10adbf1f3ca28ad661390210abbae8c5b3182a9e5b0ce5628b33fc39e6ed33021c47aea5cf61868135f3d98219923c379e1a06dcd14c255809e86

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbcFF9F38855174A9D99F19B55CDA1BCD7.TMP
    Filesize

    5KB

    MD5

    360f4f71cc9113e8b6876ddb212d0650

    SHA1

    87164731ac95a0399e1037d4aad11e9dbba6305d

    SHA256

    308021509f5ad4a83d3c402a3211264f4a6e88bb95b5b23fde187b8ffbe463df

    SHA512

    993a81530bfb15b9278494b447c8bb28e773d60d2663c1b1d33349c67b08f88a96710ab30ac76b146449e82aaab53bf25a13be04ef3e7b1810221b17fb8ec137

    Download Submit

  • F:\mswords\msword.exe
    Filesize

    959KB

    MD5

    2873ffc6801b6f646d9f14f339e7e550

    SHA1

    23329c57d5e345e5f5d5aff41164168e6e3228a6

    SHA256

    a303abeb45c17496d1134401d5f1e4e6804e6bf0ce192b28ec73951d1ee361c8

    SHA512

    16fdd7a22e01b5b5eb39b92c1ee96df0aa355a3a47d14f08ce887f3684cef65250d7675c035dab6de79054a0d39237746aa4aa67d055872643edb9753a9458cb

    Download Submit

  • memory/956-376-0x00000000003A0000-0x00000000003B4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/956-371-0x0000000001270000-0x0000000001366000-memory.dmp

    Filesize

    984KB

    Download

  • memory/1964-384-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2104-2-0x0000000074790000-0x0000000074E7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2104-5-0x0000000074790000-0x0000000074E7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2104-0-0x000000007479E000-0x000000007479F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2104-1-0x0000000000AD0000-0x0000000000BC6000-memory.dmp

    Filesize

    984KB

    Download

  • memory/2104-7-0x0000000000A60000-0x0000000000AB8000-memory.dmp

    Filesize

    352KB

    Download

  • memory/2104-3-0x0000000000390000-0x00000000003A4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2104-27-0x0000000074790000-0x0000000074E7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2104-4-0x000000007479E000-0x000000007479F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2104-6-0x0000000004EB0000-0x0000000004F54000-memory.dmp

    Filesize

    656KB

    Download

  • memory/2364-21-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2364-364-0x000000006F560000-0x000000006F96B000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/2364-11-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2364-26-0x0000000074790000-0x0000000074E7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2364-15-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2364-28-0x0000000074790000-0x0000000074E7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2364-19-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2364-24-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2364-365-0x000000006F150000-0x000000006F55F000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/2364-366-0x000000006E8E0000-0x000000006F144000-memory.dmp

    Filesize

    8.4MB

    Download

  • memory/2364-375-0x0000000074790000-0x0000000074E7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2364-372-0x000000006F560000-0x000000006F96B000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/2364-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2364-13-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2364-25-0x0000000074790000-0x0000000074E7E000-memory.dmp

    Filesize

    6.9MB

    Download